Tutwoo Kids for schools – data processing agreement
Last updated: 29 October 2026
1. About this agreement
This agreement is between Tutwoo UK Limited (company number [company number to be added]), 167–169 Great Portland Street, Westminster, London, W1W 5PF (“Tutwoo”, “we”, “us”) and the school or other organisation that registers for Tutwoo Kids for schools (“the school”, “you”).
It sets out how we handle personal information on your behalf when your school uses Tutwoo Kids (kids.tutwoo.com). It meets the requirements of Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It forms part of our terms for schools, and applies from the moment your school registers until all school personal information has been deleted as described in section 12. If anything in the terms for schools conflicts with this agreement on data protection, this agreement applies.
2. Words we use
- School personal information: personal information about pupils and staff that your school, its staff or its pupils put into Tutwoo Kids for schools, or that the service creates when they use it (for example progress and quiz results). Schedule 1 lists it.
- Controller, processor, personal data breach and data protection impact assessment have the meanings given in the UK GDPR.
- Sub-processor: another company we use to process school personal information for you. Schedule 3 lists them.
3. Who is responsible for what
Your school is the controller of school personal information. Tutwoo is your processor: we process it only to provide Tutwoo Kids for schools to you.
Tutwoo is a separate controller for a small amount of information we need to run our own business: the contact details of your lead account holder and of anyone who contacts us, billing and payment records, and technical security records needed to protect the service. Our privacy policy explains how we use that information.
If a parent links their own Tutwoo Kids parent account to a pupil using a parent code your school has given them, the parent’s own account is covered by our privacy policy. What the parent can see about the pupil is set by your school, and you can remove parent access at any time.
4. Your instructions
We process school personal information only on your documented instructions. Your instructions are this agreement, the terms for schools, the choices you make in the school dashboard (for example adding or deleting pupils, setting work, connecting Google or Microsoft sign-in, or giving parents a code) and any other written instructions you send to [email protected]. This includes instructions about transfers outside the UK (see section 8).
We will not use school personal information for any other purpose. In particular we do not use it for advertising or marketing, we do not sell it, and we do not use pupils’ information to build profiles for anyone other than your school. If the law requires us to process it in another way, we will tell you first unless the law forbids that. We will tell you straight away if we believe an instruction from you breaks data protection law.
5. Confidentiality
Everyone we allow to access school personal information is bound by a duty of confidentiality, through their contract or a statutory duty, and only accesses it when needed to provide, support or secure the service.
6. Security
We use appropriate technical and organisational measures to protect school personal information, as required by Article 32 of the UK GDPR. Schedule 2 describes them. We review them regularly and may improve them, but we will not reduce the overall level of protection.
7. Sub-processors
You give us general written authorisation to use the sub-processors listed in Schedule 3. Before we add or replace a sub-processor, we will email your lead account holder at least 30 days in advance. You may object on reasonable data protection grounds within that time. If we cannot resolve your objection, you may end your school plan without penalty before the change takes effect, and we will refund any fees you have paid for the period after it ends.
Each sub-processor is bound by a written contract with data protection obligations equivalent to those in this agreement. We remain responsible to you for their work.
8. Transfers outside the UK
The website and its database are hosted in the UK or the European Economic Area (EEA), which the UK recognises as having adequate data protection. Some sub-processors may process information outside the UK, as shown in Schedule 3. Where they do, the transfer is protected by a safeguard recognised under UK law, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified.
9. Helping with rights requests
Pupils, parents and staff have rights over their information, such as access, correction and deletion. Your school dashboard lets you see each pupil’s information, download class reports and delete pupils. If we receive a request directly that relates to school personal information, we will pass it to you within 5 working days and will not respond ourselves unless you ask us to. We will give you any reasonable further help you need to respond within the legal time limits.
10. Personal data breaches
If we become aware of a personal data breach affecting school personal information, we will tell your lead account holder without undue delay, and in any event within 48 hours. We will give you the information you need to decide whether to report it to the Information Commissioner’s Office (ICO) and to tell the people affected, and we will update you as we learn more. We will take reasonable steps to contain the breach and reduce its effects.
11. Other help
We will give you reasonable help with your obligations to keep information secure, to carry out data protection impact assessments, and to consult the ICO, taking into account the nature of the processing and the information available to us. On request we will provide a description of the service and its data flows for your impact assessment.
12. How long we keep school personal information, and deleting it
- While your school uses the service, you decide what is kept. Deleting a pupil or a class in the dashboard deletes the pupil accounts with their progress, quiz results, report comments and owl tutor questions.
- Owl tutor questions and answers are deleted automatically after 90 days, and log-in records after 30 days.
- When a trial or school plan ends, you can still log in to view and download reports and delete pupils. Unless your school starts or renews a plan, we will delete all pupil and teacher accounts, classes and the information linked to them within 90 days of the end date. If you would like us to delete everything sooner, email us and we will do so.
- Returning information: before deletion you can download class reports as spreadsheets. If you would like a copy of other school personal information, ask us before deletion and we will provide it in a commonly used format.
