Privacy Policy

Version 2.0 · Effective date 15 September 2026

Introduction

This Privacy Policy explains how Top Marks AI Ltd ("Top Marks", "we", "us") collects and uses personal data when you visit our website, contact us, or use the Top Marks platform (the "Platform"), our AI-assisted marking and feedback service for schools.

We act in two roles. For student assessment data and staff accounts on the Platform, the school is the controller and we act as its processor under Schedule 1 (Data Processing Agreement) to our Platform Terms and Conditions (topmarks.ai/terms). For our website, enquiries, marketing and business contacts, we are the controller. This Policy is a notice describing our processing; it does not form part of, and does not vary, our contract with any school.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the EU GDPR. We review this Policy regularly; the date of the last update is shown above. Questions may be sent to the contact details in section 13.

1. What Data Do We Collect About You?

Personal data is information that relates to you and identifies you, or can be used to identify you, such as your name, email address or digital identifiers such as IP addresses.

1.1 Data we process on behalf of schools (as processor)

Schools provide this data directly (for example, by upload or manual entry) or authorise us to retrieve it from their Management Information System (MIS) through Wonde's API. It comprises:

• Student Data: full name or student identification number; year group and class (where the school provides them); exam or essay responses, including handwritten responses converted into text; and assessment results and feedback generated by the Platform.

• Staff Data: full name; email address; institution name; hashed login credentials; records linking uploaded assessments to teacher accounts; and support communications with us.

1.2 Data we collect as controller

• Website and Platform usage data: IP address, browser type, operating system, pages visited, features used and time spent, collected through server logs, cookies and similar technologies (see section 11 and our Cookie Policy at topmarks.ai/cookies).

• Enquiry and business contact data: name, role, organisation, contact details and the content of our correspondence with prospective and existing school customers, partners and suppliers.

• Marketing preferences: your consent or opt-out status for marketing communications.

We do not require or deliberately collect special category data, such as health information or biometric data. Free-text assessment responses may occasionally contain such information; it is processed only as part of the assessment content and is never used for profiling.

We may aggregate and anonymise personal data to produce statistical data (for example, the percentage of users who use a particular Platform feature). Aggregated data does not identify you and is not personal data. If we ever re-combine it with personal data, we treat the combined data as personal data under this Policy.

2. How Do We Collect Your Personal Data?

We collect your data in the following ways:

• Directly from you, when you sign up, contact us or use the Platform.

• From schools, which provide student and staff data for assessment purposes, either directly (for example, by CSV upload or manual entry) or from the school's MIS via Wonde's API, at the instruction of an authorised school administrator when the integration is configured. The school specifies which categories of data are retrieved and can disable the integration at any time.

• Automatically, through cookies and similar technologies when you interact with our website or the Platform.

3. How Do We Use Your Personal Data?

For student assessment data and staff Platform accounts, we act as processor on the school's documented instructions. The school determines the purposes and the lawful basis (for most schools, public task under Article 6(1)(e) UK GDPR; for independent schools, typically contract or legitimate interests). Neither we nor the school rely on consent for this processing. Our processing on behalf of schools is described in Annex A to Schedule 1 of our Platform Terms and Conditions and in our DPIA Support Pack.

Where we act as controller, we process personal data for the following purposes:

4. Do We Share Your Personal Data?

We do not sell or rent personal data. We share it only as follows:

• With our service providers, which process it on our behalf and on our instructions: the hosting, database, file storage, analytics and email delivery providers for the Platform (listed, with locations, at topmarks.ai/subprocessors), and the business tools we use as controller, such as our CRM, support and email systems. We do not allow service providers to use your personal data for their own purposes.

• With the school, which as controller has access through the Platform to its own students' and staff's data. This is the controller's own access rather than a disclosure by us.

• With AI model providers, but only anonymised assessment content from which student identity and incidental identifiers have been removed. No personal data is shared with them.

• Where required by law, a court order or a regulator.

5. Children's Privacy

Where a school in the UK or the EEA uses the Platform, it does so as an educational institution in the course of providing education to its pupils. In that context:

• Consent is not the lawful basis. Neither we nor the school rely on consent under Article 6(1)(a) UK GDPR (or EU GDPR) for the processing of student assessment data. The school identifies and maintains its own lawful basis for sharing that data with us, and confirms that it has done so when it signs its Subscription Contract or Trial Agreement. Parental or guardian consent is therefore not generally required before a UK or EEA school shares student data with us for assessment purposes.

• Privacy notices are provided by the school. Because the school is the controller and we have no direct relationship with students or their families, the school is responsible for providing the information required by Articles 13 and 14 to students and, where appropriate, their parents or guardians. We publish this Privacy Policy and our DPIA Support Pack to help schools do this.

