Privacy Policy
1. Who We Are
Teacher Planner is an online platform operated by EduBox Ltd ("we", "us", "our") that helps teachers and schools manage lesson planning, track homework, organise seating plans, and run live teaching sessions.
We are registered in England and Wales. Our contact details for data protection matters are:
- Email: support@teacherplanner.uk
- Website: teacherplanner.uk
2. For Schools: GDPR at a Glance
We understand that schools need clear, straightforward answers about data compliance. Here is a summary of what matters most:
- Your school is the Data Controller for any pupil or staff data entered into Teacher Planner. You decide what data is entered and how it is used.
- EduBox Ltd is the Data Processor. We process data only on your behalf, following your instructions, and never for our own purposes.
- All data is hosted on EU servers (Railway.com infrastructure, EU region). No data is transferred outside the EU/UK.
- We collect only what is needed to run the service. We do not collect pupil dates of birth, addresses, UPNs, or sensitive category data.
- We never sell data to third parties, advertisers, or data brokers.
- School administrators have full control over user accounts, and can delete staff accounts and all associated data at any time.
- You can request a Data Processing Agreement (DPA) at any time by emailing support@teacherplanner.uk.
3. Data Controller & Processor Roles
Under UK GDPR, different parties have different responsibilities depending on whether they are a controller or a processor of personal data.
Data Controller
Your School / You (individual users)
- Decides what personal data is entered into the platform
- Determines the purpose for which data is used
- Responsible for ensuring lawful basis for processing (e.g. legitimate interest, consent)
- Manages Subject Access Requests from staff or parents
Data Processor
EduBox Ltd (Teacher Planner)
- Stores and processes data only on the controller's instructions
- Implements technical and organisational security measures
- Does not use data for any purpose beyond providing the service
- Reports any data breaches to the controller without undue delay
Individual (non-school) users: If you use Teacher Planner as an individual teacher (not through a school), you are both the data controller and the user. The same protections apply to your data.
4. What Data We Collect
| Category | Data Collected | Why |
|---|---|---|
| Account data | Username, email address, first name, last name, password (hashed) | To create and manage your account |
| School data | School name, department, role (teacher/admin/etc.) | To link you to your institution and set permissions |
| Teaching content | Schemes of work, lesson plans, session notes, resources, homework tasks | Core service functionality |
| Class data | Class names, year groups, subjects, seating plans | To organise your teaching |
| Student data (optional) | First names and surnames (or preferred names), gender, SEN/EAL/PP/MA/LAC flags | Homework tracking, seating plans, and classroom tools. Entered by teachers at their discretion. |
| Technical data | IP address, login timestamps, browser type | Security, troubleshooting, and abuse prevention |
5. Why We Collect It (Purposes)
- Providing the service: Lesson tracking, homework management, seating plans, live sessions, scheme of work management
- Account management: Creating accounts, authenticating users, managing roles and permissions
- Security: Preventing unauthorised access, detecting misuse, logging audit trails
- Service communications: Sending password resets, email verification, and essential service notices
- Improvement: Understanding usage patterns (in aggregate) to improve the platform
We do not use your data for advertising, profiling, automated decision-making, or any purpose unrelated to providing the Teacher Planner service.
6. Legal Basis for Processing
| Purpose | Legal Basis (UK GDPR Art. 6) |
|---|---|
| Providing the platform and its features | Contract — necessary to deliver the service you signed up for |
| Account security and fraud prevention | Legitimate interest — keeping the platform secure |
| Essential service emails (verification, password reset) | Contract — necessary for account operation |
| Processing student data on behalf of schools | Legitimate interest of the school (controller) — we process as instructed |
| Optional marketing emails | Consent — you can opt out at any time |
7. Who We Share Data With
We do not sell, rent, or trade personal data. Data is shared only with:
| Recipient | Purpose | Safeguards |
|---|---|---|
| Railway.com (hosting) | Infrastructure — servers, database hosting | EU-based servers; data processing agreement in place |
| Zoho Mail (email) | Sending transactional emails (verification, password reset) | EU data centres; GDPR-compliant processing |
| School administrators | Managing staff accounts within their own school | Access limited to their own school's data only |
We will also disclose data if required by law, a court order, or to protect the safety of users.
8. Where Data Is Stored
Our application and database are hosted on Railway.com infrastructure in an EU region. No personal data is transferred to, stored in, or processed in countries outside the EU/UK. This means there are no international transfer risks and no reliance on Standard Contractual Clauses or adequacy decisions for data storage.
9. How We Protect Data
Technical Measures
- Encryption in transit: All connections use HTTPS/TLS encryption
- Encryption at rest: Database storage is encrypted
- Password security: Passwords are salted and hashed using industry-standard algorithms (Werkzeug/PBKDF2). We never store plaintext passwords.
- Role-based access: Users can only see data they are authorised to access (their own classes, their own school)
- Rate limiting: Protection against brute-force login attacks
- Security headers: CSP, X-Frame-Options, HSTS, and other protective headers
- Audit logging: All data-changing operations are logged for accountability
Organisational Measures
- Data minimisation: We only collect what is needed for the service
- Purpose limitation: Data is only used for delivering the Teacher Planner service
- Access control: Only authorised personnel can access production systems
- Breach notification: We will notify affected data controllers (schools) and the ICO within 72 hours of becoming aware of a personal data breach, as required by UK GDPR
10. How Long We Keep Data
| Data Type | Retention Period | After Expiry |
|---|---|---|
| Active user accounts | While the account remains active | Deleted 12 months after last login, or on request |
| Teaching content (schemes, sessions, homework) | While the account is active | Deleted with the account |
| Student names and class data | Up to 3 academic years (to allow cross-year access), or until deleted by the teacher/school | Permanently deleted; cannot be recovered |
| Individual trial accounts | 90-day trial period, then 30 days grace | Account and data deleted after grace period |
| Activity & audit logs (IP addresses, login times, page views, data changes) | 365 days (1 year) | Automatically purged by the system. Logs are used for security monitoring, fraud prevention, and improving the service. They are never sold or shared with third parties. |
Schools and individual users can request earlier deletion at any time by contacting support@teacherplanner.uk. School administrators can also delete user accounts directly from the admin dashboard.
11. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
Request a copy of the personal data we hold about you.
Correct inaccurate or incomplete data. You can update most data directly in your account settings.
Request deletion of your personal data. School admins can do this from the dashboard; individuals can email us.
Limit how we process your data in certain situations.
Receive your data in a structured, machine-readable format (JSON). Available via the Data Protection page.
Object to processing based on legitimate interests or for direct marketing.
To exercise any of these rights, contact support@teacherplanner.uk. We will respond within 30 days.
12. School Data Control
Schools that subscribe to Teacher Planner retain full control over their data:
- User management: School administrators can create, verify, deactivate, and delete staff accounts at any time
- Data visibility: Teachers can only see their own classes and data. Administrators can see data within their school only. No cross-school data sharing occurs.
- Data deletion: Administrators can remove any user and their associated data. Deleted data is immediately and permanently removed.
- Data export: Schools can request a full export of their data at any time
- Account closure: If a school leaves the platform, all school data (users, classes, schemes, student data) is deleted within 30 days of the request
- Data Processing Agreement: A formal DPA is available on request to support your school's GDPR documentation
13. Student Data
Student data that teachers may choose to enter includes:
- First names (or preferred names)
- Gender
- SEN, EAL, Pupil Premium, More Able, and Looked After Children flags
- Homework completion records
- Seating plan positions
This data is stored within the teacher's account and is only visible to the teacher and their school administrator. It is the school's responsibility (as data controller) to ensure they have a lawful basis for teachers entering this data (typically legitimate interest for educational administration).
14. Cookies
Teacher Planner uses only essential cookies required for the service to function:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you logged in while using the platform | 2 hours (or until you log out) |
| CSRF token | Protects against cross-site request forgery attacks | Session |
We do not use analytics cookies, advertising cookies, or any third-party tracking cookies. No cookie consent banner is required because we only use strictly necessary cookies.
15. Children's Privacy
Teacher Planner is intended for use by teachers and school staff. It is not designed for, marketed to, or accessible by children. Students do not create accounts or interact with the platform directly.
Where student names are stored within the platform, this is done by teachers as part of their professional duties. The school, as data controller, is responsible for ensuring appropriate safeguards and consent are in place.
16. Changes to This Policy
We may update this privacy policy from time to time. If we make significant changes that affect how personal data is handled, we will:
- Notify all registered users by email
- Display a notice on the platform
- Give at least 30 days notice before changes take effect
Continued use of the service after the effective date constitutes acceptance of the updated policy.
17. Contact & Complaints
For any questions about this privacy policy, to exercise your data rights, or to request a Data Processing Agreement:
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113