Why is Sparx a data processor and not a data controller?
Why is Sparx a data processor and not a data controller?
Your school is a data controller because you collect and control the personal data used in the Sparx system.
You determine:
Why it is collected
What it is used for (the purpose) and,
How it is processed (the means).
Sparx is your processor (for the purposes of our data relationship) because we will process personal information on your behalf.
Our assessment of roles is based on:
You having a direct relationship with the data subjects, i.e. your teachers and other school staff, students and their parents, and
That the data subjects will consider you to be using Sparx Maths as a tool to teach maths at your school
Sparx applies our expertise to use personal data in the best way to provide a high-quality bespoke learning experience for your students. The only ways we use school data to provide you with our services is listed in our Terms and Conditions > Section C: Data handling agreement > Processes undertaken.
Whilst we determine the questions being provided to students and how student data is used (means), we never determine the purpose, which comes solely from your instruction to provide Sparx products (as noted in Terms and Conditions > Section C: Data handling agreement > School data being processed).
What lawful basis does Sparx use to process data?
What lawful basis does Sparx use to process data?
In data protection terms, your school is the data controller and Sparx Maths acts as the processor.
UK GDPR regulations specify a set of lawful basis for us to process data on your behalf and we follow the lawful basis you have chosen. In our experience, most schools follow the Information Commissioner's Office (ICO) position that classroom apps used for education come under the lawful basis of a public task, with the school as a public authority acting under the Education Act.
However, we of course understand you need to undertake your own assessment and act as you see fit. Particularly considering if this is within the scope of the school’s privacy notice.
We have found that if the school is an independent school then the basis of legitimate interest is more common. More information on determining lawful basis can be found on the ICO website: Lawful basis for processing.