School data pack

1. Who does what

Your school (or trust) is the controller for the pupil data it puts into UniGenius through a licence: class lists you import, pupils who join with your code, the work you set and the reports you read. Uni Admissions Prep Ltd, trading as UniGenius (company 17325935, 28 Denton Close, Barnet, EN5 3AP, United Kingdom), is your processor for that data and acts only on your instructions.

Each pupil also has their own UniGenius account. For that account, and for anything a pupil does outside your licence, we are the controller under our privacy policy at unigenius.co.uk/privacy.

2. The processing

Purpose

Giving pupils the licensed courses, and giving staff the class dashboard: who has joined, the work set, progress and exports.

Pupils' data

Name, email, class, and their work on the courses: answers, lessons finished, mock results and when they studied.

Staff data

Name, email, school, and the order and payment record.

Not collected

Dates of birth, addresses, phone numbers, special category data, SEND records or MIS data.

Pupils

Secondary and sixth-form pupils at your school who join with your code or are on a class list you import.

Duration

The licence (12 months, or the trial), then the retention schedule below.

3. Our commitments as your processor

• We process pupil data only to run the licence, on your instructions: these terms, the licence terms and what you do in the dashboard.
• Everyone at UniGenius who can reach pupil data is bound by confidentiality.
• Data is encrypted in transit. Messages to the AI tutor and answers sent for AI marking never include a pupil's name or email. Rosters and progress are read only by our servers, never directly from a browser. Dashboard links are signed, and a class link shows only that class.
• We use only the subprocessors listed below: Supabase, Vercel, Resend and Stripe under their data processing agreements; OpenRouter, Google and Apple under their published terms and privacy policies. We update the list before adding a new one, and you may object.
• Scripts sent for AI marking go to the model only through endpoints with zero data retention. Each step, where it happens and what is kept are in the marking pilot pack.
• Where a subprocessor handles data outside the UK, the transfer relies on UK adequacy regulations or the UK International Data Transfer Addendum.
• We help you answer requests from pupils or parents to see, correct or delete data, and give you the information you need for a DPIA.
• We tell you without undue delay after becoming aware of a breach affecting your pupils' data, with what we know and what we are doing.
• When the licence ends, you can export the class report from the dashboard. On your written request we delete the licence's class lists and reports within one month.
• We give you the information needed to show we meet these commitments, and answer your reasonable audit questions in writing.
• We do not sell pupil data or use pupils' work for advertising.

4. Subprocessors

5. Retention

6. For your DPIA

Lawful basis

Usually public task (state schools) or legitimate interests (independent schools): your school decides.

Automated decisions

None with legal or similar effect. The courses choose practice questions from a pupil's answers.

Who sees a pupil's work

The pupil, and staff holding your dashboard link or their class's link. Never other pupils.

Main risk

A forwarded dashboard link. Share it only with staff who need it; a class link limits a teacher to their class; a new join code stops further joins.

Pupil choice

Pupils sign in with their own email or Google, and can delete their account at any time.

7. Contact

Data protection questions, rights requests and breach reports: support@unigenius.co.uk. Supplier details and licence terms are at unigenius.co.uk/schools/supplier and /schools/terms.