01Data we expect to minimise
The service should collect only what is necessary for access, delivery, support and agreed learning evidence.
- Account and guardian or institution details
- Age band rather than unnecessary birth data
- Progress and submitted learning activities
- Security and support records
02Rules for learner data
Learner information is not an advertising asset.
- No advertising profiles
- No sale of personal data
- Age-appropriate explanations
- Restricted staff and processor access
- Deletion or anonymisation rules defined before launch
03Institutional implementation
Schools and public systems need a written allocation of responsibilities before data is uploaded.
- Controller and processor roles
- Data-processing terms
- Incident and rights-request route
- International transfer assessment
- Retention and end-of-contract export or deletion