What do we mean by “service”
We (that is, Virtual Class Ltd trading as Third Space Learning) use technology to provide access to personalised teaching through an interactive online classroom by connecting pupils with specialist maths tutors giving pupils the opportunity to question and discuss concepts in maths, building their confidence and understanding as one-to-one tuition is focused and encourages verbal communication and explanation.
We provide tools and reports that enable teachers to analyse assessment and attainment data for pupils as well as groups of pupils to determine patterns and trends that may be evident and compare the results to the national average.
We also provide, through our Maths Hub, access to teaching resources and continuing professional development resources.
Together these comprise the “service” as we use the term in this document.
When we talk about “you” we mean, depending upon the context, either you as an individual or the school for whom you work.
Data controller v processor
We are, in line with the UK Information Commissioner’s guidance, a controller not a processor, in relation to the personal data that we collect and process in the course of providing our service (including the personal data relating to children that we collect and process in relation to the provision of tutoring sessions).
Although the principal purpose of our processing of personal data is to deliver the service and, to that extent, is agreed with you (the school), we determine the manner in which the data is processed as part of (or in relation to) service delivery, and we exercise a significant degree of interpretation, professional judgement and decision making in doing so. This means that we fall into the category of controller rather than that of processor – the activities of a processor are, per data protection guidelines, limited to the more ‘technical’ aspects of an operation such as processing only in accordance with defined instructions, data storage, retrieval or erasure.
Our contract with you
Who are our data subjects (the individuals we collect data on)?
We collect data from two main categories of data subjects within a school: students and school staff members (mainly teachers although we will collect personal data of other individuals involved in either the set up or delivery of the service – IT managers and teaching assistants for example).
What type of personal data is being processed?
Under GDPR “processing” means any operation or set of operations which is performed on personal data. The personal information we process includes:
First name, last name, gender, school, current academic level, English as second language, pupil premium, KS2 SATs result, year group, reading difficulties, SEN (dyslexia, ADD/ADHD, dyscalculia, speech and language difficulties, autism (ASD), aspergers), class teacher, attitude towards maths (confidence, effort, motivation etc), hobbies/interests.
SEN information is provided on the basis of consent and allows the tutor to adapt the tutoring to the pupil’s needs (for example if the pupil is autistic, dyslexic or colour blind). Pupils’ special educational needs, medical conditions or other issues are requested only if it impacts the pupil’s learning ability and only to the extent needed to enable the tutor to adapt the tutoring to the student’s needs. SEN information is only applicable to a small %age of pupils.
Lessons are recorded which is a form of data processing as they have the potential to capture personal information. Lesson recordings show on-screen interaction and live conversations between the pupil and tutor. Voice should be the only identifiable personal data on the recording unless the pupil inadvertently discloses information that would allow the pupil to be identified.
The recording of lessons is necessary for i) fulfilling a legal obligation to which the Company is subject (safeguarding of children); and ii) is in the legitimate interests of the Company.
First name, Last name, Email, School, Role of staff member, Contact number.
Personal information of staff involved in delivery of the service, will exist on financial and other systems and are processed for fulfilling a contract and will be held for the retention period applicable to that purpose.
Why are we collecting special categories of personal data?
Provision of information about any relevant medical or learning needs or other special needs is voluntary and not necessary for delivery of the service although it allows, if they impact the pupil’s learning ability, the tutor to adapt the tutoring to the student’s needs (for example autism, dyslexia or colour blindness). The Company therefore uses Consent rather than Legitimate Interests for the processing of special categories of personal data.
As we have said, provision of this information is not required in order to use the service, but if you choose to provide it to us then it will be incumbent upon you to obtain consent from the relevant pupil’s parents before you do so. The Platform has been configured so that it is not possible to input data of this nature without first confirming that the relevant consents have been obtained.
What is the basis of processing?
Our Legitimate Business Interests save for special category personal data which is Consent.
The lesson (voice) recordings are also processed to fulfill a legal obligation to which we are subject (the safeguarding of children).
Why do we need to process this personal data?
For pupils, personal information is required to personalise and tailor the one-to-one tuition provided ensuring that it is appropriate, relevant and suitable for the pupil. We limit the information collected to the minimum necessary to deliver the service and ensure that the pupil receives the best possible educational outcome from our service. Our assessment and progress algorithms also process personal data.
