PhysicsUK Data Protection & Security Information
Controller contact
Controller: PhysicsUK (trading as PhysicsUK).
Privacy contact: contact@tafrensystems.com.
We review whether a formal data protection officer is required as our processing changes. The privacy contact handles requests and incident reports.
Roles in school-managed use
The school normally determines the purposes and means of its pupil and staff learning records and is therefore normally the controller. PhysicsUK normally processes those records only on the school's documented instructions. PhysicsUK may be an independent controller for its own account security, abuse prevention, legal compliance, billing and service-administration records. The exact allocation must be confirmed in the school agreement.
Categories and suppliers
Processing can include account details; school, class and role information; learning activity; answers; marks; feedback; uploaded material; support and safeguarding reports; billing data; and security/service logs. Providers used according to the enabled features can include:
- MongoDB Atlas — managed database and storage.
- Heroku — application hosting and runtime.
- Mailgun — transactional email delivery.
- Stripe — payment and subscription processing.
- Pusher — authenticated real-time classroom and presence functions.
- hCaptcha — contact-form abuse prevention when that form is used.
- OpenRouter and selected model providers — only for enabled automated learning, marking, image, recognition, generation or safety features.
Supplier, sub-processor, transfer and model choices must be reviewed before a new feature or supplier processes school data. A supplier list is not a substitute for that review.
Security, retention and incidents
- PhysicsUK uses access controls, HTTPS/TLS in transit, managed storage security controls and restricted administrative access. Security measures should be reviewed against the risks of the specific school deployment.
- Guest-session records expire after 7 days; login, page-visit and activity records expire after 14 days. Other school data follows the written school retention, deletion and return instructions.
- We maintain an incident process to assess, contain, investigate and document suspected personal-data incidents. Where PhysicsUK acts as processor, it must notify the school without undue delay under the applicable agreement so the school can meet its own obligations.
- Restricted transfers outside the UK require an appropriate transfer mechanism and the required data-protection test. See the public Privacy Notice for more detail.
Automated tools and children
Automated features can process user-submitted prompts, answers, images, handwriting, uploaded exam material and limited account/school context. Outputs are educational support, not official results, and can be wrong. Provider retention and training practices differ by provider and endpoint. School users should not submit unnecessary personal or sensitive information. PhysicsUK is likely to be accessed by under-18s, so high-privacy defaults, data minimisation, an age-appropriate design assessment and a DPIA review are required for relevant deployments and material feature changes.
Public notices and user requests
The public Terms of Service & Privacy Notice and Cookie Notice explain user-facing processing. For school-managed records, requests should normally be sent to the school as controller. For PhysicsUK's own processing, requests can be sent to contact@tafrensystems.com.