1. Purpose
This policy sets out the categories of personal data processed by Halved Limited (“Halved”) in respect of the Halved platform, and the retention periods that apply to each category or type of personal data, and the procedures by which data is deleted and/or anonymised at the end of each retention period. It supports Halved’s compliance with UK data protection legislation and helps demonstrate how we meet our legal and regulatory obligations.
2. Scope
This policy applies to all personal data collected, stored, or processed by Halved in respect of the Halved platform in connection with the delivery of AI-assisted learning support to UK schools. It covers data held in all storage systems operated on behalf of Halved, including by such of our sub-processors Azure PostgreSQL, MongoDB Atlas, Azure Blob Storage, and Azure Cache for Redis. For more details about the use by any of the aforementioned sub-processor, please see our Privacy Policy.
This Policy does not cover Halved’s retention of its own internal controller records such as human resources and benefits records, legal and accounting records, and sales and marketing records, which are maintained as internal confidential documents.
3. Data Controller and Processor
Where Halved provides the platform to a school, the school is controller for student personal data and school staff platform data processed in the school tenant, and Halved acts as processor under the school DPA. Halved acts as controller only for its own business administration, website enquiries, sales/contract records, support records, security/compliance records, complaints records and legal/accounting records.
4. Retention Schedule
The table below sets out the retention period for each category of personal data.
| Data Category | Data Types | Storage Location | Retention Period | Basis for Retention |
|---|---|---|---|---|
| Student account data | Name, year group, school, hashed password, account creation date | MongoDB Atlas (Azure UK South) | Duration of school contract + 90 days (unless the school instructs earlier deletion or return) | School documented instructions as set out within the data processing agreement in accordance with UK GDPR Art. 28 |
| Chat messages and session transcripts | Student messages, AI responses, session identifiers, timestamps | MongoDB Atlas (Azure UK South) | Duration of school contract + 90 days (unless the school instructs earlier deletion or return) | School documented instructions as set out within the data processing agreement in accordance with UK GDPR Art. 28; or safeguarding audit retention only where enabled and instructed by school |
| Student profile analysis | Learning style summary, subject observations, and a derived communication register value, derived from session data | Azure PostgreSQL (UK) | Duration of school contract + 90 days (unless the school instructs earlier deletion or return) | School documented instructions as set out within the data processing agreement in accordance with UK GDPR Art. 28 |
| Lesson materials | Uploaded curriculum content linked to student sessions | Azure PostgreSQL + Azure Blob Storage (UK South) | Duration of school contract + 90 days (unless the school instructs earlier deletion or return) | School documented instructions as set out within the data processing agreement in accordance with UK GDPR Art. 28 |
| Student-authored content | Student-uploaded files and documents; student free-text notes (work-completion and jotter) | Azure Blob Storage; MongoDB Atlas / Azure PostgreSQL (UK South) | Retained until the student deletes it using the in-product delete control, subject to a maximum of 24 months, and in any event deleted on contract end plus 90 days | School documented instructions (UK GDPR Art. 28); student-controlled deletion supports data minimisation and the rights of the child |
| Handwriting-input images | Canvas image of a student’s handwriting, captured for the handwriting-to-text input method | Not stored; held in memory for the duration of the single conversion request only | Not retained | Recognise-and-discard; only the recognised text is stored, after screening |
| Recognised text from handwriting | Text Halved reads from a student’s handwriting, once screened | Held with whatever surface the student was entering it into (for example a chat message or a piece of submitted work) | Same retention period as that surface | School documented instructions (UK GDPR Art. 28) |
| Submitted annotations | Marked-up lesson slide images: a student’s drawings or marks, submitted as part of a piece of work | Azure Blob Storage; MongoDB Atlas (UK South) | Retained with the assignment record; no automatic expiry; in any event deleted on contract end plus 90 days; cannot be deleted by the student once submitted | School documented instructions (UK GDPR Art. 28); retained for marking and review |
| Teacher annotations | Marked-up slide images and mark coordinates authored by a teacher while marking student work | Azure Blob Storage / Azure PostgreSQL (UK South) | Duration of school contract + 90 days | School documented instructions (UK GDPR Art. 28); staff-authored feedback retained with the assignment record |
| Photographed work | Photograph of work a student has done on paper, uploaded by the student | Azure Blob Storage (UK South) | Retained as the image of that piece of work; in any event deleted on contract end plus 90 days | School documented instructions (UK GDPR Art. 28); the photograph is the record of that piece of work |
