Privacy Notice
How RewardClass Schools uses teacher, school and pupil information, including learning progress, School Points and subscription details.
1. Who is responsible for the information?
RewardClass operates RewardClass Schools. RewardClass may act as a controller of information necessary to operate its own accounts, subscriptions, support and security. A school may be the controller for pupil and classroom information and RewardClass its processor when working under the school’s instructions. The roles depend on the actual processing and any school agreement; they are not automatically decided by this notice.
Individual teachers using the service independently must have appropriate authorisation and determine their own obligations before adding pupil information. Where RewardClass is a processor, a suitable written data-processing agreement may be needed in addition to this notice.
Privacy contact: privacy@rewardclass.com.
2. The information used by the service
| Area | Examples of personal information |
|---|---|
| Teacher & admin accounts | Name, email, hashed password, school role, country, account status, login/security events, invitation and email-verification records, legal acceptance history. |
| Schools & classes | School name, class and group membership, year/grade group, school preferences, staff invitations and administrative settings. |
| Pupil access | Display name, pupil identifier or username, class, year/grade group, and protected sign-in/PIN data where used. |
| Learning & recognition | Homework, lesson/quiz/challenge answers, attempts, submissions and uploaded files, scores, teacher feedback, progress, awards, School Points and milestone history. |
| Billing & service contact | Plan, billing country/currency, Stripe customer/subscription references, transaction status, support correspondence and email delivery information. Card details are handled at Stripe checkout or its billing portal, not entered into the RewardClass school app. |
| Technology & choices | Session cookies, cookie preferences, server and security logs, device/browser information where collected, and country hints or manual country selection for localised pages. |
Schools and teachers decide which pupil data to add. Do not upload sensitive safeguarding case files, medical histories or other unnecessary special-category information through ordinary classroom tools.
3. How and why information is used
| Purpose | Responsibility / potential UK GDPR basis |
|---|---|
| Registration, teacher accounts, invitations, service access and subscription administration | Where RewardClass is controller: contract or steps requested before a contract. |
| Security, abuse prevention, service maintenance and support | Where RewardClass is controller: legitimate interests and, where relevant, legal obligations. |
| Invoicing, accounting, fraud prevention and legally required records | Where RewardClass is controller: contract, legal obligations and/or legitimate interests, depending on the record. |
| Assignments, marking, challenge scores, School Points, class reporting and teacher feedback | Usually school-directed processing: the school determines its appropriate lawful basis and RewardClass follows applicable instructions as processor. |
| Service improvements using minimised operational information | Where RewardClass is controller: legitimate interests where appropriate, subject to necessary assessments and protections. This does not authorise using pupil records for targeted advertising. |
The precise basis can differ by processing activity and location. Checking “I have read the Privacy Notice” at teacher registration is an acknowledgement, not blanket consent for every use of personal information.
4. Pupils and children
The service is designed for school-age children, generally using accounts created by their teacher or school. Pupils are not asked to register as independent paying customers. We aim to use minimal identifiers and privacy-protective defaults and do not design the pupil service for targeted advertising or precise-location tracking.
Schools must provide any notices or authorisations they are required to provide to parents, carers or pupils. Specific rules vary internationally. For example, a US school using the service for children under 13 should assess the Children’s Online Privacy Protection Act (COPPA) requirements and obtain any applicable school or parental authorisation. School use does not, on its own, make every collection of a child’s data exempt from these rules.
There is a simpler Children’s Privacy Notice for pupils and their families.
5. Who receives information?
Authorised school staff and the pupil may see relevant classroom information according to their role. We use service providers as necessary to operate RewardClass. These include Stripe for paid checkout/subscription processing and SendGrid for transactional emails where email delivery is configured. Hosting, storage, backup and security providers may also process information on our behalf.
We may disclose information where legally required, to protect users and the service, or in a business transfer with appropriate protections. RewardClass Schools is not designed to sell pupil personal information or disclose it to advertising networks for behavioural targeting. A separate provider/subprocessor inventory and agreements should be supplied to schools where required.
6. International access and transfers
RewardClass is available in multiple countries, and service providers may process personal information outside the country where the school is located. Where the law restricts transfers, appropriate transfer arrangements must be in place. These may include adequacy arrangements or recognised contractual safeguards with any required assessments. The available hosting location and transfer arrangements should be confirmed in school data-processing documentation; choosing a country in the user interface does not change where data is stored.
7. Retention, export and deletion
We keep records while needed for the service, school instructions, troubleshooting, security, legal compliance or legitimate billing/accounting purposes. Different records may have different retention periods. We cannot promise a universal deletion deadline without the school agreement and an approved retention schedule.
Ending a trial or subscription generally limits access but does not itself erase classroom history. School Admins can review school closure in School Operations; independent teachers can review closure from My Classes. Archived class and pupil records may have permanent-deletion options for authorised staff. These tools require identity confirmation and can be blocked when billing, shared records, contractual requirements or retention issues need further review. You can also contact us to discuss export and deletion.
Some records may remain for legal or security reasons and for limited backup recovery periods. A school export CSV is not necessarily a complete copy of every file or database record; contact us when a comprehensive portable export is required. Any remaining retention and final backup expiry should be documented in the applicable arrangements.
8. Automated quiz marking
Objective quiz and challenge answers can be marked automatically, resulting in scores, progress measures and configured School Points or milestones. These support teacher decisions; they are not intended to make legal or similarly significant decisions about pupils without meaningful human involvement.
9. Protecting personal information
Our application uses role-based permissions, password hashing and session-security measures, among other protections. Schools and teachers should protect invitations, pupil sign-in details and shared devices. No online service is perfectly secure. Please notify us promptly of suspected unauthorised access.
10. Privacy rights and requests
Depending on applicable law and circumstances, people may have rights to know how information is used, access it, correct it, request deletion or restriction, object to certain uses, and obtain portable copies where applicable. Requests about school-controlled pupil records are usually handled first by the school.
Send questions or requests to privacy@rewardclass.com. We may verify identity or refer a pupil-data request to the relevant school. You can also raise concerns with the applicable privacy regulator. In the UK, this is the Information Commissioner’s Office. People in other countries may have local regulatory rights.
11. Cookies and country selection
Essential sessions keep the service operating. The public site can use hosting country information, a configured IP-location provider, browser language and manual selection to suggest country-specific labels and prices. Browser language is not proof of physical location. More details are in the Cookie Notice.
12. Changes and how to contact us
We may revise this notice when our features, providers, processing or the law changes. The effective date and version are displayed above. Material changes should be communicated to relevant account holders as appropriate.
RewardClass
United Kingdom
Privacy: privacy@rewardclass.com · Support: support@rewardclass.com