POLITICSONLINE

Privacy notice

Who we are

This form is operated by Politics Online Ltd (“we”, “us”). We provide an A Level Politics online textbook and revision platform at politicsonline.co.uk.

What data we collect

When a teacher submits this form, we collect:

  • School name — to identify the subscribing institution
  • Teacher name and email — to confirm the submission and provide account setup instructions
  • Student first name, last name, and school email — to create login accounts on our platform
  • Subscription type — to set the correct licence period
  • Your IP address — processed transiently to prevent abuse of this form (rate limiting). It is held for a maximum of 15 minutes in our rate-limiting service (Upstash Redis) and then automatically deleted. It is never stored in a database or written to any persistent log.

Lawful basis for processing

We process this data under UK GDPR Article 6(1)(b) — contractual necessity. The school has a licence agreement with Politics Online, and processing student data is necessary to fulfil that agreement by providing student access to the platform.

For students under 18, the school acts as the data controller and is responsible for obtaining any necessary consent or establishing a lawful basis under their own data protection policies, in accordance with Keeping Children Safe in Education (KCSIE) guidance.

How data flows through this form

  1. You paste student names and emails into this form.
  2. When you click submit, the data is sent over an encrypted HTTPS connection to our server.
  3. Our server generates a CSV file in memory, emails it to our admin team, and immediately discards the data.
  4. No student data is stored by this form, on this server, or in any database.
  5. The email is sent via Brevo (a GDPR-compliant email provider based in the EU) and delivered to our admin inbox.
  6. Our team then imports the CSV into our WordPress platform to create student accounts.
  7. Students and their teacher are emailed login instructions and password setup directly.

Data processors

  • Vercel Inc. — hosts this form. Data transits their servers but is not stored. Vercel is certified under the EU-US Data Privacy Framework.
  • Brevo (Sendinblue SA) — delivers the email notification with the CSV attachment. Brevo is headquartered in France, processes data within the EU/EEA, and is fully GDPR compliant.
  • Upstash Inc. — provides rate-limiting infrastructure. Only your IP address is stored, for a maximum of 15 minutes. Upstash processes data within the EU/EEA and is GDPR compliant.

Data retention

This form stores no data. The CSV exists only in server memory during the submission request and is discarded immediately after the email is sent. The email (including the CSV attachment) is retained in our admin inbox for the duration of the school’s licence, after which it is deleted.

Your rights

Under UK GDPR, you (or your school’s data protection officer) have the right to:

  • Request access to the personal data we hold
  • Request correction or deletion of personal data
  • Object to or restrict processing
  • Lodge a complaint with the ICO (ico.org.uk)

Contact

For any data protection queries, contact us at admin@politicsonline.co.uk.