Language Boosters – Data Protection for Schools
Everything your school and Data Protection Officer need to complete a DPIA for Language Boosters, in one place.
At a glance
| Provider | Primary Languages Network Group Ltd (company no. 12118977, ICO registration ZB458259) |
|---|---|
| Cost | Free add-on with Primary Languages Network membership |
| PLN's role | Data processor for pupil and staff data. The school is the data controller. |
| Pupil data held | Username, optional forename and surname (or a pseudonym), class, progress and scores, encrypted password |
| Real names needed? | No. We recommend randomly generated usernames. |
| Special category data | None |
| Hosting | My Learning UK Ltd, on servers in Germany |
| Transfers outside the UK | Germany only, covered by UK adequacy regulations |
| Security | HTTPS encryption, encrypted passwords, 24-hour server monitoring, firewall and web application firewall, IP blocking, threat detection |
| Cookies | Two first-party cookies: PHPSESSID (session, 1 hour) and vleGUID (device identifier, 360 days). Used only to make the app work. |
| Advertising or tracking | None |
| Contact with pupils | PLN never contacts pupils directly |
| Retention | Data deleted immediately when an account is deleted or membership ends |
| Breach notification | We tell the school without undue delay |
Documents
Common questions
Is PLN a data controller or processor?
For pupil and staff data in Language Boosters, PLN is a processor acting on the school's instructions, and the school is the controller. PLN is a controller only for the contact details of the staff who manage the school's membership.
Who are your sub-processors?
My Learning UK Ltd (ICO registration Z2729729) hosts and runs the platform. It processes pupil usernames, optional names, encrypted passwords, progress data and staff account details. We have a data processing agreement in place with them.
Where is the data held?
On servers in Germany. The UK recognises Germany as providing adequate protection under its adequacy regulations, so no additional transfer safeguards are needed. Data is not processed in any other country.
What happens when an account is deleted or membership ends?
The data is permanently deleted straight away. Deleted data is removed from backups as they are overwritten, and it is not used in the meantime. Schools should export any progress records they want to keep before their membership ends.
What cookies are used?
| Cookie | Purpose | What it contains | Expiry |
|---|---|---|---|
| PHPSESSID | Keeps the session open and lets a lost session resume | A random session code; no personal information | 1 hour |
| vleGUID | Recognises the device and its type (mobile, tablet or desktop) so the app displays correctly | A unique device identifier; no name, email or other personal details | 360 days |
Both cookies are used only to make the app work. There is no advertising, marketing, profiling or third-party tracking.
Do we have to use pupils' real names?
No. We recommend randomly generated usernames and a shared class password, or a pseudonym such as "Pupil 1".
How do pupils log in at home?
Schools can share a QR code. The school is responsible for sharing it securely, in line with its safeguarding policy.
What if there is a data breach?
We will tell the school without undue delay after becoming aware of it, so the school can meet its own reporting duties.
Still have a question?
If your DPO needs anything else for your DPIA, contact Sylvia Brown, Customer and Operations Manager, at sylvia@primarylanguages.network or on +44 (0)161 428 8063.