Data protection: information for schools
For data protection leads: whether we process pupil data, where it goes, and what you need for your records. The short answer is that pupil data never reaches us.
The short answer
- We are not a processor of your pupil data, because your pupil data is never sent to us.
- Every tool that holds a class list runs inside the teacher’s browser. Names typed into a seating plan or a marksheet stay on that machine.
- We are a controller only for the teacher’s own account: their email address, their subscription and their usage counts.
- The one thing to tell staff: do not type a pupil’s name into the AI tools. They are the only tools that transmit anything.
1. Why there is no data processing agreement to sign
A data processing agreement under Article 28 is required when a supplier processes personal data on your behalf. We do not, so there is nothing for the agreement to govern.
This is not a technicality we are hiding behind. It is the reason the tools were built the way they were. A teacher planning a seating plan is handling special category data in some cases — SEN status, EAL status — and the safest place for that is the machine it was typed on. So the tools that need it do all their work in the browser and have no server component at all.
If your procurement process requires a signed agreement regardless, email us and we will sign one that reflects the position accurately.
2. What the browser tools do with a class list
48 of our tools are browser tools. They are downloaded to the teacher’s computer as ordinary web page code and then run there, in the same way a spreadsheet runs on a laptop.
When a teacher pastes a class list into the seating plan, the set allocator or the marksheet:
- nothing is sent to this website;
- nothing is sent to any third party;
- the data is held in the browser’s own storage on that device, and nowhere else;
- printing produces a document on the school’s own printer.
A DPO can verify this without taking our word for it: open the tool, enter test data, and watch the browser’s network panel. No request is made.
The corollary matters for your own risk assessment. Because the data is on the device, it is covered by your own device policy, not by ours. On a shared staffroom computer, another member of staff using the same browser profile can open the tool and see the saved class list. Staff should use their own profile, or clear the tool when they have finished. We have no way to enforce that for you.
3. The AI tools, and the one rule for staff
The 12 AI tools do transmit: the text a teacher submits goes to our specialist language-processing provider, which processes it and returns a result. Nothing about the teacher goes with it — no name, no email address, no account identifier.
So the single instruction worth putting in your staff guidance is: use initials, not names, in the AI tools. None of them needs a real name to do its job, and no marking or feedback tool on this site is improved by knowing who the pupil is.
Submitted text and the answer to it are cached on our server for 1 week so that repeating a request does not cost twice, then deleted automatically. Our provider does not use the text to train models.
4. What we are a controller for
For the member of staff who holds the account, Arabic Tools is an independent controller of: their email address and username, their subscription and payment records, and a count of which tools they used and when.
That relationship is controller to controller, not processor. Full detail, including retention periods and lawful bases, is in our privacy policy.
We hold no pupil records, so there is nothing pupil-related for you to include in a subject access response from us, and nothing for us to return or delete at the end of a contract.
5. Sub-processors, transfers and hosting
For completeness, since your records will want them listed. If your supplier register needs each of these identified by name, email us and we will confirm them in writing — that is a reasonable thing for a school to ask and we will not make you chase it.
| Who | For what | Pupil data? |
|---|---|---|
| Our hosting provider | Hosting the website and its data. | No |
| our specialist language-processing provider | Processing text submitted to the AI tools. | Only if a member of staff types one in, contrary to section 3. |
| Our payment provider | Taking card payments from the account holder. | No |
Where processing takes place outside the United Kingdom, it relies on a UK adequacy decision or the International Data Transfer Addendum.
6. Questions, and who to ask
Email contact@arabic-tools.com. If you need a completed supplier questionnaire, a signed agreement or a written answer for your records, ask and we will do it — we would rather spend an hour on that than have a teacher blocked from using a free tool.