School data protection

Before assigning homework

• Document your school’s lawful basis and explain collection to pupils and parents. A pupil checkbox is not a substitute.
• Agree a written Article 28 data-processing agreement with BoardBurst, including instructions, confidentiality, security, deletion, rights-request assistance and audit arrangements.
• Review the actual hosting providers and subprocessors, processing locations, international-transfer safeguards and backup retention. These details still need confirmation; do not assume UK-only storage.
• Assess whether a data protection impact assessment is needed, with particular attention to children’s data and shared access.
• Students enter one first name or agreed single-word nickname and a class or set label themselves. Do not request surnames or school names, dates of birth, contact details or sensitive pupil information. Names linked to classes and results can still be personal data even if BoardBurst does not know the school; school approval remains necessary.

During use

• Use a strong, unique teacher password. Never share teacher access with pupils; sign out on shared devices.
• Distribute the homework link within the class. Replace a leaked link and code, or close the assignment.
• Choose the shortest retention period you need: 7, 30, 60 or 90 days, default 30. Access stops at expiry; daily cleanup removes live assignment records within 24 hours.
• Correct identifiers or delete an individual result when appropriate. Delete assignments sooner when they are no longer needed.
• Store exports only on school-approved devices. BoardBurst cannot revoke exported files or control their subsequent sharing.

Operator responsibilities

BoardBurst must maintain accurate data-flow and subprocessor records, agreed processing contracts, transfer assessments where applicable, security and incident-response procedures, and a documented process for school requests. Assess ICO registration/data-protection fee obligations and whether the Children’s code applies. These organisational requirements cannot be completed by changing this page.

BoardBurst, remains responsible for BoardBurst's own obligations. Schools are responsible for their own lawful collection, notices, sharing and exports. A registration checkbox does not transfer all privacy risk to the school, waive pupil rights or replace the written processing agreement. Report suspected breaches promptly and involve the school's data-protection lead; BoardBurst must cooperate and notify the controller without undue delay where required.

Permanent publishing permission applies only to approved community resources and their media, not pupil homework submissions. Avoid pupil information in published resources; the licence never overrides personal-data rights. Contact BoardBurst for removal or anonymisation concerns, including where the teacher's original quiz was deleted.

For the processing agreement, hosting details, or a privacy concern, contact boardburstsupport@gmail.com. Pupils and parents should contact their teacher or school’s data-protection lead first for homework rights requests.

Privacy Policy · Terms of Service