Last updated: 2 April 2026
1. Who we are and what this notice covers
This privacy notice explains how ProStudium (“we”, “us” and “our”) handles personal data on www.prostudium.com and related learning pages.
It covers two different contexts. First, direct website users, such as adult subscribers, prospective customers and people who contact us directly. Secondly, school-managed accounts used by teachers and pupils under a school subscription or school-led learning arrangement.
This distinction matters because, for some processing, we act as the organisation deciding why and how data is used. For other processing, especially school-managed teaching, class, assignment and quiz administration, the school will usually decide the purpose of the processing and we will usually provide the service on the school’s instructions.
Contact details
Organisation name: ProStudium
Contact email: info@prostudium.com
2. Our role: controller, processor, or both
For direct accounts and normal website operations, such as adult subscriptions, billing administration, website security, abuse prevention, cookie choices, support and business records, ProStudium will normally act as the data controller.
For school-managed teacher and pupil accounts used for class administration, pupil linking, assignment distribution and quiz-result reporting, the relevant school will usually be the controller and ProStudium will usually act as the processor, handling that data on the school’s documented instructions.
Even where we are mainly acting as a processor for a school, we may still act as a controller for limited operational matters of our own, such as keeping security logs, maintaining backups, preventing fraud or misuse, and complying with legal obligations.
3. What personal data we collect
| Context | Examples of data | Main purpose | Usual role |
| Adult direct users | Name, email address, account details, subscription status, billing identifiers, support messages, login data. | To run direct subscriptions, answer enquiries and manage the website. | Controller |
| School-managed teachers | Name, school email address, school domain, school identifier, classes created, assignments created and teacher-facing quiz reports. | To provide the school learning service and teacher tools. | Usually processor |
| School-managed pupils | Name, school email address, linked class, pupil code, quiz attempts, scores, percentages and timestamps. | To let the school deliver assignments, record progress and show results to teachers. | Usually processor |
| Technical and device data | IP address, browser and device data, server logs, cookie or session identifiers, local storage records where used for quizzes. | To run the service securely and reliably. | Usually controller for site operations |
We do not ask pupils to publish public profiles, and teacher tools should only expose pupil information to the relevant school context and class context needed for teaching and administration.
4. How we obtain the data
We collect data directly when someone registers, logs in, purchases a subscription, joins a class, completes a quiz, fills in a form or contacts us.
For school-managed use, we may receive data from teachers or school staff, or pupils may enter it themselves using a school email address.
Where the school-domain claim tool is used, a teacher with an approved school account may link an existing website account to one of their classes if the email address matches an approved school domain and the account is not already linked elsewhere in the school system.
5. How we use personal data
• to create and manage user accounts;
• to run subscriptions, payments, renewals and access controls;
• to provide teacher dashboards, classes, assignments and school-linked pupil accounts;
• to record, display and export quiz attempts and results;
• to keep the service secure, prevent misuse and troubleshoot technical issues;
• to answer enquiries, provide customer support and keep business records;
• to comply with legal obligations and protect our rights where necessary.
We do not use school-managed pupil quiz results for advertising to children. We do not sell pupil personal data. We do not intentionally disclose pupil results outside the relevant school context unless required by law or expressly instructed by the controller school.
6. School-managed accounts and the teacher “claim” process
Where a school uses the school-domain claim workflow, a teacher account associated with an approved school domain can attach an existing account with the same school domain to one of that teacher’s classes.
When that happens, the account is tagged internally as school-managed for the school service context, linked to a class and teacher, and written to an audit log. This is done so that quiz attempts and class administration can be properly attributed within the school service.
Claiming a school-managed account does not mean the account is visible to other schools. Access should remain restricted to the relevant school context and, where implemented, the relevant class context.
If you are a pupil or parent and you think a school-managed account has been linked incorrectly, please contact the school first. You may also contact us using the details above.
7. Lawful bases
For direct users, we generally rely on contract where processing is necessary to provide a subscription or requested service, legitimate interests for routine website administration and security, and legal obligation where we must keep records or respond to lawful requests.
For school-managed teachers and pupils, the lawful basis for the teaching, class-management and quiz-reporting activity is usually determined by the school as controller. ProStudium processes that data on the school’s documented instructions, subject to the school contract and our own limited legal and security obligations.
If a school or family asks for a copy of the lawful basis used for school-managed processing, the school should normally be the first point of contact.
8. Who we share data with
• the relevant school, teacher or school staff responsible for the class or subscription;
• payment providers used to take subscription payments, such as Stripe or another provider shown at checkout;
• hosting, security, backup, email and website support providers that help us run the service;
• professional advisers, courts, regulators or law enforcement where disclosure is necessary and lawful.
We require processors and service providers to protect data appropriately and to use it only for the services they provide to us.
9. International transfers
Some service providers may process personal data outside the UK. If this happens, we will use a lawful transfer mechanism and appropriate safeguards, such as adequacy regulations or approved contractual clauses, where required.
10. Security
We use role-based access controls, password protection, HTTPS, secure payment handling through the chosen payment provider, logging, backups and other technical and organisational measures appropriate to the risks of the service.
For school-managed data, access should be limited to authorised school users and authorised service administrators who need that access to support, maintain or secure the service.
No method of storage or transmission is completely secure. However, we work to reduce risk and to respond appropriately if we become aware of a personal data breach.
11. Cookies, local storage and session technology
We use essential cookies or equivalent session technologies to keep users logged in, maintain security and remember necessary settings.
Some quiz features may also use browser local storage to save progress or store local results on the device, particularly where a quiz has not been submitted through a school-linked assignment flow.
You can usually manage cookies and local storage through your browser settings, but some parts of the service may not work properly if essential storage is disabled.
12. How long we keep data
| Data set | Recommended retention position | Notes |
| Adult direct-user account records | While the account is active and for up to 24 months after closure or inactivity. | Review against finance, tax and dispute needs. |
| School-managed teacher and pupil account records | While the school relationship remains active and normally for up to 12 months after the school relationship ends. | A shorter or longer period may be agreed in the school contract or required for disputes, safeguarding or legal obligations. |
| Quiz attempts and results | Normally alongside the relevant school or user account record. | Delete or anonymise sooner if the school instructs this and there is no lawful reason to keep identifiable data. |
| Server logs and security logs | Usually a short rolling period, such as 30 to 180 days. | Confirm this against your actual hosting and security tools. |
| Backups | One year | Backups may persist for a limited rolling period before being overwritten. |
We review retention periodically. Where possible, and where we no longer need to identify individuals, we will delete or anonymise data.
13. Individual rights
Individuals have rights under UK data protection law, including the right to be informed, to ask for access, rectification and, in some circumstances, erasure or restriction.
If the data is part of a school-managed account, the school will usually be the first point of contact because it will usually be the controller for that processing.
If you contact us directly about school-managed data, we may need to refer the request to the school or work with the school to answer it properly.
14. Children
Where our service is used by children through a school, we aim to present privacy information in clear language and to avoid using children’s personal data in ways that are unexpected or unnecessary for the educational service.
Children and parents can ask questions about how the service works. If the account is school-managed, the school remains an important point of contact because it decides the educational purpose and lawful basis for the school use of the platform.
15. Complaints
If you are unhappy with the way personal data has been handled, please contact us first so that we can try to resolve the concern. You also have the right to complain to the Information Commissioner’s Office (ICO).
16. Changes to this notice
We may update this notice from time to time. We will publish the current version on the website and change the “last updated” date at the top.