If your data protection officer has a question this page doesn’t answer, email [email protected].
Documents
- Data Processing Agreement (PDF). It is part of our terms of service, so it applies to every organisation membership without signing. If you want a signed copy, sign the “Signed copy” section at the end and send it to us. Download the PDF to sign.
- Privacy notice: learn.creativeeducation.co.uk/privacy
- Terms of service: www.creativeeducation.co.uk/terms-of-service/
- Data protection impact assessment: a summary on request
Creative Education Limited, company number 04662664. Registered with the Information Commissioner’s Office, number Z2363705.
Who is responsible for your staff’s data
Your organisation is the controller of the training records it asks for. That means who you assign courses to, when they’re due, whether they were done, and records of training you add yourself. We process those records for you, under our Data Processing Agreement.
Each person also has their own learning record. Their account, certificates and notes belong to them, and they keep them if they move school. We are the controller of that record. When someone leaves, you stop seeing it, but you keep the record of the training they did while they were with you.
We don’t ask for children’s names or dates of birth. Free-text boxes ask people not to name pupils.
Where data is held and how it’s kept secure
- In London. The database and the servers that run the platform are both in London.
- Encrypted in transit and at rest.
- Each organisation sees only its own people. Every request is checked against who is asking. A trust sees the schools beneath it; a school never sees another school’s records.
- Our staff sign in with multi-factor authentication. Only Creative Education employees can use our support tools. When we look at the platform as one of your staff to help them, nothing can be changed, and we keep a record that we did.
- No passwords stored by us. Sign-in is handled by Clerk, and anyone can turn on two-step sign-in.
- Backups. We can restore the database to any point in the last seven days.
- Card payments are handled by Stripe. Card details never reach us.
- Tested before release. Every change has to pass automated tests, including tests that check one organisation can’t see another’s data.
The companies we use
These are the companies that handle personal data for us. We’ll email your administrators at least 30 days before we add a new one that handles your organisation’s records, and you can object.
| Company | What for | Where |
|---|---|---|
| Neon | The database | London |
| Vercel | Runs the platform | London |
| Clerk | Signing in | US |
| Resend | Service emails | US |
| Amazon Web Services (SES) | Newsletters and announcements | Stockholm |
| Amazon Web Services (S3) | Evidence files added to training records, kept private | Stockholm |
| HubSpot | Customer records and the help chat | Frankfurt |
| PostHog | Which features are used, without names, after you say yes to cookies | Frankfurt |
| Sentry | Error reports, with no user attached | EU |
| Stripe | Card payments | US |
| Xero | Invoices for organisations | US |
| Expo, Apple and Google | App notifications, which never name a course | US |
| Vimeo | Course videos; no learner records | US |
| Google Analytics | Visits to public and sign-up pages, after you say yes to cookies | US |
Transfers to the US rely on the UK Extension to the EU–US Data Privacy Framework or the UK’s international data transfer agreements.
Microsoft Clarity runs on our main website only, never on the learning platform.
How long we keep things
| What | How long |
|---|---|
| Your organisation’s training records | For the membership, then six years after it ends as safeguarding evidence, unless you ask us to delete them sooner |
| A person’s own learning record | While their account exists. They can download it or delete their account at any time |
| An account nobody has used, with no access | Closed three years after the last sign-in, after an email giving 30 days’ notice |
| Sign-in history (time, browser and kind of device; no IP address or location) | 12 months |
| Record of emails sent (not their content) | 12 months |
| Audit log of changes | 6 years |
| Invoices and payments | 6 years after the financial year, as HMRC requires |
The privacy notice has the full list.
If something goes wrong
If a personal data breach affects your organisation’s records, we’ll tell your administrators within 48 hours of finding out. That gives you time to report to the ICO within your 72 hours if you need to. We’ll tell you what happened, who is affected, and what we’re doing about it, and keep you updated.
We’re insured with Hiscox, including professional indemnity and cyber and data cover.
Other policies and contact
- Accessibility statement: the platform is built to WCAG 2.2 AA. learn.creativeeducation.co.uk/accessibility
- Cookies: www.creativeeducation.co.uk/cookies/. One question covers both sites, and nothing optional loads unless you say yes.
- Security questionnaires: we’re happy to complete yours.
Our data protection lead is Tom Hesmondhalgh. Email [email protected] or call 07590 446792.
Creative Education Limited, 49 Station Road, Polegate, East Sussex, BN26 6EA.