School = Data Controller. TBS Education Ltd Oy = Data Processor.
Legitimate interest of the school (curriculum-aligned education) under UK GDPR Art. 6(1)(f).
Verifiable on the ICO public register at ico.org.uk.
| Data type | Detail |
|---|---|
| Teacher | Name, email, school name, session history |
| Student | Self-selected nickname only (no real name, no email, no DOB, no photos). PIN-code join, no account, no password. |
| Gameplay | In-session decisions (purchases, pricing, VAT filing, hiring) and team scores |
| Technical | IP address (server logs only, 30-day auto-purge); browser/device headers; session timestamps |
| Sub-processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Netlify | Frontend hosting + edge CDN | Global edge; primary EU edge | SCC (UK Addendum) |
| Neon | Postgres database | AWS US East 1, EU migration planned May 2026 | SCC (UK Addendum); AES-256 at rest; TLS 1.2+ in transit |
| OpenAI | AI inference for end-of-session reports (Claude API) | EU and US regions | SCC (UK Addendum); no student personal identifiers sent to model |
Free tier sessions: deleted after 30 days. Paid tier saved sessions: teacher-controlled deletion. Teacher accounts: retained during subscription, deleted within 30 days of termination. Server logs (IP): 30 days, auto-purged.
No sale, no rental, no advertising profiling. The three sub-processors above process data solely to deliver their infrastructure or inference services. No marketing tracking cookies. PIN-code join eliminates credential risks.
Under UK GDPR / EU GDPR: rights of access, rectification, erasure, restriction, portability, and objection. Student data requests are routed via the school as Data Controller. Complaints to the UK ICO at ico.org.uk/concerns or to the Finnish Data Protection Ombudsman at tietosuoja.fi.
Sakari Laajoki, TBS Education Ltd Oy · support@thebusiness.school · Response within 72 hours. Full Privacy Policy and Data Processing Agreement available at thebusiness.school/data-protection.