Privacy Notice for Schools
Effective date: 02/06/2025
Fruitful Labs Ltd
Contact: support@fruitify.co.uk
1. Introduction
This privacy notice explains how Fruitful Labs Ltd (“we”, “us”, “our”) processes personal data on behalf of schools using our platform. This notice is directed at schools, which act as data controllers under the UK General Data Protection Regulation (UK GDPR).
Our platform supports schools by providing tools for automated marking, personalised feedback, class organisation, and pupil progress tracking.
2. Our Role
In our relationship with schools, Fruitful Labs acts as a data processor. The school is the data controller, deciding what data is collected and how it is used.
3. Data We Process
Student Data (as provided by schools):
Full name
Year group
Class
Student answers (including free-text answers that may contain personal data)
Teacher Data:
Full name
Role
School email address
Class and subject information
Generated Usage Data:
Student responses, submissions, and feedback
Task completion times
Progress tracking and learning analytics
Teacher usage data (e.g. logins, task assignment)
Event and behavioural logs, including student and teacher content, processed via Langfuse (EU-hosted)
4. Purpose of Processing
We process this data to:
Provide our platform services
Automate marking and feedback
Enable personalised learning and reporting
Assist with class organisation and progress tracking
Support teaching staff through dashboards and insights
Improve our product through analysis of anonymised and log-based usage data
Monitor system performance and debug issues via third-party tools (e.g. Langfuse)
5. Lawful Basis
Schools determine the lawful basis for processing. Typically this will be:
Public task under Article 6(1)(e) UK GDPR, or
Legitimate interests under Article 6(1)(f), depending on school guidance
We process data strictly under school instructions and only for agreed educational purposes.
6. Data Sharing
We do not share personal data with third parties unless:
Instructed by the school
Required by law
Necessary for secure hosting, support, or analytics under contract
All subprocessors are subject to robust data protection obligations. These include:
Amazon Web Services (UK) – secure hosting
Microsoft Azure (UK) – OpenAI-based automated marking
Langfuse (EU) – monitoring and logging, which may include student answers
7. Data Storage & Retention
Data is securely stored in the UK or in UK GDPR-compliant jurisdictions.
We retain identifiable school data for up to two (2) years after the school stops using the platform, unless earlier deletion is requested. After this, it is securely deleted or anonymised.
Anonymised usage data may be retained indefinitely for research, development, and performance analysis.
8. Data Security
We implement appropriate technical and organisational measures, including:
Encryption of data in transit and at rest
Role-based access controls
Secure server environments
Continuous security reviews and audits
9. Data Subject Rights
Schools are responsible for fulfilling data subject rights. We assist by:
Supporting responses to access, rectification, erasure, and objection requests
Referring any direct requests from individuals to the relevant school
10. International Data Transfers
Most data is processed and stored in the UK. However, logs and monitoring data (which may include identifiable student and teacher content) are stored within the EU (Germany) via Langfuse. The EU is recognised as adequate under the UK GDPR, and appropriate safeguards are in place.
We do not transfer data to jurisdictions without adequacy without prior agreement and appropriate safeguards (e.g., Standard Contractual Clauses).
11. Contact Us
For questions, subject access requests, or concerns, please contact:
Fruitify Labs Ltd
Email: support@fruitify.co.uk
Schools should also consult their Data Protection Officer (DPO) regarding their responsibilities as data controllers.