Data processing terms
For schools, NGOs and organisations enrolling learners. When you do that, you are the controller of your learners’ data and we process it on your instruction.
Who is responsible for what
You are the controller. You decide who is enrolled, why, and on what basis. You are responsible for confirming your learners are 18 or over, which is the same requirement we apply to everyone else.
We are the processor. We process what you instruct us to, for the purpose of running the courses you assign, and nothing else.
What we process on your behalf
- The usernames you issue and the PINs your learners set
- A display name, where a learner provides one
- Progress: topics completed, quiz attempts and scores
- Final projects submitted, and the assessments of them
- Certificates issued
We do not ask your learners for an email address, so we do not hold one unless a learner later adds one to keep their certificates after your programme ends.
What we will not do
- Use your learners’ data for our own purposes, including training models
- Send marketing to your learners
- Share their data with anyone other than the sub-processors below
Sub-processors
We use a small number of suppliers to run the platform: a database and file storage host, an email delivery provider, a video delivery provider, and an application host. Each processes data only on our instruction.
The current list, with the region each operates in, is on the security page. We will tell you before adding one, and you can object.
Security
Data is encrypted in transit and at rest. Project submissions sit in private storage that is not publicly reachable; access is granted through short-lived signed links. Access within Splari is limited to the people who need it to run the service.
Sub-processor incidents
If we become aware of a breach affecting your learners’ data, we will tell you without undue delay and give you what you need to meet your own notification obligations.
Your learners’ rights
Requests come to you as the controller. Tell us and we will act on your instruction — access, correction, export or deletion. Deletion removes learner records and stops certificate verification pages resolving.
What happens when you leave
You can export your cohort data at any time, and for thirty days afterwards. After that we delete it. We keep anonymised completion counts, which contain nothing identifying, because instructor payments are calculated from them.
Signing this
We sign a data processing agreement with every institution before the first cohort starts. This page is the substance of it; the signed document is what governs. Ask us for a copy before you commit to anything.
Questions about any of this? Get in touch.