Data protection, The Business School
For Heads For Teachers Curriculum Licensing Resources FAQAbout Join the waitlist Department case
Data protection

Data minimisation, in practice.

We process the least data needed to run a session and reply to an enquiry, and no more. This page sets out what that means under UK GDPR.

Who we are

For a classroom session, the school is the data controller and TBS Education Ltd Oy is the data processor, acting on the school’s instructions under a written agreement. For this website, and for teacher enquiries and accounts, TBS Education Ltd Oy is the data controller. TBS Education Ltd Oy (company number 3614159-3) is registered with the UK Information Commissioner’s Office, ICO registration ZC133810, publicly verifiable on the ICO register at ico.org.uk. Contact us for any data protection request.

Students

A student joins with a PIN and a nickname they choose. We process that nickname, the decisions they make in the game and the answers they write. In the connected version of Founder’s Hour a student is identified by their first name and last initial instead of a nickname. The answers a student writes are sent to a language model so that it can mark them and the teacher gets a report, and they are not used to train the model.

Teachers and enquiries

When you request a demo or a quote, we process the name, school email and role you provide, plus the setting you describe. The lawful basis is legitimate interest, responding to a request you have made, and, where you opt in, consent for further contact.

Sub-processors

Three sub-processors are involved in running a session. Netlify hosts the website and the functions, in the US and on a global network. Neon holds the database, in the EU, in Frankfurt. OpenAI marks the answers students write, so that the teacher gets a report. Schools are told at least 30 days before a sub-processor is added or replaced, and may object.

Retention

Student data and game states are deleted after 30 days. Waitlist and enquiry form data is kept for 24 months. Session data is under the teacher’s control and can be ended at any time. We do not sell data or use it for advertising.

Your rights

You have the usual UK GDPR rights, access, rectification, erasure, restriction, objection and portability. To exercise any of them, or to request a data processing agreement for your school or MAT, contact us through the enquiry form.