Data protection for schools

At a glance

Who is responsible

Markaroo is an AI-assisted marking and learning service for secondary schools, operated by Citrine & Sage Limited, a company registered in England.

Under the UK GDPR, the school is the Data Controller and Citrine & Sage Limited is the Data Processor. The school decides why pupil data is processed and on what lawful basis. We process it only on the school's documented instructions, as Article 28(3)(a) requires. We are happy to help a school identify its lawful basis, but the decision and the record of it stay with the school.

What we process

We do not collect special category data, and we ask schools not to upload it. We do not request home addresses, dates of birth or SEN or safeguarding records. We use this data only to sign users in, transcribe and mark work against the mark scheme, let teachers review, publish and export results, and keep the service secure and accurate.

Sub-processors

These are the companies that process personal data on our behalf to deliver Markaroo. Each is engaged under its own data processing terms.

AI model providers

Handwriting transcription, marking, written feedback and the Learning coach use large language models from the providers below. We may use any of them, depending on the task and the accuracy we measure. They receive the pupil's work and the mark scheme: typed answers, and scanned scripts as images. Our requests do not include names, email addresses or account details, although a name the pupil has written on a script is visible in its image. Each is engaged on paid business terms under which pupil work is not used to train their models.

Other services

Our apps load typefaces from Google Fonts, which sees the visitor's IP address in the same way any website visit does.

Planned: Wonde

Wonde is not engaged and processes no data for us. We list it so the position is disclosed in advance. If a school chooses to connect it in a full deployment, Wonde would read the class and pupil roster from the school's MIS. The school grants that access from its own Wonde panel, chooses the scopes and can revoke it at any time. We would not propose connecting Wonde during a trial.

Changes to this list

We give schools 30 days' written notice before adding or replacing a sub-processor that handles pupil data, and a school may object within that period. Moving work between the AI model providers already listed does not count as a change. To be notified, email parth@markaroo.co.uk with the subject "Sub-processor updates".

AI processing and international transfers

Pupil records, marks and transcribed work are stored in the United Kingdom: the database in AWS London (eu-west-2) and uploaded scripts on our application servers in Google Cloud London (europe-west2). Both are encrypted at rest and in transit.

AI processing is a separate matter, and we state it plainly. Transcription, marking and feedback send the pupil's work to one of our AI model providers, all of which process it in the United States. Schools should record AI processing as an international transfer of pupil work, though not of names or contact details.

Teachers stay in control

In Marking and in teacher-set Learning assignments, no AI mark reaches a pupil until a teacher has published it. Until then, results are visible to school staff only. A teacher can override the total, change the marks on any question with a recorded reason, and edit the feedback. We keep the original AI output for audit but never show it to the pupil. The teacher remains the marker of record, so there is no solely automated decision within the meaning of Article 22.

When a pupil practises on their own in Learning, AI feedback is shown straight away. That is the purpose of practice, and it is the pupil's own formative work rather than a mark set by the school.

Sign-in and accounts

Schools can sign in through their own Microsoft Entra ID or Google accounts. Authentication then happens entirely within Microsoft or Google, so the school's conditional access and multi-factor policies apply unchanged, and we never see the password. On first use, Entra asks a school administrator to consent to the permissions we request: sign-in and reading the user's basic profile. The school can withdraw that consent at any time, which revokes access for everyone at the school.

Users without single sign-on can register with an email address and password. We store only a salted one-way hash of the password, never the password itself. For schools, we recommend single sign-on.

Security

• All traffic is encrypted in transit with TLS, including connections to the database.
• The database is encrypted at rest by Neon, with keys managed through AWS Key Management Service. Uploaded scripts sit on server disks that Google Cloud encrypts at rest.
• Pupils see only their own work. Teachers see only the classes and workspaces they belong to.
• Access to production data is limited to named personnel on a least-privilege basis.

We hold no security certification yet.

Retention and deletion

• We keep pupil data for the period agreed with the school. Unless the school specifies otherwise, the default is the end of the academic year after the year of collection.
• A school can ask us to delete a pupil, a class or its whole dataset at any time. We complete this within 30 days and confirm in writing.
• When an agreement ends, we delete all school data within 30 days and confirm in writing, unless the school asks for an export first. A deletion certificate is available on request.

Automatic enforcement of the retention period is not yet in place. Until it is, we delete on request rather than on a schedule.

Breaches and your rights

Breaches. We will notify the school without undue delay, and in any event within 24 hours of becoming aware of a personal data breach affecting its data. That gives the school time to meet its own 72-hour obligation to the ICO. We will describe the nature of the breach, who is affected, the likely consequences and what we have done.

Data subject rights. Pupils and parents should make requests to the school, which as Data Controller decides how to respond. We help the school with access, rectification, erasure, restriction, objection and portability requests at no charge, in time for its statutory deadline.

Children's data. We process the minimum data needed and apply no profiling, behavioural advertising or engagement nudges aimed at children. Our approach follows the ICO's Age Appropriate Design Code.

Audit. Once in any twelve-month period, a school may ask for reasonable evidence that we comply with this page and with Article 28.

Change log