• Limited data collection. We process only the student data the school chooses to provide, and only to the extent necessary to deliver automated marking and feedback. We do not collect student email addresses or contact students directly.

6. How Do We Protect Your Data?

Personal data is encrypted in transit using TLS and at rest using AES-256 encryption. Access to personal data is restricted by role to staff who need it, protected by multi-factor authentication, and logged. Student and staff data processed on behalf of schools is hosted in the United Kingdom and the European Union. Top Marks holds Cyber Essentials certification. Further detail on our security measures is set out in our DPIA Support Pack.

Where we have given you (or you have chosen) a password, you are responsible for keeping it confidential. Please do not share your password with anyone.

7. How Long Do We Keep Your Data?

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy and to comply with our legal obligations:

Student assessment data and staff Platform accounts are held on behalf of schools as their processor. We do not delete this data on our own initiative. It is retained for the school's Licence Period and then returned or deleted in accordance with paragraph 11 of Schedule 1 to our Platform Terms and Conditions (deletion within 90 days of the end of the contract, or within 30 days of the school's instruction, after the school's 60-day export period), or earlier on the school's instruction.

• Enquiry records and business contact data held as controller are deleted 24 months after our last contact with you, after notifying you first.

• Website and Platform usage data is retained for the periods set out in our Cookie Policy and, for security logs, for 12 months.

• Some data may be retained for longer where required by law, for example accounting records.

8. International Data Transfers

Student and staff data that we process on behalf of schools is stored and processed in the United Kingdom and the European Economic Area (EEA). Anonymised assessment content is sent to AI model providers in the United States; it does not identify any individual and is not personal data.

Some of the business tools we use as controller, such as CRM, support, email and analytics systems, may store enquiry and business contact data outside the UK and EEA, including in the United States. Where we transfer personal data outside the UK or EEA, we rely on UK adequacy regulations or an EU adequacy decision, or we put in place the UK International Data Transfer Agreement or Addendum (for transfers from the UK) or the EU Standard Contractual Clauses (for transfers from the EEA). You can ask us for more detail about the safeguards used by contacting us (section 13).

A current list of our sub-processors, by name and location, is at topmarks.ai/subprocessors.

9. Automated Decision-Making

The Platform uses artificial intelligence to generate suggested grades and written feedback on student work. These suggestions are reviewed by the school's teaching staff, who retain final judgement; nothing is released to a student or used for any summative or reporting purpose without that review. We do not make any decision producing legal or similarly significant effects on any individual solely by automated means.

10. Your Rights

Where we process your personal data on behalf of a school as its processor, which includes student assessment data and staff Platform accounts, the school is the controller and decides how rights requests are handled. You may contact the school directly, or contact us at info@topmarks.ai and we will acknowledge your request and refer it to your school within two business days. Where we process personal data as controller in our own right (section 3), we handle your request ourselves, normally within one month.

Under the UK GDPR and, where applicable, the EU GDPR, you have the following rights:

• Access: to request a copy of your personal data.

• Rectification: to have inaccurate or incomplete data corrected.

• Erasure: to have your data deleted where there is no good reason for us to continue processing it.

• Restriction: to limit our processing in certain circumstances.

• Objection: to object to processing based on legitimate interests, and to direct marketing at any time.

• Portability: to receive the data you have provided to us in a structured, machine-readable format.

• Withdrawal of consent: where processing is based on consent, to withdraw it at any time.

• Complaint: if you are unhappy with how we have handled your personal data, please contact our data protection lead (COO) at info@topmarks.ai so that we can try to resolve the matter. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in the EEA, to your local supervisory authority.

11. Marketing and Cookies

We may send you marketing communications about our services by email where you have consented or where the 'soft opt-in' applies, that is, where you have enquired about or purchased our services and have not opted out. You can opt out at any time by using the unsubscribe link in any marketing email or by contacting us (section 13). Opting out of marketing does not affect service communications that we need to send you about the Platform or your account. We will not share your personal data with any other organisation for its own marketing purposes.

Our website and the Platform use cookies and similar technologies for essential functions and, with your consent, for analytics. Details of the cookies we use, their purposes and how to manage them are in our Cookie Policy at topmarks.ai/cookies.

12. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. We will publish the updated version at topmarks.ai/privacy with a new 'last updated' date and, for significant changes, notify Platform users by email or by a notice on the Platform.

13. Contact Us

For any questions about this Privacy Policy or to exercise your rights, please contact us:

Email: info@topmarks.ai

Address: Harben House, Harben Parade, Finchley Road, London, United Kingdom, NW3 6LH

ICO registration number:ZB903015

Data protection lead:Chief Operating Officer

Document information