Data processing schedule

Schedule to the Writeboard terms of use (Article 28 UK GDPR), for every tutor, tutoring business, agency and school that uses Writeboard, and the starting point for an agency's or a school's own agreement. Published at writeboard.uk/data-processing, from this one document. Terms in bold are defined by UK GDPR.

Parties. The Customer (a tutor, tutoring business, agency or school using Writeboard to teach its students) is the controller of Instructional Data. Writeboard (Writeboard Ltd, company number 17460235, registered office 71-75 Shelton Street, London WC2H 9JQ, trading as Writeboard; the successor since 17 September 2026 to Oliver Woodcock as a sole trader) is the processor of Instructional Data and the controller of Platform Data.

1. Subject matter and duration

Storage, synchronisation, display and export of lesson content, and of the record the Customer keeps around it, on the Customer's instructions, for as long as the Customer's account is open and for the retention periods after removal: 30 days in the recovery bin, or 30 days read-only after a student is offboarded, then purge, then up to a further 30 days in backups. After the purge the Customer, where it is a team, retains its finished reports and its own audit trail under the student's first name; documents and consent forms are purged with the student. A safeguarding hold set by the Customer suspends every deletion until lifted.

2. Nature and purpose

To provide a shared whiteboard and the record around it: boards, pages, homework, marks, hand-ins, images and imported worksheet pages, shared live between the Customer's account and the students the Customer adds; the student's record, results and documents; contacts and guardians with links of their own; a weekly timetable and what happened to each lesson; progress reports; and, where the Customer switches it on, a recording of each lesson. Each of these beyond the whiteboard is a switch the Customer sets per team, off by default on a plain Team plan. Writeboard does not analyse, profile, mine or classify Instructional Data for any purpose of its own; a report draft is assembled from facts the Customer entered, for a person to finish.

3. Categories of data subject

Students of the Customer (children and adults); parents and guardians the Customer records as contacts or gives a link of their own; the Customer's own staff where the Customer is an organisation, including their read receipts on the Customer's policies.

4. Categories of personal data (Instructional Data)

The name or nickname the Customer types for a student; the username the student chooses; the email address (if any) the Customer enters for an invitation or the student adds, used to send password resets, a reminder the day before homework is due if the student asks for one, and the Customer's reminders about homework; everything written or placed on boards (handwriting, text, images, imported pages, homework notes, marks, hand-ins); homework tasks and their state; the lessons that happened and the Customer's notes on them, including private marks made during a lesson; the student's record (date of birth, year group, source of enquiry, schools attended, subjects with board, tier, level, grades and exam dates, results); documents the Customer uploads about the student (school reports, results, exam entries, specifications, plans, correspondence, and consent or safeguarding forms), each up to 20 MB; the names, email addresses, phone numbers and relation of parents, guardians and other contacts; the name, email address, postal address and invoice reference of whoever pays (a parent, an agency or a school); for each student sign-in, the kind of device and browser it is used on and when each was last used (never a network address), and whether the email they added is confirmed; each guardian's link, which of the Customer's students' links belong to the same parent, the channels they consented to, when the link was last used and when revoked; for each tutor invited, a link of their own to join if the Customer makes one, with when it was opened and used; the weekly timetable, holidays and the outcome of each lesson; progress reports and whom they were shared with; and, where switched on, the recorded sequence of a lesson. Free-form board content and consent or safeguarding forms may contain special category data; Writeboard applies the same protections to all such content, does not process it by category, and restricts consent forms and correspondence to the Customer's administrators.

5. Platform Data (Writeboard as controller)

The Customer's account email, display name, logo, sessions (device type and the two-letter country of the sign-in) and plan; the security log (sign-ins, changes, revocations, view-as, with a daily-salted hash of the network address); abuse, copyright and safeguarding reports and their handling; usage totals for plan limits. Purposes: providing and securing the service, preventing abuse, meeting legal obligations, and answering "what happened" questions. Retention: the security log 12 months; the record of which emails were sent (kind and time, by account) 90 days; the rest for the life of the account plus the recovery period.

