Data processing terms for tutors

• Subject matter: hosting the work you set your students on Markr, marking it, and showing you their results and progress.
• Duration: while you have a tutor account, and until the data is deleted under section 8.
• Data subjects: your students.
• Personal data: their display name and email address; the work you set them; their answers, working and drawings for it; marks and your feedback; and, for questions they practise while linked to you, which they answered and whether they got them right.
• Special category data: none. Markr doesn't ask for it, and you shouldn't add it (for example, health details in feedback).

A student's account itself, and the practice they do for themselves, is Markr's responsibility as controller, as set out in the privacy notice. If you remove a student, their account carries on as an ordinary student account.

• Only add students you teach, and have a lawful basis for using Markr with them (usually that their family has arranged tutoring with you).
• Tell your students, or their parents, that you use Markr. You can point them to the privacy notice.
• For a student under 13, have their parent or guardian's agreement first.
• Keep your login secure and don't share your account.
• Deal with your students' requests about their data, with Markr's help where needed (section 6).

• Markr processes your students' data only to provide Markr to you and them, and otherwise only on your documented instructions. Using Markr's features (setting work, marking, removing a student) counts as your instructions.
• If the law requires Markr to process the data in some other way, I will tell you first unless the law forbids it.
• If I think an instruction from you would break data protection law, I will tell you.
• Markr never sells the data, uses it for advertising, or shares it with other tutors.

• Only Aaron Godwood has access to Markr's systems, and only to run and support Markr. Anyone given access in future will be bound by confidentiality.
• The data is protected by access rules in the database, so each tutor can only reach their own students' work; connections are encrypted; and passwords are stored scrambled.
• Security measures are kept under review as Markr grows.

You authorise Markr to use these sub-processors:

• Supabase: database and logins (EU, Frankfurt).
• Vercel: website hosting.
• Resend: account emails such as password resets.

Each is bound by data protection terms at least as protective as these. Where data leaves the UK, it is covered by a UK adequacy decision or the UK's approved transfer terms. I will tell you at least 14 days before adding or replacing a sub-processor, and you can object by closing your account.

• If one of your students asks Markr to see, correct or delete their data, I will pass it to you (unless it is only about their own account and practice) and help you answer it.
• I will give you reasonable help with your own data protection duties, such as security questions or an impact assessment, so far as they concern Markr.
• I will make available the information you reasonably need to show these terms are being met, and answer reasonable questions about them.

If a personal data breach affects your students' data, I will tell you without undue delay, and within 48 hours of finding it, with what is known about it and what is being done. I will keep you updated and help you meet any duty you have to report it.

When your tutor account closes, the work you set your students, their answers to it, and your feedback are deleted within 30 days, unless the law requires them to be kept. Ask before closing if you would like a copy first. Your students keep their own accounts and practice.

If these terms change, the date at the top will change, and I will tell you by email before a significant change takes effect. Questions about these terms, and notices under them, go to hello@markrmaths.com.