Internal · For TBS Education Ltd Oy staff and contractors
Internal Data Policies
Operational policies for handling personal data · Version 1.0, September 2026. Effective 28 April 2026
Organisation registration
TBS Education Ltd Oy · Business ID 3614159-3 · Lahti, Finland
UK ICO Registration: ZC133810
1. Scope
This document describes the internal operational policies of TBS Education Ltd Oy with respect to personal data. It applies to all staff, founders, and engaged contractors. It supplements (and is consistent with) the public-facing Privacy Policy and the Data Processing Agreement signed with each customer school.
2. Roles and Responsibilities
| Role | Responsibility |
|---|
| Data Protection Lead | Sakari Laajoki (Founder & Director), first point of contact for all data-protection enquiries, breach response, and regulator correspondence. |
| Engineering Partner | Appifest, Sydney, Australia (Muhammad Feroz), operates the production codebase under written confidentiality terms; access to production database is logged and audited. |
| Sub-processors | Netlify (frontend), Neon (database), OpenAI (AI inference). Each operates under their own DPA and Standard Contractual Clauses. |
3. Access Control
- Production database access is limited to the Data Protection Lead and the contracted Engineering Partner
- Each access uses a uniquely identifiable credential; shared accounts are not permitted
- Multi-factor authentication is enabled on the Neon, Netlify and OpenAI admin consoles
- Access is reviewed quarterly; any contractor whose engagement ends has access revoked within 24 hours
4. Data Minimisation
- The simulation collects only what is operationally necessary (see Privacy Policy section 3)
- No real student names, emails, dates of birth, addresses or photos are collected
- Students join via PIN code, no account or password is required or generated
- Student data and game states are deleted after 30 days
5. Encryption
- All connections use HTTPS / TLS 1.2 or higher
- The production database is encrypted at rest using AES-256
- Backups are encrypted and held by the database provider; encryption keys are managed by the provider
6. Logging and Monitoring
- Server logs (including IP addresses) are retained for 30 days, then auto-purged
- Database admin actions are logged by Neon
- Application errors are surfaced to the Engineering Partner for investigation
7. Breach Response
If a personal data breach is suspected or confirmed, the following process applies:
- Hour 0-2: Containment, the Data Protection Lead and Engineering Partner isolate affected systems; access tokens are rotated
- Hour 2-24: Assessment, scope, data categories, number of data subjects, and risk to rights and freedoms are documented
- Hour 24-72: Notification, affected schools (Controllers) are notified within 72 hours of awareness, with all information required under UK GDPR Art. 33. The UK ICO and the Finnish Data Protection Ombudsman are notified directly where required
- Day 7: Post-incident review, root cause, remediation, and policy updates are documented
The Data Protection Lead is Sakari Laajoki, support@thebusiness.school.
8. Sub-processor Engagement
- New sub-processors are engaged only under a written DPA that mirrors the obligations in our customer DPA
- Each sub-processor's location, purpose and transfer safeguard is recorded in the public-facing Privacy Policy and DPA
- Customer schools are notified at least 30 days in advance of any new or replacement sub-processor
9. Training and Awareness
- The Data Protection Lead reviews UK GDPR, UK Data Protection Act 2018, and KCSIE 2024/25 §143 obligations annually
- Engineering Partner receives a written briefing on these obligations at the start of the engagement and on any material change
10. Data Subject Rights, Internal Workflow
When a data-subject request is received (typically via the school as Controller):
- Acknowledge within 5 working days
- Verify identity (or rely on Controller verification)
- Locate relevant records; redact third-party personal data
- Respond within 30 days of receipt; in complex cases, extend to 60 days with written explanation
- Log the request and response in the internal register
11. Retention and Deletion
| Data type | Retention | Trigger to delete |
|---|
| Free-tier session data | ≤ 24 hours | Session end + 24h auto-delete |
| Paid-tier saved sessions | Teacher-controlled | Teacher delete action |
| Teacher account data | Subscription duration | Subscription termination + 30 days |
| Server logs (incl. IP) | 30 days | Auto-purge |
| Backups | 30 days rolling | Auto-rotation |
12. Review
This document is reviewed at least annually by the Data Protection Lead, and immediately after any material change to processing, sub-processors, or applicable law.