- Backups: deleted information is removed from our live systems straight away or within 30 days, and from backups when they are overwritten in the normal backup cycle. Until then it is kept secure and not used for anything.
We keep information after this only where UK law requires it, and only for as long as it requires.
13. Showing that we comply
We will make available the information you reasonably need to show that we meet our obligations under Article 28 of the UK GDPR. We will allow and contribute to audits and inspections by you or an auditor you appoint, on reasonable written notice of at least 30 days, during normal working hours, no more than once a year (unless the ICO requires it or there has been a personal data breach), and subject to reasonable confidentiality terms. We may first offer written answers to your questions and relevant documents, which may make an audit unnecessary.
14. Your school’s responsibilities
As controller, your school is responsible for:
- having a lawful basis for using Tutwoo Kids with your pupils (state-funded schools often rely on their public task) and completing any data protection impact assessment you consider necessary;
- telling pupils and parents how their information is used, for example in your school’s privacy notice;
- entering only the information the service asks for: a first name, the first letter of the surname, a class and, if you use school sign-in, a school email address. Please do not enter full surnames, dates of birth, photos, health information or information about special educational needs, or any other special category information;
- making sure only authorised staff have school accounts, keeping login cards and passwords safe, and removing staff who leave;
- deciding whether to give parents a parent code, and whether to connect Google or Microsoft sign-in.
15. Liability
Each party’s liability under this agreement is subject to the limits in the terms for schools, except where the law does not allow liability to be limited.
16. Changes and governing law
We may update this agreement to reflect changes in the law, in ICO guidance or in the service. We will email your lead account holder at least 30 days before any change that affects how school personal information is processed. This agreement is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction, except where the law gives you the right to bring a claim elsewhere in the UK.
Schedule 1: details of the processing
| Subject matter | Providing Tutwoo Kids for schools: online courses, quizzes, skills checks, AI owl tutors, class management, progress reports and parent reports. |
|---|---|
| Duration | From registration until deletion under section 12. |
| Nature of the processing | Collecting, storing, organising, displaying, analysing for progress reports, sending questions to the AI model that powers the owl tutors, backing up and deleting. |
| Purpose | To provide the service to your school so that pupils can learn and staff can set work and follow progress. |
| People the information is about | Pupils; school staff with school accounts; parents who link a parent account to a pupil (only the link itself). |
| Pupil information | First name; first letter of surname; username; password (stored only in protected, scrambled form); class, learning stage and UK nation; courses started, lessons completed, quiz answers and scores, certificates; due dates and work set; questions asked to the owl tutors and the answers given (90 days); log-in records: time, device type and a shortened, scrambled network address (30 days); easier-reading settings; report comments written by staff; answers, scores, timings and reading speeds from skills checks set by the school; parent code and the IDs of linked parent accounts; if school sign-in is used, a keyed scrambled (hashed) form of the school email address and the permanent account ID from Google or Microsoft. |
| Staff information | Name; email address; job title (lead account); password (protected form); classes taught; actions in the dashboard; if school sign-in is used, the permanent account ID from Google or Microsoft and your school’s Google domain or Microsoft tenant ID. |
| Special category information | None is requested. Schools must not enter it (section 14). |
Schedule 2: security measures
- Encrypted connections (HTTPS) for all pages; passwords stored only in protected, scrambled (hashed) form.
- Data minimisation: pupils are identified by first name and surname initial only, and pupil email addresses are never stored in readable form.
- Role-based access: teachers see only their own classes; the lead account sees the whole school; parents see only pupils whose code they have been given.
- Google and Microsoft sign-in accepts only accounts from the school’s own connected Google domain or Microsoft tenant, and never personal accounts or administrator accounts.
- Limits on how many devices can be logged in to one account at once; rate limits on parent codes.
- Network protection and filtering of malicious traffic through Cloudflare.
- Restricted administrator access, regular software and security updates, and regular backups.
- Automatic deletion of owl tutor chats after 90 days and log-in records after 30 days.
Schedule 3: sub-processors
| Sub-processor | What it does | Where | Transfer safeguard |
|---|---|---|---|
| [Hosting provider name to be added] | Virtual private server that runs the website and stores its database and backups | UK or EEA | Not needed (UK, or EEA covered by UK adequacy regulations) |
| Cloudflare, Inc. | Network security and content delivery: passes web traffic, including IP addresses and page requests, between users and the website | Global network, including the USA | Cloudflare Data Processing Addendum, including the EU Standard Contractual Clauses with the UK Addendum, and the Data Privacy Framework |
| Anthropic | Provides the AI model that powers the owl tutors. Receives the question a pupil types and the text of the lesson, to produce an answer | USA | Anthropic Data Processing Addendum, including the UK International Data Transfer Addendum to the EU Standard Contractual Clauses |
If a school connects Google or Microsoft sign-in, Google or Microsoft act for the school under the school’s own agreement with them, not as our sub-processors. When a pupil or member of staff signs in, they confirm the person’s identity to us.
Contact
Tutwoo UK Limited, 167–169 Great Portland Street, Westminster, London, W1W 5PF. Email: [email protected] with “School data protection” in the subject line.