Data processing summary

Last updated . This summarises how (“we”, the processor) handles personal information for an organisation that uses CourseDeck (“you”, the controller). It is the basis of the data processing terms we will agree with you in writing; the signed version is the one that binds us. It goes with the terms and the privacy notice.

1. What we process, for whom and why

Subject matter and purpose: running CourseDeck for your organisation: storing your facilitators’ content, signing people in, running sessions, and showing results to the facilitator.
Duration: for as long as your organisation uses CourseDeck, then as set out in section 8.
People: your facilitators and administrators, and the learners who join sessions.
Kinds of information: names or nicknames, email addresses (facilitators and administrators), what facilitators save, learners’ answers, scores, chat messages and requests for help, and the optional “about me” line. We do not ask for sensitive (special category) information, and you should tell learners not to enter any.

2. Our promises

We process the information only on your documented instructions (the terms, your use of the service and your written requests), unless the law requires otherwise, in which case we will tell you first if we are allowed to.
Everyone who can access it is bound by confidentiality, and access to production systems is limited to the people who need it.
We keep it secure (section 4) and help you meet your own security duties.
We help you respond to requests from people about their information (section 6), and with your own duties on breaches and impact assessments.
We give you what you reasonably need to show that we meet these promises, and allow audits as set out in the written agreement [reasonable notice, once a year, at your cost].

3. Sub-processors

You agree that we may use these to provide CourseDeck. We will tell your administrators in writing [30 days] before adding or replacing one, and you may object.

Who	What for	Where
Amazon Web Services	Hosting, database, file storage, sign-in (Cognito), email delivery, content delivery	Ireland (eu-west-1); the website’s pages are delivered by CloudFront’s worldwide network
Stripe (only if you pay by card)	Taking payment. An independent controller of the payment details it holds.	EU and US, under its standard contract terms and transfer safeguards
Optional, only if switched on for your deployment: Anthropic, Google (Gemini, Maps), Stability AI models via Amazon Bedrock, Shodan, WiGLE, GrayHatWarfare	The activity that uses them (AI text and images, look-ups, map displays). What a user types into that activity is sent to the provider.	Mostly the United States (Bedrock images default to US West, Oregon)

4. Security measures

Information is encrypted in transit and at rest, and held in private AWS storage.
Each organisation’s deployment has its own database, storage and sign-in, kept apart from every other.
Passwords are handled by Amazon Cognito and are never seen by us.
Daily backups, with the database rewindable for up to 35 days, and alarms for errors and failed backups.
Learners’ session data expires automatically (about 17 days); other retention is in the privacy notice.

5. International transfers

Your deployment is stored in Ireland. Information goes outside the UK and the EEA only through a sub-processor in section 3, under that provider’s standard contract terms and transfer safeguards. The optional services are off unless an administrator sets them up; we will tell you which are on.

6. People’s requests

If someone asks us about their information, we pass the request to you without answering it ourselves, unless you tell us to. Facilitators can export their organisation’s content through the administrator pages, and we can find, correct or delete information on your instruction.

7. If something goes wrong

If we become aware of a breach affecting your organisation’s information, we will tell your administrators without undue delay [and within 48 hours], with what we know about what happened, what information is involved, and what we are doing, so you can meet your own duty to tell the ICO (within 72 hours of when you become aware).

8. When it ends

When the arrangement ends we will give you [30 days] to export your content, then delete your deployment: its database, files and sign-in accounts. Deleted data can remain in backups for up to 35 days and is then gone. On request we will confirm in writing that it has been deleted.

9. Contact

, . Email . ICO registration number .