Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between Learning Loft Ltd ("the Processor", "we", "us") and the subscribing educational institution ("the Controller", "your school", "your nursery") and supplements any existing service agreement.

This DPA sets out the terms under which Learning Loft processes personal data on behalf of schools and nurseries, in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and Department for Education (DfE) data handling guidelines.

By using Learning Loft, your institution acknowledges and agrees to the data processing practices described in this agreement.

We process the following categories of personal data solely for the purpose of delivering our educational platform services:

Student / Child Data

• Names — First name and surname, used to identify students within the school's account
• Year Group / Key Stage — To deliver age-appropriate content and resources
• Reading levels and assessment data — To track educational progress
• Quiz attempts and scores — For formative and summative assessment tracking
• Work submissions — Uploaded files and text submitted through assignments
• Login credentials — Unique student IDs generated by the platform (no personal email required for students)

Staff / Teacher Data

• Names and email addresses — For account creation and communication
• Role assignments — Teacher, school admin, etc.
• Teaching observations and marking records — Professional data related to their role

Parent Data (where applicable)

• Names and email addresses — For parent portal access
• Linked children — To provide parents with visibility of their child's progress

Little Loft (Early Years / Nursery) Data

• Child profiles — Including developmental observations, dietary requirements, and medical information where provided by the nursery
• Photos and media — Uploaded by nursery staff as part of learning journals, stored in private encrypted storage
• Emergency contacts and authorised pickup persons — For safeguarding purposes

Learning Loft implements multiple layers of security to protect personal data:

🔐 Encryption

• All data is encrypted in transit using TLS 1.2+ (HTTPS)
• All data is encrypted at rest using AES-256 encryption
• Sensitive fields such as PIN codes are hashed using secure one-way algorithms

🛡️ Access Controls

• Row-Level Security (RLS) — Every database table enforces strict access rules ensuring users can only access data they are authorised to see
• Role-Based Access Control (RBAC) — Users are assigned roles (student, teacher, school_admin, parent, owner) with permissions scoped to their role
• School-level isolation — Data is partitioned by school; one school cannot access another school's data
• Step-up authentication — Sensitive pages require additional PIN verification
• Leaked password protection — Passwords are checked against known breach databases to prevent use of compromised credentials

🏢 Infrastructure

• Hosted on enterprise-grade cloud infrastructure with ISO 27001, SOC 2 Type II, and GDPR compliance certifications
• Data is stored in EU/UK data centres
• Regular automated backups with point-in-time recovery
• Private storage buckets for sensitive files (children's photos, nursery documents) — these are NOT publicly accessible

🔍 Monitoring & Auditing

• Access to sensitive data is logged and auditable
• Regular security scans and dependency audits
• Automated vulnerability detection for third-party packages

We process personal data under the following lawful bases:

• Contractual necessity (Article 6(1)(b) UK GDPR) — Processing is necessary for the performance of the service agreement between Learning Loft and the educational institution
• Legitimate interests (Article 6(1)(f)) — To provide educational tools, track student progress, and maintain platform security
• Legal obligation (Article 6(1)(c)) — Where required to comply with educational regulations or safeguarding duties
• Consent (Article 6(1)(a)) — For optional activities such as marketing communications, which can be withdrawn at any time

For special category data (e.g., dietary or medical information in nursery settings), processing is based on explicit consent provided by parents/guardians or the legitimate activities of the educational institution under Article 9(2)(g).

We do NOT sell personal data. We do NOT share student or child data with advertisers or any third party for commercial purposes.

Data may be shared with the following sub-processors solely to deliver our services:

• Cloud hosting provider — For secure data storage and application hosting
• Email delivery service — To send transactional emails (e.g., password resets, parent notifications)
• AI processing services — For educational features such as AI-generated quizzes and reading analysis. Student names are NOT sent to AI services; only anonymised academic content is processed
• Video conferencing — For live classroom sessions (LoftClass). Session data is processed in compliance with provider DPAs

All sub-processors are bound by equivalent data protection obligations and are regularly reviewed.

• Student data is retained for the duration of the school's active subscription
• Upon account closure or subscription expiry, personal data is deleted within 90 days unless legally required to retain
• Schools may request immediate data deletion at any time by contacting us
• Aggregated, anonymised data may be retained for analytics and service improvement purposes
• Billing records are retained as required by UK financial regulations (typically 6 years)

Child-to-Child (C2C) Data Transfers

When a child moves between institutions, our C2C data transfer system ensures records are only shared with the explicit consent of parents/guardians, using secure one-time codes and time-limited access windows.

Under UK GDPR, data subjects (including parents on behalf of children) have the right to:

• Access — Request a copy of personal data held about them or their child
• Rectification — Request correction of inaccurate data
• Erasure — Request deletion of data ("right to be forgotten")
• Portability — Receive their data in a structured, machine-readable format
• Objection — Object to processing in certain circumstances
• Restrict processing — Request a limitation on how data is used

To exercise any of these rights, contact us at info@learningloft.co.uk. We will respond within 30 days as required by law.

In the unlikely event of a personal data breach:

• We will notify affected schools/nurseries within 72 hours of becoming aware of a breach, as required by UK GDPR Article 33
• We will provide full details of the nature of the breach, categories of data affected, and remedial actions taken
• We will cooperate fully with the school's Data Protection Officer and the ICO (Information Commissioner's Office) as required
• We maintain an internal breach register and conduct post-incident reviews to prevent recurrence

• Our infrastructure provider maintains ISO 27001, SOC 2 Type II, and GDPR compliance
• All data processing occurs within UK/EU data centres
• No personal data is transferred outside the UK/EEA without appropriate safeguards (Standard Contractual Clauses or adequacy decisions)
• Regular penetration testing and vulnerability assessments are conducted