For members of staff, personal data is necessary to identify users, communicate via email/phone for sales, retention, pupil progress, analysis purposes etc.
We only collect data required for functions required in the system; data gathering points that are no longer required are removed and/or archived where necessary. Where information is not required by a user or an employee, we mask or remove it from their view of the data.
See also What else do we do with the data?
Do we use sub-contractors to provide the service?
We use sub-contractors (“tutor centers”) to deliver our service. We have worked with all our tutor centers for several years and have written contracts with all of them setting out the terms and obligations of both parties in relation to delivery of the contract. As we exercise detailed control over what the tutor centers do, they act as data processors in relation to any personal data they process in the course of their sub-contracted activities relating to provision of the service. By agreeing to use our service, you are agreeing to the engagement of the tutor centers by us.
To enable us to provide you with more timely in-session support including resolving technical issues as they arise, part of our customer support team is based in Sri Lanka and are employed by our wholly owned subsidiary – Third Space Global (Pvt) Ltd.
See also What about the support team in Sri Lanka?
Who and where are our tutor centers?
We have relationships with three tutor centers:
Does it matter that our tutor centers are outside of the EEA?
The tutor centers are situated outside the EEA and in countries which are not recognised as providing an adequate level of protection of personal data. We have data transfer agreements in place, which include the GDPR Model Clauses for transfer of personal data outside of the EEA and an appendix summarising the technical and organisational measures (TOMS) implemented to protect personal data, with the tutor centers to ensure that adequate safeguards are in place over personal data processed by the tutor center are in place.
Our written contracts with tutor centers set out the terms and obligations of both parties including in relation to data protection which require the tutor center to only process personal data strictly in accordance with instructions and in accordance with the terms of the data transfer agreement.
Additionally, our written contract with Third Space Global (Pvt) Ltd, our wholly owned subsidiary based in Sri Lanka, sets out the additional terms and obligations including in relation to data protection in respect of in-session support and ancillary services, such as quality assurance and data analytics, provided by the tutor center.
Are our Platform and the interactive classroom secure?
Personal data shared by schools with us is held on our Platform which is designed, built and maintained in-house by our product development team and hosted by Amazon Web Services (“AWS”).
Our Platform is hosted on servers in the UK or the EU and all personal data is processed and stored on that platform and is under our control. AWS’s GDPR statement states that all AWS customers globally can rely upon the terms of the AWS data processing agreement whenever they use AWS services to process personal data under GDPR and that if personal data from the EEA is transferred to other countries it will be given the same level of protection it receives in the EEA – for details of AWS GDPR processes and compliance, please see https://aws.amazon.com/compliance/gdpr-center/
We have the option to transfer data to AWS’s servers in India during lessons to improve latency (speed) if there are performance issues. At the end of the session, the data is automatically uploaded onto AWS servers in the UK or EU and deleted from the server in India. We have not exercised this option for over two years and, at present, have no intention of doing so.
What about other third-party service providers?
We use other third-party data processors who are well known and respected in their field and have either updated their terms and condition of service to comply with GDPR or provided a GDPR Data Processing Addendum. We minimize personal data shared with third parties providing data monitoring and analytic tools by referring to data subjects by ID rather than name.
We take all steps reasonably necessary to ensure that personal data transferred outside the EEA is subject to appropriate safeguards, such as relying on a recognised legal adequacy mechanism which may include entering into EC approved standard contractual clauses relevant to transfers of personal data.
Personal data may be held on systems hosted or managed by data processors providing CRM, financial, communication and marketing services etc. to the Company (e.g.-Google, Intercom, Pardot, Salesforce. Slack, Stripe, Xplenty, Mixpanel and xero).
The personal data of pupils is only held on the platform and, during development work, on local databases.
What about the tutors themselves?
The measures put in place by ourselves and the tutor centers we work with to ensure the privacy of your data include:
We ensure that every tutor recruited and/or used to provide the service undergoes a security check to provide him or her with a Police Clearance Certificate (which is similar but not the same as the DBS checks which are carried out on people who are working in the UK) which is renewed regularly.
What about the support team in Sri Lanka?
The customer support team in Sri Lanka is managed by the UK support team who designed the training and on-boarding programme for the team in Sri Lanka which includes completing our training programme on GDPR and data privacy procedures.
