School data processing summary

The practical facts a school data protection lead needs before a classroom pilot.

Version 1.0. Published 15 August 2026. Applies to market.thebusiness.school only.

Service and organisation

Provider: TBS Education Ltd Oy
Business ID: 3614159-3
Registered office: Lahti, Finland
ICO registration: ZC133810
Contact: support@thebusiness.school

This summary supports a school's review; it is not itself a signed data processing agreement. In the current self-service pilot TBS Education is controller for the data described in the privacy notice. A school that requires TBS Education to act as its processor must put a written Article 28 agreement in place before relying on that relationship.

Purpose, people and data

Area	Detail
Purpose	Run teacher-created classroom simulations, show live progress and provide lesson results.
Data subjects	Teachers and students, normally aged 11-18.
Student data	First name or classroom nickname, join time, choices, scores, progress and free-text answers.
Teacher data	Optional display name, saved simulation content and a one-way fingerprint of a secret teacher token.
Not requested	No student account, surname, email, date of birth, school identifier or special-category data.

Retention and deletion

Class sessions are automatically deleted after 30 days by a daily cleanup.
The teacher can permanently delete a session immediately from its dashboard.
Saved teacher simulations remain until the teacher deletes them.
Public sharing is separate and explicit; classroom data cannot enter the public library.

Hosting, transfers and suppliers

The service is hosted by Netlify on AWS. It has not been pinned to a European region; schools should treat classroom data as processed in the United States. Netlify is the service provider and publishes its own subprocessors and international-transfer safeguards. See sections 6-8 of the full privacy notice before approval.

Security and classroom controls

HTTPS in transit.
Separate stores for teacher work, public library content and classroom sessions.
Students receive only their current screen and their own game state.
The teacher dashboard requires a separate secret link; the join code is not enough.
No advertising, analytics, tracking pixels, AI processing or automated grading.

Teacher instruction: ask students to use only a first name or classroom nickname and not to enter personal information in writing tasks.

School approval checklist

Confirm the school's lawful basis and update its own pupil privacy information if needed.
Decide whether the self-service controller model is acceptable or request a signed processor agreement.
Review the disclosed US processing and Netlify safeguards.
Use a low-risk pilot activity and avoid special-category or safeguarding information.
Keep the teacher dashboard link private and delete the session after the debrief.

Requests and incidents

For access, correction, deletion, school DPIA questions or a suspected incident, email support@thebusiness.school. Include the six-character join code when the request concerns a class session.