KEZ is operated by KEZ Services Ltd. Registered office: Lower Ground Floor, 63 Fairholt Road, London, N16 5EW, UK. Company number 11853498.
We can be contacted at school@kezhub.com
Schools use KEZ to store and process information about their pupils, families and staff. For this data the school is the data controller and KEZ is a data processor: we process the data only on the school's instructions, in line with our contract with each school. This data can include special category data, such as special educational needs, safeguarding, medical and religious information, which we protect with appropriate security measures.
If your information is held in the app by a school (for example you are a parent, pupil or staff member of the school), the school decides how and why it is used. Please direct any questions or requests about this data to the school; we will assist the school in responding.
KEZ is the data controller for a smaller amount of data we hold for our own purposes: app user accounts, sign-in and security logs, billing contacts, support correspondence, optional usage telemetry, and visits to our public web pages.
KEZ users use the app to store information about their school which includes personal data such as staff and pupil data. KEZ staff are able to access records for support, security, quality control, audit, and other purposes to ensure our services work correctly and are not misused. All web requests and data modifications are logged for security and quality purposes.
KEZ uses infrastructure provided by Google Cloud Platform (GCP) to host the app. GCP may also log web requests and access data in other ways. These logs may include personal data, such as data being stored in the app. If you provide a phone number for SMS authentication this may be stored by Google and used for spam and fraud prevention across all Google services. Also see https://cloud.google.com/privacy and https://cloud.google.com/terms/data-processing-terms which is relevant to our use of GCP as a subprocessor. GCP's own subprocessors are listed at https://cloud.google.com/terms/subprocessors
Sign-in uses Google Identity Platform. If your organisation signs in with Microsoft or Google accounts, your sign-in is also processed by that provider (for Microsoft see https://privacy.microsoft.com/privacystatement). Some sign-in steps, such as sending an SMS verification code, are protected by Google reCAPTCHA, which collects device and usage signals to distinguish real users from automated abuse. Also see https://policies.google.com/privacy and https://policies.google.com/terms
Additionally, if Golem AI assistant or test scanning (which uses the GCP Vertex API for reading handwritten scores) is enabled for your school and you use it, data is shared with the model provider (Google through the GCP Vertex API). Google does not use this data for training but it may be briefly logged for abuse prevention and caching. The models run in the 'global' region, meaning data may be sent to Google datacentres in multiple locations around the world, including outside the UK and EEA. All messages are also logged in our database and visible to KEZ staff, and may be used for support, quality control and abuse prevention purposes.
We use Rsync.net for backup purposes. All data is encrypted before transfer to Rsync.net and no personal data is shared with Rsync.net. Also see https://www.rsync.net/resources/regulatory/privacy.html
We use Sentry for error tracking and for tracing use of the app for quality and analytics purposes (telemetry). We avoid sending personal data such as your IP address to Sentry and do not share any data stored in the app. However, in the event of a crash the crash report sent to Sentry may accidentally include the data users were working with. Sentry uses automated tools to attempt to scrub personal data from reports submitted to it. Also see https://sentry.io/privacy/ and the Data Processing Addendum https://sentry.io/legal/dpa/
Emails we send (for example messages and invoices sent to parents by schools) are delivered by Postmark, whose servers are in the USA. Email addresses, names and message content are shared with Postmark in order to deliver them. Also see https://postmarkapp.com/privacy-policy
Text messages are delivered by Alfonica, a UK telecoms provider, and the carrier networks it uses. Phone numbers and message content are shared with them in order to deliver messages. Also see https://alfonica.com
Automated voice calls and voicemail (where enabled) use Twilio, whose servers are in the USA. Phone numbers, call recordings and voicemails are processed by Twilio. Also see https://www.twilio.com/en-us/legal/privacy
Online card payments (where enabled, for example school fees or camp fees, and payment of KEZ invoices) are processed by Stripe. Your card details are sent directly to Stripe and are not stored by KEZ. Also see https://stripe.com/privacy
Pages where you enter an address use Google address lookup (Google Maps Platform). As you type an address, your search text and IP address are sent to Google. Also see https://policies.google.com/privacy
Transport route maps load map images from OpenStreetMap, which will receive your IP address. Also see https://osmfoundation.org/wiki/Privacy_Policy
If live dashboard updates are enabled, messages may be delivered to you by being passed, encrypted, through GCP's Firebase Messaging service and through servers operated by your browser or operating system vendor; and may be displayed by your browser as notifications.
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Hosting, database, file storage, sign-in, AI features | London, UK (some services global) |
| Rsync.net | Encrypted backups | Zurich, Switzerland |
| Sentry (Functional Software, Inc.) | Error tracking and telemetry | USA |
| Postmark (ActiveCampaign, LLC) | Email delivery | USA |
| Alfonica | SMS delivery | UK |
| Twilio | Voice calls and voicemail | USA |
| Stripe | Card payments | USA and EU |
We may also store cookies or other data on your device for authentication purposes, recording of preferences, and delivering messages. We do not use cookies for tracking purposes.
You may opt out of browser telemetry by unchecking the option 'Automatically track usage and report technical issues to KEZ (recommended)'. This may take up to ten minutes to take effect. Other data we use and record is required for security purposes or for us to deliver services, and so cannot be opted out of.
Most of the personal information we process is provided to us directly by you as part of setting up the app and recording data. Other data is shared with our servers by your browser, such as your IP address and operating system. We use the information that you have given us in order to deliver our service, detect errors and fraud, backup data, and monitor performance. We may share this information with our contractors and our infrastructure providers mentioned above.
Where we process data on behalf of your school, the school is responsible for the lawful basis for that processing. Where KEZ is the data controller, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 the lawful bases we rely on are:
You may object to processing based on legitimate interests, and can opt out of browser telemetry as described above.
Most data is stored in the UK. Backups are stored in Switzerland, which the UK has determined provides adequate data protection. Some of the providers above process data in the USA or globally; for these transfers we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the ICO's International Data Transfer Agreement or Addendum.
Your information is stored in secure data centres operated by GCP in London, and in encrypted backups at Rsync.net's facility in Zurich. Data stored by Sentry is located in their data centre in Iowa, USA.
Data stored in the app by users is managed by users and not subject to automatic deletion. Logs are automatically deleted after 30 days (90 days for some GCP and Sentry logs). An exception is database audit logs of data changes which need to be stored longer to ensure the integrity of data and to comply with regulations around recording changes to the admissions register. These are deleted after 6 years.
When a school's contract with us ends, we return the school's data to the school if requested and then delete it, in line with our contract.
For information held about you by your school in the app (for example if you are a parent, pupil or staff member), please contact the school, which is the data controller for that information; we will help the school respond to your request.
For data where KEZ is the controller, under data protection law you have rights including:
Please contact us at the contact details above if you wish to make a request.
If you have any concerns about our use of your personal information, you can make a complaint to us at the contact details above.
You can also complain to the ICO if you are unhappy with how we have used your data.
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk