Who is responsible
For pupil information, the school is the data controller and [Company name] Ltd is the data processor, under the School Data Processing Agreement (UK GDPR Article 28). For the accounts of teachers, parents and school administrators, [Company name] Ltd is the controller. ICO registration: [ICO registration number].
What we hold
- Pupils: first name and (optionally) surname, pupil number and birthday (day and month); class; attendance; rewards, points and points taken away; badges; teacher comments and report comments; house. No photos of pupils, and no special category data is needed: we ask teachers not to add health or other sensitive details in comments.
- Teachers and school administrators: name, email address, optional phone number and profile picture, school, and login records.
- Parents: name, email address, which child they are linked to, and login records.
Who can see what
| The class teacher | Their own classes and pupils: names, rewards, points taken away, attendance, comments and reports. |
|---|---|
| Parents | Only their own child: their Kudoling, points, positive behaviour, points taken away, badges and end-of-term report. Never other children. |
| School administrators | For teachers who join the school account: teachers’ names and classes; pupils’ names, level and points; records and comments from the last 60 days; whether a parent is linked. View only: they can’t change or delete anything. |
| The class, on the board | Pupils’ first names and their Kudolings. A view-only link (for a display screen or parents’ evening) shows no names at all. |
| Other teachers | If visits are switched on (the teacher can turn them off), visiting teachers see the class’s aquarium or sky with each Kudoling’s name, not pupils’ names. First names appear only if the teacher chooses to show them. Surnames and records are never shown. |
| Kudolings staff | Only authorised staff, to run and support the service, through a protected administration area. |
Where it is stored: our service providers
| Provider | What it does | Location | Safeguard |
|---|---|---|---|
| Namecheap, Inc. | Hosting: web server, database, backups and account emails | Amsterdam, Netherlands (EU) | UK adequacy regulations for the EEA |
| Cloudflare, Inc. | Secure connection and protection from attacks: every request passes through its network | Global network; USA company | UK Extension to the EU–US Data Privacy Framework and/or the International Data Transfer Addendum |
No other company receives pupil data. Fonts and icons are served from our own servers, and pages load no third-party scripts. We will give schools notice before adding a new provider.
How long we keep it
| Accounts, classes and pupil records | While the account is open. Deleting an account removes the details straight away (pupils’ names, numbers, birthdays and comments too); points and attendance rows remain without any name. |
|---|---|
| Pupils removed by a teacher | Name, number, birthday and comments are deleted one year after removal. |
| Login records (IP address, country, browser) | 365 days. Failed login attempts: 30 days. |
| Notifications, activity records and messages sent to us | 1 year. |
| Database backups | Taken before every update and deleted after 30 days. |
| When a school’s agreement ends | Pupil data is deleted or returned, as the school chooses (School Data Processing Agreement, section 8). |
How we protect it
- All connections are encrypted (HTTPS), and browsers are told to use HTTPS only (HSTS).
- Passwords are stored with Argon2id, a one-way hashing method; nobody at Kudolings can see them.
- After 5 failed logins for an account within 15 minutes, logging in is paused for 15 minutes; there are also limits per network.
- Sessions end after 60 minutes without activity and after 12 hours at most. Changing your password logs out your other devices.
- Session cookies are HttpOnly, Secure and SameSite, every form is protected against cross-site request forgery, and a strict Content Security Policy blocks third-party scripts.
- Teachers only ever reach their own classes and parents only their own child: every request is checked on the server.
- Parent invitation codes are single-use and expire after 14 days; teachers approve parents who join with the class link.
- Uploaded profile pictures are re-drawn, so hidden data such as location is removed.
- Administration is restricted to authorised staff, needs two-step login with an authenticator app (a staff member’s own device can be remembered for up to 30 days), uses a separate unpublished address, and every sign-in attempt is recorded.
If something goes wrong
If a personal data breach affects a school’s data, we tell the school without undue delay and in any case within 48 hours of becoming aware of it, with what we know and what we are doing, so the school can decide whether to report it to the ICO.
Requests and rights
Teachers, parents and school administrators can download their data (“Download my data”) and delete their account (“Delete my account”) on their profile page. Schools handle subject access requests about pupils, and we help them. For anything else, contact us at kudolings.com/#contact.