ACEL-Pro Privacy Notice

1. Who we are

ACEL-Pro is provided by ALTA Education Limited.

For data protection queries relating to ACEL-Pro, please contact: support@alta-education.com

2. What ACEL-Pro is

ACEL-Pro is a pupil-level evidence platform designed to support schools, trusts, school groups and local authorities in building a clearer picture of mathematical learning over time.

It helps schools gather structured evidence of pupil progress, support teacher judgement, and provide leaders with clearer information about learning, gaps and attainment.

ACEL-Pro is designed around data minimisation. We aim to process only the personal data needed to provide the service.

3. Who is responsible for the data?

When a school, local authority, multi-academy trust, governing body or other customer organisation uses ACEL-Pro, the relevant organisation will usually act as the Data Controller. The identity of the Data Controller depends on the customer’s legal and organisational structure.

This means they decide what personal data is entered into ACEL-Pro and how it is used within their organisation.

ALTA Education Limited will usually act as the Data Processor.

This means we process personal data only to provide ACEL-Pro and only in line with the instructions of the Data Controller.

The Data Controller is responsible for identifying the lawful basis for processing personal data. ALTA Education processes the data as processor, under the instructions of the Data Controller.

4. Personal data ACEL-Pro may process

Pupil data

ACEL-Pro may process the following pupil data:

• first name and last name, or a pseudonymised identifier if preferred by the school
• username or other login identifier
• password, stored in hashed form and not retained in retrievable plain text
• school
• year group
• class
• intervention group membership
• responses to mathematical tasks and related task-session records
• timestamps and limited activity records relevant to learning evidence
• system-generated curriculum-linked evidence indicators and summaries
• teacher professional judgements or notes recorded in relation to learning evidence
• first language, only where a school chooses to use native-language scaffolding for a pupil

When an authorised member of staff prepares or resets pupil login details, ACEL-Pro may generate a new pupil password and display it temporarily so that it can be distributed securely. Only the password hash is retained by ACEL-Pro. The previous pupil password cannot be retrieved.

First language is used only to provide access to pre-prepared translated ALTA content where this feature is enabled by the school.

Pupil input is not sent to any external AI or translation provider.

Staff data

ACEL-Pro may process the following staff data:

• name
• username or other login identifier
• email address
• password, stored in hashed form and not retained in retrievable plain text
• two-factor authentication credentials where the role requires them, comprising an authenticator secret and backup codes, both stored in encrypted form
• remembered-device records where a user chooses to trust a browser, comprising a hashed token, a short device description such as Chrome on Windows, and related timestamps
• display language preference
• organisational association, including school, local authority, trust or school group
• user role, for example teacher, school leader, or local authority, trust or group user
• limited account, sign-in and activity records relevant to use and security of the platform

5. Data ACEL-Pro does not routinely collect

ACEL-Pro is not designed to collect or require:

• pupil date of birth
• home addresses
• parent or carer contact details
• demographic or socioeconomic categories such as FSM or ASN
• special category personal data as part of its standard operation

ACEL-Pro is not designed to collect, store or process special category personal data such as health information, ethnicity, biometric data or religious belief.

6. Why personal data is used

ACEL-Pro processes personal data only for the purpose of providing and maintaining the service.

This includes:

• providing curriculum-aligned mathematical practice
• building a longitudinal evidence base of pupil learning
• supporting teacher judgement with structured evidence over time
• giving school, local authority, trust and group users appropriate insight into progress and attainment
• supporting moderation and attainment discussions
• providing optional native-language scaffolding where enabled by the school
• maintaining and supporting the secure operation of the platform
• providing technical and account support

We do not sell personal data.

We do not use pupil data for advertising.

ACEL-Pro does not make decisions about pupils that have legal or similarly significant effects. System-generated indicators are intended to support teacher and leader judgement, not replace it.

7. Who can access data in ACEL-Pro?

Access is controlled by user role and organisational boundary.

Pupils

Pupils can access practice activities and, where enabled, their own learning history.

Teachers

Teachers can access information relating only to pupils and groups assigned to them.

School leaders

School leaders can access school-level information and, where appropriate, pupil-level information within their own school.

Local authority, trust and group users

These users can access aggregated data for their organisation and, where permitted by role, school-level information relevant to their responsibilities.

ALTA Education support access

ALTA Education may access account information where necessary for technical support, maintenance or fault resolution.

This access is restricted and subject to role and system controls.

8. Hosting and data location

The ACEL-Pro platform, including its core application, database and backups, is hosted using IONOS Cloud Ltd.

IONOS has confirmed in writing that, for the relevant hosting setup:

• website files, databases and backups are hosted within its European infrastructure
• for UK-based services of this type, this is typically located in Germany
• it has no indication that customer personal data for this hosting service is being stored, accessed or processed outside the UK/EEA

Because the service is provided on shared hosting infrastructure, more granular contract-specific location details may not always be available.

Based on the current written confirmation from IONOS, ACEL-Pro’s core hosting environment should be understood as being hosted within European infrastructure, with Germany identified by IONOS as the typical location for this setup.

IONOS automatically creates daily backups of the hosted webspace and MySQL/MariaDB databases. These automatic recovery points are available for a maximum of 14 days. They are used for service continuity, security and disaster recovery rather than routine active processing.

ACEL-Pro’s transactional email is sent through Scaleway Transactional Email. Scaleway states that its Transactional Email service is hosted and processed entirely within the European Union.

On the basis of the current provider information available to ALTA Education, ACEL-Pro’s current core hosting, database, backups and transactional email subprocessors are located within the UK/EEA or EU. ALTA Education does not currently use a transactional email provider that requires routine transfer of ACEL-Pro customer personal data outside the UK/EEA or EU.

9. Third-party providers

ACEL-Pro uses a limited number of third-party providers where needed to operate the service.

Current subprocessors are:

IONOS Cloud Ltd

Used for application hosting, database hosting and backups.

Scaleway Transactional Email

Used for transactional emails such as password setup, password reset, security codes and service notifications.

Scaleway Transactional Email is used through Laravel’s standard SMTP mail transport. Transactional email data may include the recipient email address, message content needed to deliver the email, delivery metadata and related technical logs.

Scaleway states that, for its Transactional Email service, personal data is hosted and processed entirely within the European Union and that the Transactional Email technical stack is fully managed by Scaleway within the EU.

Scaleway’s public documentation identifies the Transactional Email service region as Paris (fr-par).

ALTA Education does not share personal data with third parties except where necessary to provide the service through approved subprocessors.

10. Security

ACEL-Pro uses technical and organisational measures to help protect personal data.

These include:

• encryption of data in transit using TLS/HTTPS
• password storage in hashed form
• role-based access controls
• technical controls to limit administrative support access
• restricted access to production systems
• limited telemetry to support system health, security and troubleshooting
• no advertising cookies within the platform
• staff password creation and reset rules aligned to modern security practice, including minimum length requirements and checks against known compromised passwords
• controlled pupil credential preparation and reset, with only password hashes retained after distribution
• multi-factor authentication required for organisation-level administrator accounts (local authority, trust or school group) and ALTA platform administrator accounts with access to customer personal data
• where a user chooses to remember a browser, that choice skips only the additional authentication step and never the password, lasts for a limited period, and is cancelled automatically whenever the account password changes

Further technical detail can be provided where needed as part of DPIA or IT/security review.

11. Cookies

The ACEL-Pro website does not use analytics or advertising cookies.

The ACEL-Pro platform may use essential cookies or similar technologies where needed for secure login and basic service operation.

These are used only to provide the service and keep user sessions secure.

12. Retention and deletion

Personal data is retained only for as long as needed to provide ACEL-Pro and support the customer’s use of the service.

During the contract period, pupil learning data is retained to support longitudinal tracking of progress over time.

At the end of a contract or agreed access period, customer access to ACEL-Pro ends unless renewal or continuation has been agreed. The Data Controller may request return/export of relevant personal data or instruct ALTA Education to delete it. Where technically possible, an export may be provided in a commonly used format such as CSV.

Unless the Data Controller instructs earlier deletion or a separate agreement requires a different timescale, ALTA Education’s standard offboarding process retains customer personal data in the live ACEL-Pro systems for a maximum of 90 days after the contract or agreed access period ends. This recovery period exists only to allow an authorised customer to request data export or recovery. The data is then deleted from the live ACEL-Pro systems.

IONOS automatic backups operate on a rolling daily cycle and are available for a maximum of 14 days. This means that, after data has been deleted from the live ACEL-Pro systems, an earlier copy may remain temporarily within the normal IONOS backup rotation for up to 14 further days before expiry. Backup data is not used for routine active processing and would only be restored where needed for service continuity, security or disaster recovery.

13. Data subject rights

Individuals have rights under data protection law.

These may include the right to:

• access personal data
• correct inaccurate personal data
• request deletion of personal data
• restrict how personal data is used
• object to certain types of processing

Requests about pupil or staff data should usually be made first to the Data Controller.

ALTA Education will support the Data Controller where reasonably required to help respond to these requests.

14. Personal data breaches

If ALTA Education becomes aware of a Personal Data Breach, or a security incident which we reasonably suspect involves unauthorised access to, disclosure, alteration, loss or destruction of personal data processed on behalf of a Data Controller, we will investigate the incident promptly and take reasonable steps to contain and mitigate its effects.

We will notify the relevant Data Controller without undue delay and, where practicable, within 24 hours of becoming aware.

We will provide the information reasonably available to us that the Data Controller requires to assess the incident and meet its reporting obligations. Where relevant information is not immediately available, we may provide it in stages as the investigation develops.

15. Website enquiries

If someone contacts ALTA Education or ACEL-Pro through a website form or by email, we may process their name, email address, organisation and message so that we can respond.

We will use this information only to deal with the enquiry and any related follow-up.

16. DPIA and information governance support

Data Controllers completing a DPIA or information governance review for ACEL-Pro can request additional technical or data protection information from support@alta-education.com.

17. Complaints

Questions about ACEL-Pro and data protection can be sent to: support@alta-education.com

Individuals also have the right to complain to the Information Commissioner’s Office if they are concerned about how personal data is being used.

The Information Commissioner’s Office can be contacted through its website: ico.org.uk