The customer support team in Sri Lanka does not come into direct contact with pupils.
We also require every member of the customer support team in Sri Lanka to undergo a security check to provide him or her with a Police Clearance Certificate (which is similar but not the same as the DBS checks which are carried out on people who are working in the UK) which is renewed regularly.
All our staff – not just those who process/access personal data – are required to complete our training programme on GDPR and data privacy procedures which includes mandatory re-certification every 12 months.
We ensure that our staff deal with personal data in accordance with the policies and procedures that we have put in place. Failure to comply with policies and procedures in place or breaching data privacy will be dealt with through our disciplinary procedures.
Where personal data has been provided but is not required by the person accessing the platform, the Company masks or removes it from their view of the data.
What else do we do with the data?
Lessons are recorded (on-screen interaction and live conversations between pupil and tutor) and the recordings are used by us to monitor and track progress; provide feedback on progression and performance; assess quality of teaching provided; compliance by tutors with guidelines; and other factors relevant to the teaching.
Recordings also a tool for on-going continual professional development for tutors enabling us to improve the services provided and enhance educational outcomes through conducting analysis and research into sessions and outcomes.
Lesson recordings identify the pupil by their Pupil ID. Recording is a form of data processing, as recorded conversations have the potential to capture personal information. The voice of the pupil and tutor should be the only identifiable personal data on the recording.
We conduct analysis and research into sessions and outcomes including training delivery and pupil performance to generally enhance how we deliver our service. When we conduct analysis and research we use a combination of anonymisation (irreversibly destroying any way of identifying the data subject) and pseudo-anonymisation (substituting the identity of the data subject in such a way that additional information is required to re-identify the data subject) so no pupil will be identifiable directly or indirectly from the aggregated data. We analyse and track standards and performance development across different age groups, geographies and other categories of pupil data.
The outcome of analysis and research is also not used to make decisions directly affecting individuals as the pupils cannot be identified.
Does it make any difference if our school is in an evaluation trial?
In the event that our service is being provided to you as you are participating in an evaluation trial (funded, for example by the government or an education charity), we will provide you with information about the purpose of any additional processing and the data that will be shared with the parties involved in the trial including the independent assessment experts appointed by the body funding the evaluation trial.
What about safeguarding?
We take online safety seriously and are committed to ensuring that children using our services do so in a safe educational environment. Our recruitment processes; safeguarding policies and procedures; safeguarding training; and features built into our delivery platform are all designed to provide a safe educational environment for children.
The measures we have taken include:
Further information about our safeguarding policies and procedures can be found on our website in the section titled Safeguarding Children.
Once we have set you up on the Platform, it is the school’s responsibility to set up and delete staff members and pupils from the Platform and ensure access is restricted only to authorised persons. It is your decision as to whether an individual is still “live” – we can’t make that decision for you.
The accuracy of personal data supplied to us is the responsibility of the school as it is provided by staff of the school purchasing the service. Personal data provided (either about staff or pupils) can be updated/amended by you at any stage. Updates and amendments to personal data overwrite existing data so that the previous personal data supplied is lost once the backup cycle (7 days) is exceeded.
Creation of staff and pupil logins and passwords (other than lead purchaser) on the platform is the responsibility of the school and you are responsible for keeping login credentials secure to minimize the risk of unauthorised entry/amendment or deletion of personal data.
Once a staff member has left the School, the individual can only be deleted by the Company although our Road Map includes developing the ability for the Purchaser or Lead Teacher to delete teachers who have left the School or are not recognised as it is your responsibility to ensure that only authorized persons have access to data on the Platform. The Purchaser, Lead Teacher and IT Lead roles are integral to delivery of the service and have to be reassigned to another individual before being deleted.
Last updated: 27 August 2020
Changes made since last version (17 July 2020)
Two sections updated – Do we use sub-contractors to provide the service? and Does it matter that our tutor centers are outside of the EEA?
New section added – What about the support team in Sri Lanka?
Reflecting that from September 2020 onwards part of the customer support team will be based in Sri Lanka and employed by our wholly owned Subsidiary (Third Space Global (Pvt) Ltd).
If you would like to know more, please contact us:
Virtual Class Ltd
4th Floor Frazer House
32-38 Leman Street
Telephone: 020 3794 2736
Last updated : 27 August 2020