Mathsense and school data protection

Most school software is supplied on the basis that the school is the controller and the supplier is its processor: the school decides, and the supplier acts on the school’s instruction. Mathsense is not built that way, and it is better to say so plainly than to sign a document describing something the product does not do.

A Mathsense pupil account is created by the pupil. It exists before any school is involved, and it continues to exist if the school’s arrangement ends. A school cannot create one, cannot read one unless the pupil joins a class, and cannot delete one. There is no mechanism by which a school could instruct us to process a pupil’s data, which is the thing an Article 28 agreement exists to govern.

• The pupil account — sign-up, practice, skill mastery. Mathsense is the controller, and the pupil is our data subject.
• The class view — a teacher seeing the record of a pupil who joined their class. The pupil authorises the disclosure; we build it; the school uses it.
• What the school then does with what it sees, including anything it records in its own systems. The school is the controller of that, and we are not involved.

A school’s data protection officer may reasonably say: these are our pupils, we told them to use it, and the educational purpose is ours. That argument has real force, and how the roles are best described is a question we are happy to work through with you rather than assert at you. What is not in doubt is the mechanism: the account is the pupil’s, and a teacher sees it because the pupil joined their class.

Disclosed to the teacher of a class the pupil has joined

• The pupil’s chosen display name, and their year group if they supplied one.
• Their practice record: which maths skills they attempted, whether each attempt was correct, when it happened, and of what kind.
• Any mini-exam the pupil sits, including the paper itself and the answers they gave. A mini-exam is assessment rather than private practice, and marking it means reading it.
• Work the teacher set for them, and papers the teacher marked for them.

The practice record includes private practice. A pupil’s skill map is built from everything they do on Mathsense, not only from work a teacher set, and what a teacher sees is that whole record — including practice done before they joined the class. This is stated in the pupil-facing privacy notice and on the screen where a pupil joins a class. It is drawn to your attention here because it is more than a school might assume.

Not disclosed to the teacher

• The pupil’s email address. The Mathsense pupil record contains no email address at all — it is held only by our authentication provider and is not reachable by any teacher-facing function. This is a property of the system’s design, not an access rule that could be changed by configuration.
• The pupil’s password, which we do not hold in readable form.
• For private practice, which individual questions the pupil answered or the answers they gave. The teacher gets the skill map, not a transcript.
• Anything about a pupil who is not an active member of that teacher’s class.

Pupil data is held in the United Kingdom and the European Union. The current list of the providers we use, what each one receives, and where it processes it, is in the privacy notice. A full sub-processor schedule, with the transfer mechanism for each, comes with the school agreement.

We will give you reasonable notice of any new sub-processor that would process your pupils’ data, and you may object.

We do not claim to be your processor. We do offer the assurances a school would ordinarily obtain from one, because they reflect what we do in any event:

• Row-level security on every database table, so access is enforced by the database rather than only by application code.
• Every cross-account read confined to a server-side route gated on class ownership and active membership, returning named columns only.
• Encryption in transit throughout, and at rest by our hosting providers.
• Notification of a personal data breach affecting your pupils without undue delay, and in any event within 72 hours of becoming aware of it.
• Answers to reasonable written questions about how we handle pupil data, with evidence where we can give it.
• Deletion of a named pupil’s account on request. A pupil may also delete their own account at any time, and an account unused for a year is deleted automatically.

If your seat arrangement ends, pupil accounts are not deleted and pupils keep their own records. What ends is the additional service you paid for, and the teacher’s continued view of their class members.

We state these rather than leave them to be discovered by a questionnaire.

• No ISO 27001 and no Cyber Essentials certification.
• No independent penetration test.
• No statutory data protection officer. Mathsense is a sole trader and is not required to appoint one; the contact below is the route for any data protection question.

Some schools will require pupils to be enrolled without any pupil action, which means the school is the controller of the account and we are processing on its behalf. That is lawful and ordinary, but it is a different arrangement from the one described above rather than a setting we can switch on, and it would need a different agreement in place before it began.

If that is what your school needs, tell us and we will work out what it involves rather than quietly treat it as covered by this page.

There is a school agreement covering the arrangement described here. To ask for a copy, to send us your own questionnaire, or to raise anything on this page, contact us at privacy@mathsense.net.

Mathsense is operated by Christopher Reay, a sole trader, registered with the Information Commissioner’s Office under registration number ZC152231. Our pupil-facing privacy notice is at mathsense.net/privacy.