For schools
DATA PROTECTION SUMMARY
A one-page summary to help your school complete its Data Protection Impact Assessment (DPIA) for WordGoal.
| Supplier | Roost Education Ltd (company no. 17456657), trading as WordGoal. |
|---|---|
| Purpose | Spelling practice for UK primary pupils, with progress reports for teachers and parents. |
| Roles | For school accounts the school is the data controller and Roost Education Ltd is the processor, acting on the school's instructions. |
| Likely lawful basis (school) | Public task (UK GDPR Art. 6(1)(e)) — supporting the curriculum. The school confirms its own basis. |
| Pupil data collected | First name (surname optional), generated Player Name, 4-digit PIN, year group, class membership, avatar choices, and spelling activity and progress. |
| Not collected from pupils | Email address, phone number, date of birth, home address, photos, voice recordings or free-text messages. |
| Special category data | None. |
| Staff data collected | Name, school email, role at school, school name and postcode, and sign-in details. |
| Sharing | Never sold. No advertising or profiling. Shared only with hosting and email providers needed to run the service. |
| Pupil safety features | No chat, no messaging between pupils, no public profiles, no adverts, microphone input switched off. |
| Access control | Teachers only see pupils in their own school. Separation between schools is enforced in the database itself. |
| Security | Encrypted connections (HTTPS). PINs stored as one-way hashes. Hosted on managed cloud infrastructure that is patched by the provider. No PHP or WordPress. |
| Retention | Learning data kept while the school account is active, then deleted or anonymised. Sign-in attempt records about 24 hours; security records up to 180 days. |
| Rights requests | Access, correction and deletion requests are supported via our privacy request form. School requests are handled on the school's instruction. |
Overall risk view
Because pupils share very little personal information, there is no communication between users and there is no advertising, we consider the risk to pupils low. Your school should still record its own assessment and decision.
Full details are in our privacy policy. Questions: roosteducationltd@gmail.com.