Privacy Notice
BenchMark & the Enrichment Mark
Last updated 14 July 2026 · Version 1.0 (draft – pending legal sign-off).
rounded.education is a trading name of After Hours Education Ltd, a company registered in England and Wales (company number 17051217), registered office Wellesley House, Duke of Wellington Avenue, London, England, SE18 6SS (“we”, “us”). We are registered with the Information Commissioner’s Office under registration number [●].
This notice explains how we handle personal data when you use BenchMark (our free self-evaluation tool) and the Enrichment Mark (our paid accreditation service), together “the Service”.
1. The two roles we play
We are the controller of the personal data you give us to run your account and our business: your name, role, work email, school details, payment records and how you use the Service.
We are a processor, and your school is the controller, for the content your school puts into the Service – evaluation responses, comments and uploaded evidence. That material belongs to your school and may include personal data about staff or pupils. We process it only to provide the Service, under our Data Processing Agreement with your school. Please do not upload more pupil personal data than the evidence requires; where possible, anonymise pupils in documents you upload.
2. What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, role, work email, password (hashed) | Create and secure your account | Contract |
| School name; optional URN, phase, local authority, postcode | Identify your school; segment and improve the Service | Contract; legitimate interests |
| Evaluation responses, scores, comments, action plans | Provide the self-evaluation, outputs and history | Contract (as processor for your school) |
| Evidence uploads | Enable independent moderation for the Enrichment Mark | Contract (as processor for your school) |
| Payment and invoicing details | Take payment for the Enrichment Mark; accounting | Contract; legal obligation |
| Usage and funnel events (e.g. registration, completion) | Understand and improve how the Service is used | Legitimate interests |
| Support correspondence | Answer your queries | Legitimate interests |
| Marketing preferences | Send product updates if you opt in | Consent (withdraw any time) |
We do not sell personal data. We do not use personal data to train AI models. We do not knowingly collect data directly from children – the Service is for school staff.
3. Who sees your data
- Our staff and reviewers, on a need-to-know basis and under confidentiality obligations. Evidence is accessible to the assigned reviewer only for the purpose of moderation.
- Sub-processors who host and support the Service: [hosting provider, e.g. AWS (London region)], [payment processor, e.g. Stripe], [email provider]. A current list is maintained at https://rounded.education.
- No one else, unless the law requires it (e.g. a court order) or you ask us to.
Award outcomes (school name and Mark status) are published only with the school’s agreement.
4. Where your data lives
Personal data is stored in the United Kingdom / EEA. If any sub-processor transfers data outside the UK, we rely on UK adequacy regulations or the ICO-approved International Data Transfer Agreement / Addendum.
5. Security
Data is encrypted in transit (TLS) and at rest. Passwords are stored hashed, never in plain text. Access to evidence is role-restricted and logged. We test and review our security measures regularly. If a breach is likely to result in a risk to individuals, we will notify the ICO within 72 hours and affected schools without undue delay.
6. How long we keep things (Retention Policy)
| Data | Retention | Rationale |
|---|---|---|
| Account data (name, role, email) | While the account is active, then 24 months after last sign-in, then deleted | Annual re-evaluation cycle; dormant-account cleanup |
| Evaluations, scores, action plans | While the account is active (your school's year-on-year history), deleted with the account | The history is the product |
| Evidence uploads | Deleted 90 days after the award decision (or withdrawal of the application) | Held only as long as moderation and any resubmission require |
| Reviewer's written summary and award record | 6 years from award | Defensibility of accreditation decisions |
| Invoices and payment records | 6 years from end of financial year | HMRC / Companies Act requirement |
| Usage / funnel analytics | 12 months, then aggregated or deleted | Product improvement only |
| Support correspondence | 24 months after resolution | Continuity of support |
| Marketing consents | Until withdrawn | Legal requirement to honour opt-outs |
Schools may request earlier deletion of their content at any time (see §7). Backups are purged on a rolling [30]-day cycle after deletion.
7. Your rights
You have the right to access, correct, delete, restrict or object to our processing of your personal data, and to data portability. To exercise any right, email privacy@rounded.education. We respond within one month. Where we act as processor, we will refer requests about school content to your school and assist them in responding.
You can complain to the Information Commissioner’s Office (ico.org.uk / 0303 123 1113), though we’d welcome the chance to resolve concerns first.
8. Cookies
We use only essential cookies (sign-in session) and [analytics tool, if any]. [Complete after final cookie audit – if any non-essential cookies are used, a consent banner is required.]
9. Changes and contact
We will post changes here and, for material changes, email account holders. Questions: privacy@rounded.education or After Hours Education Ltd, Wellesley House, Duke of Wellington Avenue, London, England, SE18 6SS.
Draft (Version 1.0), pending legal sign-off. Bracketed items – ICO registration number, named sub-processors, backup cycle and cookie/analytics detail – are still to be confirmed before wide release.