For your DSL or DPO
Data protection summary
A two-minute read. Full detail in our privacy notice; questions to info@getondesk.com.
What we collect
- Name, school email and password check (never readable by us).
- School year and an optional stated interest area.
- Date of birth - used only to determine age and whether parental consent is required.
- Module progress and any task answers the student submits.
- For students under 18: a parent or guardian email, consent status and consent date.
- Order records where one-to-one support has been purchased. We never hold card details.
Why we collect it
To provide the platform to your licensed cohort: age-appropriate content, progress tracking, assignment records, and lawful operation for minors. We do not use student data for marketing, advertising or profiling, and we do not sell it.
How long we keep it
While the school's licence is active or the account is in use. On a student leaving, or on request, progress data is deleted. Date of birth is deleted when it is no longer needed for the age and consent checks.
Who sees it
- The student: their own account and progress.
- Your careers lead: only their own school's cohort. Access is technically constrained to their school; other schools' students are never queryable.
- A parent: only the students they are linked to.
- onDesk staff: to run and support the platform.
- Students cannot see each other's data. There is no student-to-student messaging anywhere on the platform, and no field where one student's work is visible to another student.
Consent for minors
Under-16 accounts do not open until a parent or guardian confirms consent through a private, single-use link. Consent status and the date it was given are recorded on the account. For 16-17 year olds, parental consent is required before anything can be purchased for them.
Deletion and subject access
Requests for a copy of data, correction or deletion go to info@getondesk.com. We respond within one month. A school can also request deletion of an individual student's data or a whole cohort's data at the end of the licence period.
Safeguarding
Coach accounts remain disabled until a DBS Enhanced with Barred List check is recorded against that person. Safeguarding concerns should go to info@getondesk.com and, where relevant, the student's school.