| Teacher-to-student messages | Message content, sender, recipients, timestamp | MongoDB Atlas (Azure UK South) | 7 days from sending, then automatically deleted | Transactional teaching communication; data minimisation |
| Attainment records | Teacher marks, code-judged answer outcomes, time-in-productive-difficulty | Azure PostgreSQL (UK South) | Duration of school contract + 90 days (unless the school instructs earlier deletion or return) | School documented instructions as set out within the data processing agreement in accordance with UK GDPR Art. 28 |
| Activity records | Interval records of when a student was active in the platform and on which surface: student identifier, school identifier, an optional session identifier, the surface (chat, work-completion, lesson-content, lesson-notes, homepage, or unknown), a start time and an end time each recorded to the minute, and the exact length of the period in seconds. No message content, no location and no device identifier. Where the session identifier is absent and the surface is unknown, the record attributes a period of time to a named student with no further context | Azure PostgreSQL (UK South) | Retained for a maximum of 12 months from the start time of the interval, purged by a scheduled job, and in any event deleted on contract end plus 90 days | School documented instructions as set out within the data processing agreement in accordance with UK GDPR Art. 28; the 12-month cap applies data minimisation to a record that is not otherwise anchored to the end of the contract |
| Safeguarding flags | Flagged message excerpts, category, severity, session reference, timestamp, status | Azure PostgreSQL (UK) | As instructed by the school and aligned with the school safeguarding retention policy (if applicable) | School documented instructions as set out within the data processing agreement in accordance with UK GDPR Art. 28; or (as applicable) For compliance with a legal obligation; safeguarding regulatory guidance (Keeping Children Safe in Education) |
| Authentication tokens | Session tokens, JWT identifiers stored in Redis | Azure Cache for Redis (UK South) | Session JWT expires after 7 days | Strictly necessary for security and session management |
| Application logs | App Service diagnostic logs (no PII in log body, see Logging Policy) | Azure Log Analytics workspaces (UK South) | 30 days (unless a security incident requires longer retention of relevant extract) | Security and operational monitoring; data minimisation |
| Email delivery records | Delivery status, message ID, recipient address for transactional emails sent via Azure Communication Services | Azure Communication Services (United Kingdom) | 30 days | Transactional delivery, support and security audit |
| Teacher and staff accounts | Name, email address, role, school, hashed password | MongoDB Atlas (Azure UK South) | Duration of school contract + 90 days (unless the school instructs earlier deletion or return) | School documented instructions as set out within the data processing agreement in accordance with UK GDPR Art. 28 |
| School administrator accounts | Name, email address, administrator role, school identifier | MongoDB Atlas (Azure UK South) | Duration of school contract + 90 days (unless the school instructs earlier deletion or return) | School documented instructions as set out within the data processing agreement in accordance with UK GDPR Art. 28; |
| Security incident records | Incident ID, severity, affected systems/accounts, timeline, containment and remediation actions, notification assessment, resolution and lessons learned. Avoid student chat content, special category data, passwords, tokens or secrets except where strictly necessary. | Restricted security incident log / compliance storage | 7 years from incident closure unless a shorter or longer period is required by law, regulator, insurer, school DPA or legal proceedings | Security incident management, UK GDPR accountability, regulatory evidence and legal claims |
| Administrative access records and access reviews | Admin Account Register, access grants/removals, role, system, start and end dates, monthly contractor access reviews, MFA/access control evidence and privileged-access audit information | Access management records / approved register | 3 years from access removal, or up to 6 years where needed for audit, legal claims, regulatory investigation or Cyber Essentials evidence | Security, Cyber Essentials, audit and UK GDPR accountability |
5. Post-Contract Deletion
Upon termination or expiry of the school’s contract with Halved, all personal data subject to the “Duration of school contract + 90 days” retention period, together with all personal data that any other row of the retention schedule states is in any event deleted on contract end plus 90 days, will be permanently deleted within 90 calendar days of the contract end date. Where a category also carries a shorter cap of its own, such as the 12-month cap on activity records or the 24-month cap on student-authored content, that cap applies during the contract and the contract-end deletion applies in addition to it. The 90-day window allows for:
Resolution of any outstanding data subject access requests or complaints;
Transition assistance to the school or its successor provider;
Final invoicing and contractual close-out.
