GDPR Compliance Statement
Effective Date: January 15, 2026
Last Updated: January 15, 2026
EduCore ("we," "our," or "us") is dedicated to upholding data protection and privacy standards in accordance with the European Union General Data Protection Regulation (GDPR) (EU 2016/679) and UK GDPR requirements.
This document outlines our compliance framework, roles, and data subject rights for institutional clients processing data of EU/UK residents.
1. Compliance Architecture & Roles
1.1 Data Controller vs. Data Processor
- Subscribing Institution (Data Controller): The educational institution determines the legal basis for processing student, parent, and staff personal data.
- [Company Name] (Data Processor): We process personal data solely on documented instructions from the Controller institution to provide school ERP capabilities.
2. Legal Basis for Processing
Data processed within the Platform relies on the following lawful bases established by Subscriber institutions:
- Performance of a Contract: Fulfilling educational enrollment contracts and parent-school agreements.
- Public Interest / Official Authority: Providing mandatory public education services and attendance reporting required by educational authorities.
- Legal Obligation: Maintaining official academic, examination, tax, and payroll records required by applicable laws.
3. Data Subject Rights & Fulfillment
We provide educational institutions with built-in platform features to fulfill data subject requests under GDPR.
| Data Subject Right | Platform Capability & Process |
|---|---|
| Right of Access (Article 15) | School administrators can generate complete exports of student profiles, attendance history, academic marks, and parent transaction logs. |
| Right to Rectification (Article 16) | Authorized staff can edit or update inaccurate student, parent, or employee records directly within administrative portals. |
| Right to Erasure / "To Be Forgotten" (Article 17) | School administrators can initiate student record deletion or anonymization upon student graduation or transfer, subject to statutory record retention laws. |
| Right to Data Portability (Article 20) | Data can be exported in structured, machine-readable formats (CSV, JSON, XML). |
| Right to Restriction of Processing (Article 18) | School administrators can archive or lock user credentials and student profiles to restrict data processing while retaining historical data. |
4. International Data Transfers
When personal data originating in the European Economic Area (EEA) or UK is transferred to infrastructure located outside the EEA, we implement appropriate safeguards:
- Execution of Standard Contractual Clauses (SCCs) approved by the European Commission.
- Encryption of data at rest (AES-256) and in transit (TLS 1.3) prior to transmission across cloud regions.
5. Data Protection Impact & Subprocessors
We maintain an updated register of third-party subprocessors providing cloud hosting, database backups, transactional email delivery, and SMS notifications. All subprocessors undergo rigorous security reviews and execute GDPR-compliant Data Processing Addendums (DPAs).
6. Data Breach Notification Protocol
In the event of a confirmed personal data breach affecting Subscriber data:
1. We will notify the affected Subscriber institution's primary contact within 48 hours of confirmation.
2. The notification will include details regarding the nature of the incident, affected data categories, estimated impact, and remediation actions taken.
7. Contact Information & DPO
For GDPR inquiries or to request a Data Processing Addendum (DPA), please contact:
- Company Name: [Company Name]
- Data Protection Officer Email: [Contact Email]
- Legal Office Address: [Company Address]