6. Documented instructions

The Customer's instructions are: the terms, this schedule, and the actions the Customer takes in the service (creating, sharing, revoking, exporting, deleting). Writeboard processes only on those instructions unless UK law requires otherwise, in which case it informs the Customer before processing unless the law prohibits that.

7. Confidentiality

Only the operator has administrative access. The console shows counts and the security log, never board content, documents, recordings or exports: the support view stops at the shelf and the code refuses those routes to it. The one exception is a book held by a safeguarding freeze: the operator may open it, read-only, to assess a safeguarding report or to answer a lawful request, after giving the reason and a fresh second factor; each opening is recorded with its reason, and the Customer is told unless the law, or the risk to a child, requires otherwise (15 October 2026). Within the Customer's team, an administrator, and a coordinator where the team allows it, reads another tutor's book only by the same confirmed opening, and that tutor is told. Viewing a student's shelf "as them" is read-only, expires after fifteen minutes and is recorded at start and end. Within the Customer's own team, a coordinator runs a student's file, timetable and reports but never opens their work; an assigned tutor opens the work; consent forms and correspondence open only to the Customer's administrators, and each opening is recorded on the Customer's own audit trail. Any person given operator access in future is bound by a written confidentiality obligation.

8. Security measures

In summary, and in full in our technical facts sheet, which we send on request: tenant isolation enforced per request through one authority function and covered by a test that tries every route as every wrong party, the coordinator, the departed tutor and the operator's support view included; role-based capabilities on the live connection; TLS only with HSTS and a content security policy; same-origin policy on writes; session cookies HttpOnly, Secure, SameSite, 30-day expiry; scrypt password hashing, eight-character minimum, common-password block, per-username lockout; optional two-factor for Customers; hardened service configuration and a patched host; secrets in files readable only by the service; continuous encrypted backups with proven restores; a health check every ten minutes; a daily purge of deleted data.

9. Sub-processors

Listed on the privacy page, under who else handles the data. General authorisation is given for those listed. Writeboard gives 30 days' notice on the privacy page and by email before a new sub-processor handles Instructional Data; the Customer may object and, if the objection cannot be resolved, terminate and export without charge. Sub-processors are bound by terms no less protective than this schedule.

10. Data subject rights

Writeboard assists the Customer with requests from students or parents: the Customer can export a student's data (books, tasks, images, the record, documents and reports) and remove or erase a student from the service without asking Writeboard; a guardian can stop each kind of email through the link in it, and the Customer can revoke a guardian's link at any time. Requests that reach Writeboard directly are passed to the Customer within 2 working days with Writeboard's assistance; a request from a child or parent is never simply refused.

11. Personal data breaches

Writeboard notifies the Customer without undue delay and in any case within 48 hours of becoming aware of a breach affecting Instructional Data, with what is known, the likely consequences and the measures taken, and updates as facts emerge, following our breach procedure, which we send on request.

12. Impact assessments and consultation

Writeboard provides the information in the technical facts sheet, its own DPIA and this schedule to help the Customer carry out any assessment, and assists with prior consultation with the ICO where required.

13. Deletion or return at the end

At the Customer's request or on termination, the Customer exports their data from Your data in Settings, as one file, and every student's data from the student's page. A team ends by its admin closing it (or Writeboard, when the agreement has ended): for 30 days everything is read-only for everyone on the team and the export still works, and it can be reopened; on day 30 every student is purged and then the team itself, its finished reports, audit trail, documents and invoices included. Writeboard keeps no copy of the Customer's invoices, which the Customer keeps for as long as the law requires of it. On account deletion everything enters the 30-day recovery bin, is removed from the live service after it, and leaves backups within a further 30 days. A team's finished reports and its own audit trail are retained under the student's first name as the Customer's record of what it did, and are deleted with the team's account. Nothing else is retained beyond that unless UK law requires it, or a safeguarding hold the Customer set is still in place.

14. Audit and information

Writeboard makes available the information needed to demonstrate compliance with this schedule: the technical facts sheet, the security log entries relating to the Customer's data on request, and answers to reasonable written questions. An on-site audit may be requested once a year on 30 days' notice at the Customer's cost, scoped to Instructional Data.

15. Liability and precedence

This schedule forms part of the terms. Where it conflicts with the terms on the processing of personal data, this schedule prevails.