School Data Privacy and Terms

1. Parties, roles, and instructions

The service provider is Velislav Tihomirov Tsvetanov, trading as NumDojo, 58 Beechley Road, Wrexham, LL13 7BA, United Kingdom. The customer is the school, tutoring organisation, or other education provider identified in the workspace or order form.

For learner data the school submits and controls for its educational purpose, the school is generally the controller and NumDojo acts as processor. NumDojo processes that data only to provide, secure, support, and maintain the contracted learning service, on the school's documented instructions, unless law requires otherwise. NumDojo acts as controller for its own billing, account security, legal compliance, and direct commercial relationship records.

2. Processing details

• Subject and duration: delivery of the NumDojo learning and management service for the term of the workspace, order, trial, or other agreement, plus necessary return, deletion, security, and legal retention steps.
• Purpose: account provisioning, classes, assignments, lessons, practice, progress, reports, support, security, and permitted competitions.
• Data: generated username or school identifier, safe display name, age group, class and teacher relationships, credentials, learning activity, progress, audit logs, and support information.
• People: learners, teachers, school administrators, and authorised contacts.
• Sensitive data: NumDojo does not ask schools to upload health, special-category, home-address, personal-phone, or safeguarding-case data. Do not place that information in names, identifiers, CSV files, announcements, or notes.

3. School responsibilities

The school confirms that its representative can bind the organisation, that it has a lawful basis and any required transparency or parent communication for the educational use, and that its instructions comply with law. The school must limit access to authorised staff, keep credentials secure, promptly remove leavers, avoid unnecessary data, and tell NumDojo about disputed guardian or learner relationships.

A school may not use NumDojo's managed-account process for advertising, unrelated commercial profiling, or another purpose outside the educational relationship.

4. NumDojo commitments

• process school learner data only on documented instructions and notify the school if an instruction appears unlawful, unless prohibited from doing so;
• require confidentiality from people authorised to process the data;
• use appropriate technical and organisational safeguards, including HTTPS, password hashing, role checks, tenant boundaries, audit records, backups, and access revocation;
• assist the school, taking account of the processing, with data-subject requests, security incidents, DPIAs, and regulator enquiries;
• notify the school without undue delay after confirming a personal-data breach affecting its learner data;
• provide information reasonably needed to demonstrate these obligations and support proportionate audits, subject to confidentiality, security, and reasonable notice;
• delete or return school-controlled personal data at the end of service as instructed, unless law requires retention.

5. Subprocessors and transfers

Current provider categories are Hostinger for hosting and email infrastructure, Stripe for school billing where used, optional sign-in providers chosen by adult users, and browser push services chosen by an opted-in user. Google Analytics is not enabled for signed-in minors. NumDojo remains responsible for processor obligations it delegates to a subprocessor.

This page is the current general subprocessor notice. A school may object to a material new subprocessor on reasonable data-protection grounds by contacting support. Where personal data is transferred outside the UK, the parties will use an applicable adequacy regulation or contractual transfer safeguard where required.

6. Access, exports, and offboarding

School access is tenant-scoped. Teachers are further limited to assigned classes and learners. Student exports are permission-controlled and audit-recorded. When a learner leaves a class or school, school membership and school access can be removed without automatically deleting a separate family-owned account or independent learning history.

On termination, the school should export permitted records before access ends and instruct NumDojo whether to return, transfer where supported, anonymise, or delete school-controlled data. Billing, security, audit, and dispute records may be retained where legally necessary.

7. Precedence, changes, and contact

A signed data processing agreement, order form, or negotiated contract takes precedence over these online terms to the extent of a conflict. NumDojo will version material changes. A new version is not treated as accepted for new learner provisioning until an authorised school user accepts it.

Contact support@numdojo.com for procurement questions, a signed DPA, security evidence, rights assistance, deletion instructions, or a subprocessor objection.