The Business School is operated by TBS Education Ltd Oy (Finnish business identifier 3614159-3), registered in Lahti, Finland. We provide a browser-based business simulation for secondary-school and sixth-form classrooms.
TBS Education Ltd Oy is registered with the UK Information Commissioner's Office (ICO) as a fee-paying data controller. The registration is publicly verifiable on the ICO register at ico.org.uk.
Contact: support@thebusiness.school.
When a school uses The Business School with its students, the school is the Data Controller and TBS Education Ltd Oy is the Data Processor. We process personal data only on the school's behalf and in accordance with their documented instructions, as set out in our Data Processing Agreement (DPA).
The Business School is designed to collect minimal student data:
We do NOT use personal data for advertising, marketing profiling, or sale to third parties. We do NOT use cookies for tracking. The simulation uses only essential session cookies required for gameplay.
The Business School's infrastructure uses three sub-processors. Each is documented below with current location and the safeguards in place for international transfers.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Netlify, Inc. | Frontend hosting, edge CDN, serverless functions | Global edge network; primary EU edge nodes | Standard Contractual Clauses (UK Addendum) under UK GDPR Art. 46 |
| Neon, Inc. | Postgres database (session state, scores, teacher accounts) | AWS US East 1 (current), EU region migration planned May 2026 | Standard Contractual Clauses (UK Addendum) under UK GDPR Art. 46. Data encrypted at rest (AES-256) and in transit (TLS 1.2+). |
| OpenAI | AI inference for end-of-session teacher feedback reports (Claude API) | EU and US regions | Standard Contractual Clauses (UK Addendum). No student personal identifiers are sent, input is restricted to aggregated session data already collected under sections 3.1 and 3.2. |
All connections use HTTPS / TLS 1.2 or higher. No student passwords exist, PIN-code join eliminates credential risks. Each classroom session is sandboxed and isolated from every other session.
We do not sell, rent, or share personal data with third parties. The three sub-processors listed in section 6 process data solely to provide their infrastructure or AI inference services. A current list of sub-processors is maintained in our Data Processing Agreement and on our Trust Centre at thebusiness.school/trust.
Under UK GDPR and EU GDPR, data subjects have the right to:
For student data, requests should be made by the school (as Data Controller) on the student's behalf. Contact: support@thebusiness.school.
The Business School is designed for classroom use under teacher supervision, typically with students aged 14-18. Because students join via a PIN code and do not provide personal information, we do not knowingly collect or store data that identifies children. Parental consent for the use of the simulation is managed by the school as part of its standard IT and educational tools consent processes.
We may update this Privacy Policy from time to time. Material changes will be communicated to subscribing schools at least 30 days in advance via email. The current version is always available at thebusiness.school/data-protection.
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact: Sakari Laajoki, TBS Education Ltd Oy, support@thebusiness.school.
If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk/concerns or the Finnish Data Protection Ombudsman at tietosuoja.fi.