Privacy Notice for Schools

Fruitful Labs Ltd
Contact: support@fruitify.co.uk

1. Introduction

This privacy notice explains how Fruitful Labs Ltd (“we”, “us”, “our”) processes personal data on behalf of schools using our platform. This notice is directed at schools, which act as data controllers under the UK General Data Protection Regulation (UK GDPR).

Our platform supports schools by providing tools for automated marking, personalised feedback, class organisation, and pupil progress tracking.

2. Our Role

In our relationship with schools, Fruitful Labs acts as a data processor. The school is the data controller, deciding what data is collected and how it is used.

3. Data We Process

Student Data (as provided by schools):

• Full name

• Year group

• Class

• Student answers (including free-text answers that may contain personal data)

Teacher Data:

• Full name

• Role

• School email address

• Class and subject information

Generated Usage Data:

• Student responses, submissions, and feedback

• Task completion times

• Progress tracking and learning analytics

• Teacher usage data (e.g. logins, task assignment)

• Event and behavioural logs, including student and teacher content, processed via Langfuse (EU-hosted)

4. Purpose of Processing

We process this data to:

• Provide our platform services

• Automate marking and feedback

• Enable personalised learning and reporting

• Assist with class organisation and progress tracking

• Support teaching staff through dashboards and insights

• Improve our product through analysis of anonymised and log-based usage data

• Monitor system performance and debug issues via third-party tools (e.g. Langfuse)

5. Lawful Basis

Schools determine the lawful basis for processing. Typically this will be:

• Public task under Article 6(1)(e) UK GDPR, or

• Legitimate interests under Article 6(1)(f), depending on school guidance

We process data strictly under school instructions and only for agreed educational purposes.

6. Data Sharing

We do not share personal data with third parties unless:

• Instructed by the school

• Required by law

• Necessary for secure hosting, support, or analytics under contract

All subprocessors are subject to robust data protection obligations. These include:

• Amazon Web Services (UK) – secure hosting

• Microsoft Azure (UK) – OpenAI-based automated marking

• Langfuse (EU) – monitoring and logging, which may include student answers

7. Data Storage & Retention

Data is securely stored in the UK or in UK GDPR-compliant jurisdictions.

We retain identifiable school data for up to two (2) years after the school stops using the platform, unless earlier deletion is requested. After this, it is securely deleted or anonymised.

Anonymised usage data may be retained indefinitely for research, development, and performance analysis.

8. Data Security

We implement appropriate technical and organisational measures, including:

• Encryption of data in transit and at rest

• Role-based access controls

• Secure server environments

• Continuous security reviews and audits

9. Data Subject Rights

Schools are responsible for fulfilling data subject rights. We assist by:

• Supporting responses to access, rectification, erasure, and objection requests

• Referring any direct requests from individuals to the relevant school

10. International Data Transfers

Most data is processed and stored in the UK. However, logs and monitoring data (which may include identifiable student and teacher content) are stored within the EU (Germany) via Langfuse. The EU is recognised as adequate under the UK GDPR, and appropriate safeguards are in place.

We do not transfer data to jurisdictions without adequacy without prior agreement and appropriate safeguards (e.g., Standard Contractual Clauses).

11. Contact Us

For questions, subject access requests, or concerns, please contact:

Fruitify Labs Ltd
Email: support@fruitify.co.uk

Schools should also consult their Data Protection Officer (DPO) regarding their responsibilities as data controllers.