Data Processing Summary

For learner personal data entered into the platform, your school or organisation is the data controller and Adaptify is the data processor. Adaptify processes that data only on your documented instructions — namely, to provide the service of adapting and generating learning resources.

• Educators and staff who hold accounts
• Pupils for whom resources are created

• Educator account data: name and email address
• Learner profile data: the identifier you choose (we recommend a pseudonym), accessibility preferences, and optional SEND tags
• Any personal data contained within documents you upload for processing

We do not require — and ask you not to provide — medical diagnoses, assessment scores, or other special category data. We recommend using pseudonyms and recording accessibility needs only, so that no directly identifying student data is shared with the platform.

Adaptify processes personal data solely to provide the service: extracting content from your documents, adapting and generating learner-tailored resources, making them available in your account, and providing support. We do not use your content or learner data to train AI models, and we do not sell personal data.

Adaptify uses a small set of trusted sub-processors to deliver the service, each engaged under a data processing agreement. A full list of our sub-processors — including what each processes, where, and the applicable transfer safeguards — is available to schools and organisations on request at support@adaptifyeducation.com.

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• UK-hosted infrastructure on Google Cloud Platform
• Role-based access controls limiting access to authorised personnel
• Audit logging for accountability
• Sub-processors engaged under data processing agreements with appropriate safeguards

Your account data, documents, and generated resources are hosted in the United Kingdom. Certain AI processing involves sub-processors located outside the UK; those transfers are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or an equivalent approved mechanism). Details of the sub-processors involved are available on request.

As the controller, you remain responsible for responding to data subject requests. Adaptify will assist you in meeting requests to access, rectify, or erase personal data, including through the self-service deletion available in the dashboard and on request to our support team.

We retain personal data for as long as your account is active, and delete it on request as described in our Data Retention Statement. On termination, you can export your resources and request deletion of your account and associated data, which we process within 30 days.

In the event of a personal data breach affecting your data, we will notify you without undue delay and provide the information you need to meet your own notification obligations.

A full Data Processing Agreement is available for schools and organisations that require one. Contact support@adaptifyeducation.com and we will provide it for signature.