About TrIBe TrIBe VIP đź‘‘ Resource Store Blog
Become a Member
About TrIBe TrIBe VIP đź‘‘ Resource Store Blog
Become a Member

Schools & Under-18s Privacy Addendum for GradePod Ltd

Last updated: 1 September 2025

A) How we work with schools

When a school buys licences, the school is the data controller for student data and GradePod acts as a data processor. We process student data only on the school’s documented instructions and for educational purposes. Schools and students own their personal data.

B) Legal compliance

  • GDPR: we follow UK GDPR (and EU GDPR where applicable) as processor for school-provided data.

  • FERPA (US): we operate as a “school official” with a legitimate educational interest, and do not disclose student education records except as directed by the school or required by law.

  • COPPA (US under 13): we rely on verified school or parental consent before creating accounts for learners under 13. GradePod does not knowingly allow under-13 self-registration.

C) Data we process for schools

  • Student identifiers, for example name, email

  • Learning records, for example progress, assessments, activity logs

  • Support interactions relevant to the student’s use of GradePod
    We do not collect unnecessary sensitive categories.

D) Third-party processors and accountability

We use vetted service providers, for example Kajabi for hosting and Stripe for payments where relevant. Each is contractually required to protect data and process only to provide their service to us. We remain responsible for their compliance for the services they provide.

E) Security

Data is encrypted in transit and at rest where supported by our vendors. Access is role-based and logged. We enforce good password hygiene and support SSO/MFA where available.

F) Retention and deletion for cohorts

  • Retention: student accounts and learning records are retained until the exam window ends, then deleted within 12 months, unless the school instructs otherwise or law requires longer retention.

  • Deletion on request: the school may request complete deletion at any time via [email protected]. We will delete across our systems and instruct processors to do the same, subject to legal holds.

G) Data location and transfers

If data is transferred outside the UK/EU, we use lawful transfer tools such as Standard Contractual Clauses.

H) Accessibility

We are committed to accessible learning. Captions are provided for videos, our site supports screen readers, and we consider reasonable adjustments on request via [email protected].

I) Contact

GradePod Ltd, 5 South Charlotte Street, Edinburgh, EH2 4AN, United Kingdom
Email: [email protected]