Last updated: 9 October 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between the subscribing organisation (the “School”, “you”) and AB Tutor Limited (“AB Tutor Limited”, “we”) for use of AB Tutor installed on the School’s own infrastructure (“on-premise”). A separate DPA applies to the AB Tutor cloud service.
In plain language: on an on-premise installation, the data stays with you. AB Tutor is software you run on infrastructure you control; we do not host it, cannot see into it, and receive no student data from it. The only thing the software sends us is a count of which features are used, labelled with your licence. The only time we ever handle your data is if you deliberately send it to us for support — and then only for as long as that support request is open.
You are the controller of all personal data processed through AB Tutor, and you are also the host and custodian of it: student and staff data resides on the servers, network and devices you control throughout, wherever you choose to run them (see section 2.1). AB Tutor Limited is a software supplier, not a hosting provider.
In normal operation we do not act as your processor of student data, because we do not receive, store or have access to it. This DPA exists because two narrower categories of processing do occur, and because your own records of processing should reflect them accurately:
| # | What we process | Our role |
|---|---|---|
| A | Your admin, licensing and billing contact details | Independent controller — see our Privacy Policy |
| B | Service telemetry from the software (section 4) | Not personal data — see section 4 |
| C | Anything your staff deliberately send us, or show us, for support (section 5) | Processor, on your instruction, for that request only |
Data collected depends on which features you enable; monitoring features are off unless you turn them on. Depending on configuration this can include: account/class details you enter, device and technical data, screen views and thumbnails, websites visited and applications used, teacher–student chat, and keyword-triggered safeguarding alerts with short excerpts of surrounding typed text (there is no continuous keystroke logging).
All of it is written to, and stays on, storage you control. Retention, backup, access control and deletion of that data are therefore configured and carried out by you. We can advise on settings; we cannot reach the data.
The on-premise product does not integrate with Google Workspace or Microsoft Entra ID. Class lists and accounts are managed locally by you, so no directory data is exchanged with any third party through the on-premise product.
The supported configuration is a server on your own local network, running on hardware or a virtual machine you control. The product is designed for local network use: it is not tested or hardened for exposure to the open internet, and we do not support or recommend deploying it that way. Remote access to an installation should be over a VPN.
We do not technically prevent other configurations, and our licence terms do not forbid them, but running the software outside its supported configuration is your responsibility — as is the security of any environment you choose to run it in.
Consequently, where your data physically sits is your choice, not ours. If you host the installation on infrastructure owned or operated by someone else, or engage a managed service provider to run or administer AB Tutor for you, that provider processes your data on your behalf under your own arrangements with them. They are your processor, not our sub-processor; we have no contract with them, no visibility of what they do, and no responsibility for it. You should record them in your own processing records and satisfy yourself that their security and contractual terms are adequate. Nothing in this DPA covers them.
For the on-premise product we engage no sub-processors of your service data, because we do not receive it and so have nothing to pass on. (If you have chosen to host or have your installation managed by another company, that provider is engaged by you and is your processor — see section 2.1.)
The suppliers behind our own business operations (AWS Ireland for licence management, Microsoft 365 for business email, Crisp for our helpdesk) serve our correspondence with your staff and administrators. Student and parent personal data does not flow into them in normal operation. The single exception is support material you actively choose to send us — see section 5.
The software reports usage telemetry to us: counts of which product features are used, together with your licence key / school name so that we can attribute a count to an installation.
It contains no personal data about any individual — no names, no user accounts, no device identifiers, no screen or activity content, no location, and no identifiers attributable to a person. It identifies an organisation (you), not a data subject, so it is not personal data under the UK GDPR and is not “anonymised personal data” either — personal data is never collected in the first place. We use it only to understand which features are in use, and we do not share it.
Telemetry and licence checks are the only connections the on-premise software makes to us. It has no update channel, remote-support relay, crash reporting or other mechanism through which your data could reach us (confirmed with engineering, September 2026).
