POLITICSONLINE

Privacy notice

Who we are

This form is operated by Politics Online Ltd (“we”, “us”). We provide an A Level Politics online textbook and revision platform at politicsonline.co.uk.

What data we collect

When a teacher submits this form, we collect:

  • School name: to identify the subscribing institution
  • Submitting teacher’s name and email: to confirm the submission and provide account setup instructions
  • Student first name, last name, and school email: to create login accounts on our platform
  • Department teacher first name, last name, and school email (optional, up to five): to create staff login accounts on the same platform
  • Subscription type: to set the correct licence period
  • Your IP address: processed transiently to prevent abuse of this form (rate limiting). It is held for a maximum of 15 minutes in our rate-limiting service (Upstash Redis) and then automatically deleted. It is never written to a persistent log.

Lawful basis for processing

We process this data under UK GDPR Article 6(1)(b), contractual necessity. The school has a licence agreement with Politics Online, and processing student and staff data is necessary to fulfil that agreement by providing access to the platform.

For students under 18, the school acts as the data controller and is responsible for obtaining any necessary consent or establishing a lawful basis under their own data protection policies, in accordance with Keeping Children Safe in Education (KCSIE) guidance.

How data flows through this form

  1. You paste student names and emails, and optionally department teachers, into this form.
  2. When you click submit, the data is sent over an encrypted HTTPS connection to our server.
  3. Our server generates a CSV file in memory and emails it to our admin team.
  4. A backup copy of the submission is held in an encrypted store (Upstash Redis) for a maximum of 90 days, so that a failed email delivery cannot lose your list. It is deleted automatically after that period, or sooner on request.
  5. The email is sent via Brevo (a GDPR-compliant email provider based in the EU) and delivered to our admin inbox.
  6. If you reached this form from the link in our email, the link carries a code telling us which school’s licence the list belongs to. The code contains no personal data.
  7. Our team reviews the list in our internal administration system, which runs on our own computer and is not reachable from the internet, and creates the accounts on our WordPress platform.
  8. Accounts are created without an automatic email to students. We tell the submitting teacher when they are ready, and students set their own password with the “Lost password” link on our site.

Data processors

  • Vercel Inc.: hosts this form, which runs in Vercel’s London region. Data passes through their servers but is not stored there. For any transfer to the US, Vercel is certified under the EU-US Data Privacy Framework and its UK Extension (the UK-US data bridge).
  • Brevo (Sendinblue SA): delivers the email notification with the CSV attachment. Brevo is headquartered in France, processes data within the EU/EEA, and is fully GDPR compliant.
  • Upstash Inc.: provides rate limiting (IP address, 15 minutes) and the encrypted 90-day submission backup described above. This data is stored in Upstash’s London (UK) region and does not leave the UK.
  • Krystal Hosting Ltd: hosts our website, where the student and teacher accounts are created, in the UK.

Data retention

The CSV exists in server memory only for the duration of the submission request. The backup copy of the submitted names and emails is held for a maximum of 90 days and then deleted automatically. Our internal administration copy of the list is also deleted 90 days after it arrives; only the number of students is kept. The accounts themselves last for the licence period. The email (including the CSV attachment) is retained in our admin inbox for the duration of the school’s licence, after which it is deleted.

Your rights

Under UK GDPR, you (or your school’s data protection officer) have the right to:

  • Request access to the personal data we hold
  • Request correction or deletion of personal data
  • Object to or restrict processing
  • Lodge a complaint with the ICO (ico.org.uk)

Contact

For any data protection queries, contact us at admin@politicsonline.co.uk.