Trust & Compliance

NethGuide is designed around GDPR, UK GDPR, FERPA, COPPA and the ICO Children’s Code principles: data minimisation, purpose limitation, privacy by design and high-privacy defaults for children.

NethGuide does not currently hold a formal GDPR certification (such as an Article 42 seal) or ISO/IEC 27701 certification. We are preparing for independent assessment and will publish any certification only after it has been issued by an accredited body.

For school-managed accounts, the school decides why and how learner information is used and acts as the data controller. NethGuide processes that information on the school’s documented instructions as a processor, in line with GDPR Article 28.

A Data Processing Agreement (DPA) sets out the subject matter, duration, purposes, data categories, confidentiality duties, sub-processor rules, assistance with rights requests and return or deletion at the end of the service. The template in this pack is a starting point for review by the school and both parties’ legal advisers.

Account data: names, emails, roles, school affiliation, profile photos and linked family or school contacts. Learning data: tasks, submissions, goals, progress, support preferences, messages and saved visuals.

Support-plan and needs information (IEP, Section 504, specialist reports) may be special-category data under GDPR Article 9. It is shared only by authorised adults, visible only to linked supporters, and AI suggestions never become confirmed profile facts without human review.

NethGuide has no advertising, does not sell personal data and does not use learner data for commercial profiling.

Access control: database row-level security limits every learner record to the learner and their linked supporters. Platform administration uses separate verified roles, and privileged actions are written to audit logs.

Authentication: two-step verification is mandatory for all adult accounts (staff, specialists, school leaders, administrators and parents). Google Workspace sign-in relies on the school’s own 2-Step Verification policy.

Transport and storage: the service is delivered over HTTPS, and uploaded files are kept in private storage that requires an authorised session. Usage analytics record only the type of activity, never what a learner wrote or said.

Hosting, database, authentication and file storage are provided by established cloud infrastructure providers under written processing agreements. AI features are routed through a managed AI service to the model provider used by each feature.

Schools receive the current sub-processor list on request and are notified before a new sub-processor is added, so they can raise objections as set out in the DPA.

AI helps break tasks into steps, read aloud and suggest supports. It never diagnoses, labels or makes consequential decisions. Observed patterns are stored as unconfirmed observations, separate from facts confirmed by qualified people.

Learner content sent for AI processing is used to provide the requested feature. Schools should confirm provider retention terms within the DPA review.

Depending on the applicable law, people may request access, correction, erasure, restriction, objection, portability or withdrawal of consent. For school-managed accounts, requests are handled with the school as controller, and identity checks and statutory record exceptions may apply.

Requests can be raised through the school’s privacy lead or through the in-app Messages/Ask route for escalation to the platform administrator. We aim to respond within one month, as required by GDPR.

Information is kept only for as long as needed for the learner’s support and the school’s record obligations. At the end of a school agreement, data is returned or deleted on the school’s instruction, subject to legal retention duties.

The precise retention schedule for each data category is agreed with each school in the DPA.

If a personal-data breach affects school data, NethGuide will notify the school without undue delay so the school can meet its own duty to notify regulators within 72 hours where required, and will assist with investigation and communication.

Learner-triggered safeguarding indicators create minimal-content safety records and notify designated linked adults for review, consistent with AISA child-protection principles. Safety information is restricted to authorised staff.

Where data is processed outside the UK or EEA, transfers rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses or the UK International Data Transfer Addendum, documented in the DPA.

NethGuide is presented by Elokins Innovation & DigiPolis. Schools can request the DPA, sub-processor list or a security questionnaire response through their NethGuide contact or https://nethguide.com.

Parties: [School name] (“Controller”) and Elokins Innovation & DigiPolis, provider of NethGuide (“Processor”).

1. Subject matter and duration: provision of the NethGuide learning-support service for the term of the service agreement.

2. Nature and purpose: account management, personalised learning support, assignment and review of work, progress reporting, safeguarding alerts and communication between linked supporters.

3. Data subjects: learners, parents/guardians, teachers, specialists and school staff.

4. Data categories: identity and contact data, learning records, support preferences, support-plan information (special category), messages and usage events.

5. Processor obligations: process only on documented instructions; ensure confidentiality of authorised personnel; implement the measures in this pack; engage sub-processors only with prior notice; assist with rights requests, impact assessments and breach notification; return or delete data at the end of the service; make information available for audits.

6. Signatures — Controller: name, title, date ____________ Processor: name, title, date ____________