No IP address is retained at the telemetry endpoint (confirmed with engineering, September 2026), so nothing in the submission or its metadata is attributable to a person.
Telemetry can be switched off. If you would prefer the software not to report feature usage at all, it can be disabled — contact support@abtutor.com and we will tell you how for your version. Disabling it does not affect licensing or support.
We operate no automated channel that can retrieve data from your installation. We can only see your data if you decide to show it to us. That happens in two ways, both requiring your active step and consent at the time:
Where either occurs and the material contains personal data, we act as your processor on your instruction and:
Please avoid sending student personal data at all. In most cases logs with identifiers redacted, or a screenshot of a non-student machine, will resolve the issue. Our support team will ask you to redact where practical.
Your service data never leaves your own infrastructure, so there is no international transfer of student data. Transfers arise only for the admin, licensing and billing contact details described in section 1 (row A) and in our Privacy Policy and for any support material you send us, which is held in the UK (Microsoft 365) or EU (Crisp). Where any transfer outside the UK/EEA occurs to a third country not deemed to have adequate protection under UK data protection law, we rely on the UK IDTA / UK Addendum to the EU SCCs, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified.
Because the installation is yours, the security of the data within it is yours to maintain — server hardening, access control, patching, backup and physical security. Our responsibilities are to build and ship the software securely and to support you in configuring it safely. We maintain a written information security programme with at least annual risk assessment and review, background checks and data protection training for staff; AB Tutor Limited is certified to ISO/IEC 27001 and holds Cyber Essentials.
Our support team can advise you on secure configuration of your installation — server placement, service accounts, console roles and retention settings — on request.
Requests from students, parents or staff are handled entirely by you: you hold the data, and we have no copy to search, export, correct or delete. We will assist by explaining where the product stores particular data and how to export or purge it. Route questions to support@abtutor.com.
Retention of data inside your installation is set and enforced by you. At the end of your subscription there is no data for us to return or delete, because we hold none; you retain and dispose of your own data. Any outstanding support material we hold is deleted per section 5.
On request we will provide the information reasonably necessary to demonstrate compliance with this DPA, including our security documentation and certifications, and will support your own audits and DPIAs. Because we hold no service data, an audit of our systems tells you little about your own installation — we will reasonably cooperate to help you audit that instead.
We cannot suffer a breach of data we do not hold. A breach of student data in an on-premise installation is a breach of your systems, and the assessment and notification duties under Art. 33/34 UK GDPR are yours; we will assist with technical investigation on request. We will notify you within 48 hours of becoming aware of a breach affecting support material you sent us, or a vulnerability in our software that could expose data held in your installation, with the information you need to make your own assessment.
US schools. COPPA and FERPA apply to your use of the software. Because all student information remains on your systems and is never transmitted to us, we do not collect personal information from children with respect to an on-premise installation — see our Children’s Privacy Notice (COPPA) — On-Premise.
Nothing in this agreement should be read as us receiving education records in normal operation: on an on-premise installation, there is no disclosure of education records to us for FERPA purposes at all, so the “school official” exception has nothing to operate on. Where you do choose to send us material for support, or grant us a remote session, that is a disclosure by you, and for it we accept the conditions of the school official exception (34 CFR § 99.31(a)(1)(i)(B)) for that request only: we use what you send us solely to resolve the request, under your direction, we do not re-disclose it, and we delete it on closure per section 5. As with the cloud service, that exception is available to you only if your annual notification of FERPA rights identifies contractors of this kind as school officials.
We also do not rely on school-provided consent under COPPA here, because we collect nothing from children to consent to.
Australian schools. Because we hold no personal information from your installation, the Australian Privacy Principles bite on you as the holder of that information. Telemetry contains no personal information. Overseas disclosure under APP 8 arises only for support material you choose to send us.
EU schools. References to the UK GDPR include the EU GDPR as applicable, and references to the ICO include your competent supervisory authority. We are appointing an EU representative under EU GDPR Art. 27; details will be added here once engaged.
All notices, questions, requests and complaints under this DPA: support@abtutor.com.
