Data controller and contact details
Scottish Borders Council (including your child's school) is the data controller. We are responsible for ensuring your child's personal information is handled safely and lawfully.
- Address: Newtown St Boswells, Melrose, TD6 0SA
- Enquiries: 0300 100 1800 | customeradvice@scotborders.gov.uk
- Education service
- Data Protection Officer: dataprotection@scotborders.gov.uk
Protecting your child's identity
Before using any application, we assess if we can achieve our goals without using personal data:
- Pseudonymisation: If a school does not synchronise Sumdog with its management information system, Sumdog states that some information, such as pupils’ names, can be pseudonymised without losing access to the service.
- Data minimisation: Schools must provide only the information needed to create and manage the pupil’s Sumdog account and class.
Information we use and purpose
The information used to run a school Sumdog account may include: pupil first and last name, class and school year; teacher first and last name, email address, password, school name and address, and optional role. Sumdog also collects technical information, usage data and educational progress data, such as accuracy and place in the curriculum. We use this to:
- Provide interactive numeracy and literacy learning at school or at home.
- Personalise progression through games and quizzes, track progress, and help teachers identify where support, intervention or consolidation may be needed.
Legal basis and safety measures
- Lawful Basis: We process this data under Public Task, to support our legal duties to provide education under the Education (Scotland) Act 1980 and Education (Scotland) Act 2016.
- Lawful Basis: We process this data under provision of a contract to support our legal duties to provide education under the Education (Scotland) Act 1980 and Education (Scotland) Act 2016. Each school will enter into a contract with Sumdog individually.
- Security: A Data Protection Impact Assessment (DPIA) has been completed. Sumdog states that information transferred to its EEA servers is encrypted in transit and at rest. Sumdog also states that its security measures include firewalls, multi-factor authentication for systems, malware protection, staff training and physical access controls.
- Retention: The school manages its Sumdog classes and accounts. Sumdog states that inactive accounts may be deleted; linked pupil accounts may be deleted at the same time. When an account is deleted, personal information is anonymised. Aggregated usage data that does not identify an individual may be retained for research and service improvement. A parent or teacher may ask Sumdog to delete information held in a linked Sumdog Family or Sumdog School.
Data sharing and decision making
- Who sees it: Access is limited to authorised staff linked to the school’s Sumdog account, Sumdog Ltd as the service provider and processor, and Sumdog’s contracted service providers where needed to deliver the service. Individual schools accept Sumdog’s terms and conditions for their accounts. Scottish Borders Council does not have a Council-wide data sharing agreement with Sumdog.
- Personalised progression and analytics: Sumdog collects educational progress information, including accuracy and place in the curriculum, and uses pupil input to personalise learning. Teachers can access pupil information and reports linked to their Sumdog School. Sumdog also uses analytics to understand, support and improve the service.
- International transfers: Sumdog states that information collected through the service is transferred to its servers in the EEA. It may also transfer information to service providers in the UK, EEA or United States, depending on location, and states that safeguards are applied in accordance with EU and UK data protection law.
| Third party category | Purpose | Pupil data is shared? |
|---|---|---|
| Third party service providers | Administration and provision of the Sumdog service. | No |
| Payment providers | Purchase and payment processing. Sumdog notes that payment details are held by its third-party payment provider. | No |
| Marketing / communications providers | Marketing and external communications. | No |
| Auto-rostering providers | Synchronisation of subscribed school accounts. | No |
| Analytics providers | Analytics and service improvement. | No |
| Professional advisers | Legal, banking, insurance, audit and accounting services. | No |
| Regulators and authorities | Compliance with legal and regulatory obligations. | No |
| Other companies in the eEducation Albert group | Reporting, system administration, data storage, hosting and selected marketing activities. Sumdog names eEducation Albert AB, Ampd AB, ARPU Management AB, Kids MBA SAS, Swedish Film AB and Sumdog Inc. | No |
Your rights and complaints
Depending on your child’s age and capacity (usually from age 12 in Scotland), they or their parent/guardian have the right to access their data or request corrections. They may also ask us to restrict processing or object in certain circumstances. For concerns or to exercise your rights, please contact the Headteacher or visit our Data protection and your rights webpage.
How to raise a complaint
We aim to directly resolve all complaints about how we handle personal information. If your complaint is about how we have handled your personal information, you can contact our Data Protection Officer by email dataprotection@scotborders.gov.uk or phone on 0300 100 1800.
However, you also have the right to lodge a complaint about data protection matters with the Information Commissioner's Office (ICO), who can be contacted by
- post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- phone on 0303 123 1113
- Visit the ICO website
If your complaint is not about a data protection matter, visit our Making Complaints webpage for more information.