For schools

Data Processing Agreement

Version 1.0 · October 2026

When a teacher uses Paddle with their classes, the school decides what student work is submitted and why. Paddle only processes that work to mark it, on the school’s instructions. This agreement sets that out in the form your data protection officer will expect, under Article 28 of the GDPR and the UK GDPR.

1. Who is who

The controller is the school, or the teacher acting on the school’s behalf. The controller decides which students submit work, what they are asked to write, and what the marks are used for.

The processor is Paddle (workpaddle.com). We process student work only to produce proposed marks and feedback for the teacher, and for no purpose of our own.

For the teacher’s own account (their name, email address and billing), Paddle is the controller. That is covered by our privacy policy, not by this agreement.

2. What is processed, and why

Purpose. To let a teacher collect student work through a link, have it marked against the teacher’s own mark scheme, review and edit the proposed marks, and publish them to each student.

Data subjects. Students who submit work through a teacher’s link, and the teachers who use Paddle for the school.

Personal data.

• The name a student types on the submission form.
• The work they submit, and the marks, feedback and comments attached to it.
• Files a teacher attaches to an assignment.
• The teacher’s name and email address, so marks are tied to the right account.

Students do not create accounts. We do not collect student email addresses, dates of birth, year groups or school identifiers. Paddle is not designed to process special category data, and teachers should ask students not to include personal details in their work beyond their name.

Duration. For as long as the teacher uses Paddle, until the data is deleted as described in section 8.

3. Our commitments as processor

• Instructions. We process student data only on the school’s documented instructions. Using Paddle as designed (setting assignments, collecting and marking work, publishing marks) is that instruction. If we believe an instruction breaks data protection law, we will say so.
• No other use. We do not use student work to train AI models, for advertising, or for any purpose of our own, and we do not sell it.
• Confidentiality. Anyone with access to student data on our side is bound by confidentiality.
• Teacher review. No mark reaches a student automatically. Every mark is a proposal that the teacher reviews, can change, and chooses to publish.

4. Security

We apply technical and organisational measures appropriate to the risk, including:

• Encryption of all traffic in transit, and of stored data at rest.
• Access scoped at the database level, so a teacher can reach only their own classes and a student can see only their own published mark.
• Files attached to assignments held in private storage and opened only through links that expire within the hour.
• Teacher passwords stored hashed, never in readable form, with Google sign-in as an alternative.
• Rate limiting and abuse controls on submission and marking.
• Aggregate product analytics only, without cookies, never including the text of any submission.

5. Sub-processors

The school gives general authorisation for Paddle to use the sub-processors below. We hold each to data protection terms at least as protective as this agreement, and we will notify account holders by email before adding or replacing a sub-processor that handles student work, so the school can object.

6. Transfers outside the UK and EEA

Marking is the only processing of student work that leaves the EEA: the work and the mark scheme are sent to Anthropic in the United States to produce the proposed mark. Anthropic does not use API inputs or outputs to train its models. This transfer, and Stripe’s processing of teacher payments, rely on the European Commission’s Standard Contractual Clauses, together with the UK Addendum for UK schools. Nothing is sent to any other AI provider, and student work is never used to search the web.

7. Helping the school

• Data subject requests. Teachers can view, correct and delete any submission themselves, immediately. If a request about a student reaches us directly, we pass it to the school and help it respond.
• DPIAs. We provide the information a school needs for a data protection impact assessment, including this agreement and answers to its questionnaire.
• Breaches. If a personal data breach affects the school’s data, we tell the school without undue delay and within 48 hours of becoming aware of it, with the information it needs to meet its own 72-hour reporting duty.

8. Deletion

• A teacher can delete a submission, assignment or class at any time. Deletion is immediate and permanent.
• Files attached to an assignment are deleted automatically twelve months after its due date.
• When a teacher closes their account, their classes, assignments, submissions and marks are deleted within 30 days.
• At the end of the service, the school can ask for a copy of its data before deletion.

9. Audits and information

We make available the information needed to demonstrate compliance with this agreement and answer reasonable security and data protection questionnaires. Where a school needs more, it may audit our compliance on 30 days’ written notice, no more than once a year unless a breach has occurred, at its own cost and subject to confidentiality.

10. General

This agreement forms part of Paddle’s Terms of Service and is governed by the same law. Where it conflicts with the Terms on the processing of personal data, this agreement takes precedence. We will update this page when the service changes, change the version and date at the top, and email account holders before any material change that affects student data.