Redpen AI | Privacy Notice
Last updated – January 2024
About this notice
This privacy notice explains what personal data we collect from or about you. It sets out why we collect, use, and protect your personal data, and what rights you have over that data.
Who we are
We are Redpen AI Ltd, registered in England under company number 15971890.
What we do
We provide an AI-powered formative assessment platform that helps teachers provide high quality, personalised feedback to students against the standards set in the national curriculum. We aim to provide teachers a tool to save time, whilst improving quality of feedback, to allow them the space to do what they do best; teach.
Our role
Typically, we act as a processor of your personal data. This means that we only process data about you to provide our service to our customers, or on the instructions of our customers that use us to provide their services. For information on how our customer uses your personal data, including how we fit into that processing, you should review their privacy notice or contact them for more information.
This notice applies to the personal data we process as a controller (this means when we are responsible for deciding how we collect, use and store information about you), and as a processor (when we process personal data provided by a teacher or school on their instructions).
We are registered with the Information Commissioner's Office (ICO) under number ZB883899.
How we collect and use your information
How we collect and use your personal data will depend on how you interact with us or the services you use.
If you are just browsing our website
We may collect your data using cookies or other tracking technology. Cookies are small text files that are placed on your device, such as your computer, phone or tablet, when you view pages on our website. These cookies allow us to track some of your browsing preferences and optimise how the website works.
While we are not looking to identify you using cookies as the focus is on your device, it may be possible for us to identify you or infer information about you. Unless the cookies are "strictly necessary" to make our website function, we will always ask for your consent before they are placed on your device.
If you've signed up to use our product
When you sign up to use Redpen AI, we collect and use your data for a number of reasons. Here's a breakdown of what we use, and why:
Registering your interest, creating your account, and managing it — For all of these, we use your name, email address, and the name of your school. This is necessary to fulfil our contract with you.
Improving our platform's suggested feedback — We analyse previous feedback generated on the platform, along with any edits you've made to it, alongside your name. Again, this forms part of our contract with you.
Sending feedback surveys — From time to time we may send you a short survey to help us understand how we can improve. For this we use your name and email address, on the basis of our legitimate interests.
Sending marketing emails — We may occasionally send you relevant updates about new products or services we offer. For this we use your name and email address, again on the basis of our legitimate interests. You can opt out at any time using the link in any of our emails.
If your school is using our product
If your teacher or school uses Redpen AI, we'll need to process some of your information in order to deliver the service. Because we act on the instructions of your school in these cases, any questions about how your data is used, how long it's kept, and on what legal basis, should be directed to your teacher or school — not to us.
That said, here's an overview of what we process and why when working on your school's behalf:
Setting up a new lesson — We use the teacher's name and the names of the students involved.
Processing submitted work — We use the student's name and an image of their submitted work.
Providing suggested feedback to the teacher — We use the student's name and an analysis of their work.
What do we mean by "legal basis"?
We are only able to use your personal data when the law allows us to. This is called the legal basis. The legal bases listed above are explained below:
Consent – You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. To do so please contact the Data Protection Officer via the details supplied below.
Contract – We need to use your data to fulfil a contract you have with us. Alternatively, it's necessary to use your data because we have asked you to, or you have taken yourself, specific steps before entering that contract.
Legal Obligation – We need to use your data to comply with the law.
Vital Interests – Processing your data is necessary to protect your vital interests or those of another person. For example, to prevent you from serious physical harm.
Public Task – Using your data is necessary for the performance of a task carried out in the public interest, or because it is covered by a task set out in law, for example, for a statutory function.
Legitimate Interests – Processing your data is necessary to support a legitimate interest we or another party has, only where this is not outweighed by your own interests.
We have listed two legitimate interests above: sending feedback surveys, and sending relevant marketing. In both cases, we will only send these where you have not objected to their receipt. In each email, we will give you the opportunity to opt out, as required by law.
How long do we keep your information?
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
By law we must keep basic information about our customers (including contact, identity, financial and transaction data) for 6 years after they cease being customers for tax purposes.
In some circumstances you can ask us to delete your data.
Sometimes we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Who is the information shared with?
As with most organisations, we use service providers to help us deliver our services and keep your data secure. When we use these service providers, it is necessary for us to share your personal data with them. We have agreements in place with all our providers that oblige them to protect your data.
Where your data is transferred outside of the UK, we make sure that your data is given the same level of protection, either because that country has a comparable data protection standard (Adequacy), or by using another safeguard such as an enhanced contractual agreement (IDTA).
Sometimes we may be legally obliged to supply copies of personal information to other organisations, for example to supply information to the police. We might not always be able to tell you that we have shared your information in this way, however we will ensure this is only shared in accordance with the law.
Microsoft Azure Reason data is shared: To enable our product. Location of data: UK. Transfer safeguard: N/A (data does not leave the UK).
Your rights
Under data protection legislation, in certain circumstances you have the following rights over the processing of your personal data:
Right to be informed about how your data is used
Right of access to your personal data
Right to correction or rectification of your data
Right to request deletion of your data
The right to data portability
In most cases, when we provide our services, we act as a processor and therefore you should submit your requests to your school.
Where we act as a controller, namely for account setup and management purposes, we will respond to a request to exercise these rights within one month if not before. If you would like to submit a request, please contact us at team@redpenai.co.uk.
Complaints
If you are unhappy with any aspect of this privacy notice, or how your personal data is being processed, please contact us at team@redpenai.co.uk.
If you are still not happy, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
By post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
By live chat: https://ico.org.uk/global/contact-us/live-chat
By email: casework@ico.org.uk
By phone: +44303 123 1113