Data processing terms
These terms apply when the operator of Lex360 ("we") processes personal data on behalf of a school, college, tutor or other organisation ("you") that uses Lex360. They sit alongside the terms of service.
Roles
You are the controller of the personal data of your teachers and students; we are your processor. We process it only to provide Lex360 and on your documented instructions (what you and your teachers do in the product, and these terms).
What is processed
People: your staff and students. Data: names, email addresses (optional for students), ID numbers, roles, teaching records, homework answers and scores, placement and exam results, attendance registers, certificates, reports and messages. Duration: while your account is active and until deletion as described below.
Our promises
- Staff who can reach the data are bound by confidentiality.
- Each organisation's data is isolated from every other's inside the database; passwords are hashed; sign-in codes work once; stored third-party keys are encrypted; connections are encrypted.
- We tell you without undue delay, and within 72 hours of becoming aware, of a personal-data breach that affects you, with what we know and what we are doing.
- We help you answer requests from people exercising their rights (access, correction, export, deletion) and with data-protection assessments. Students can export their own data and ask for deletion from their page; you decide.
- When your account ends we return or delete the data on request; otherwise it is deleted within 90 days of closure, except where law requires us to keep something.
- We let you check we keep to these terms by answering reasonable written questions and providing relevant information.
Sub-processors
You authorise the following. We will tell you before adding or replacing one so you can object.
| Provider | What for | Where |
|---|---|---|
| Fly.io | Application hosting and the database | Frankfurt, Germany (EU) |
| Stripe | Payments and subscriptions (paying accounts only) | EU / USA, under Stripe's own terms |
| Email delivery provider (to be named) | Sign-in codes, receipts and account notices | As stated by the provider |
| Anthropic (only if you add your key) | AI-drafted feedback on writing | USA |
| Google Cloud (only if you add your key) | Natural-voice audio | As stated by Google |
Transfers outside the EU/EEA
Where a sub-processor is outside the EU/EEA, transfers rely on the safeguards the law provides, such as standard contractual clauses. Optional services (AI feedback, natural voices) send only the text of the item used, and only when your own teachers use them.
Contact
the contact address on this site