Deletion will be performed by permanently removing the relevant records from MongoDB Atlas, Azure PostgreSQL, and Azure Blob Storage.
6. Safeguarding Data
Safeguarding flags are retained in accordance with the relevant UK school instructions provided to Halved as set out within the data processing agreement (‘DPA’) agreed between Halved and the school, or otherwise in accordance with the relevant UK school’s documented lawful instructions. The specific retention periods for safeguarding flags are as set out within the relevant DPA or are otherwise aligned to the relevant school’s safeguarding retention policy and/or documented instructions. In the event of any conflict between the retention periods set out within the DPA between Halved and the relevant school, the DPA shall prevail, unless and to the extent that Halved and the school agree otherwise.
Access to safeguarding records after contract termination will be restricted to the designated safeguarding leads of the contracting school and to Halved’s designated safeguarding officer.
7. Deletion Verification
Halved will maintain a deletion log recording the date, scope, and method of each deletion event. The deletion log itself does not contain personal data and records only the school identifier, the data categories deleted, and the timestamp. The log will be retained for 3 years.
Where a school or data subject requests confirmation of deletion, Halved will provide written confirmation within 30 days following the date of deletion.
8. Sub-processor Retention and Deletion
All sub-processors used by Halved are bound by the Microsoft Customer Agreement and Microsoft Data Protection Addendum, which include obligations to delete personal data in accordance with the controller’s documented instructions. MongoDB Atlas is bound by MongoDB’s Data Processing Agreement.
Halved will issue written deletion instructions to relevant sub-processors within 30 days of a contract end date. Sub-processors are required to confirm deletion within their own documented SLAs.
9. Backup Retention
Automated backups are retained as follows:
MongoDB Atlas: Point-in-time restore enabled with a 7-day restore window. Backups are stored within Azure UK South.
Azure PostgreSQL: Automated backups are retained for 7 days with geo-redundant storage within the UK.
Azure Blob Storage: No automatic backup; data durability provided by Azure LRS (locally redundant storage) within UK South.
No backup snapshot will be retained beyond the applicable retention period for the data category it contains.
10. Data Subject Rights and Early Deletion
For further information about the rights of data subjects, please see our Privacy Policy.
In respect of any requests received by Halved from a data subject to exercise their right to erasure (including when such request is received from a student, a parent and/or legal guardian) Halved will comply with all such requests and delete the specific personal data without undue delay and in any event within one month of receipt of the request. This period may be extended by up to two further months where the request is complex or numerous, in which case Halved will inform the data subject within one month of receipt and explain the reasons.
A student may delete their own uploaded content and free-text notes at any time using the in-product delete control, and deletion is actioned immediately. Students can also delete their own working annotation drawings on a lesson at any time before those annotations are submitted. Once annotation content is submitted to the teacher as part of a piece of work, it forms part of the assignment record and is retained for marking and review; it cannot be deleted by the student. Teacher feedback annotations are authored by staff and retained with the assignment record. Annotation content flagged by safeguarding screening is retained for staff review.
Requests for the erasure of any special category personal data retained by Halved or any of its sub-processors will be complied with without delay (and in any event, within one month of receipt of any request).
There may be circumstances where Halved has a legal obligation to retain information (excluding special category information) which will result in Halved having to refuse to comply with an erasure request. In such circumstances, Halved will inform the data subject without delay and shall set out the reasons for such refusal. The circumstances that may be relied upon for such refusal include (but are not limited to) compliance with applicable laws and/or regulations, or for establishing, exercising or defending legal claims.
11. Policy Review
This policy is reviewed annually (or upon a material change to the Halved platform’s data processing activities, applicable law, or regulatory guidance). The next scheduled annual review is May 2027.
12. Document Control
| Field | Detail |
|---|---|
| Owner | Halved Limited |
| Classification | Confidential, for data protection lead review |