Schools & Pupil Data

Last updated: 8 July 2026

This notice is for teachers, school leaders and data protection officers. It explains how Complete the Map handles pupil and class data, and sits alongside our main Privacy & Cookies Policy.

At a glance

Your school is the data controller; Complete the Map is your data processor.
We collect the minimum: a username, a display name (first name is fine), a class password and quiz scores.
We ask for no pupil email, surname, date of birth or contact details.
No advertising, no analytics, no tracking, no data selling.
Pupil data is stored in the EU (Ireland) and is only visible within the pupil’s class.
You can delete a pupil or a whole class at any time, or ask us to erase your school’s data.

1. Controller and processor roles

When your school uses Complete the Map to create classes and pupil logins, your school decides what data is entered and why. In data protection terms your school is the controller and Complete the Map is the processor, acting only on your documented instructions (i.e. through the features of the service). We do not use pupil data for our own purposes.

2. What we process for a class

Data	Set by	Purpose
Username	Teacher	Lets the pupil log in.
Display name (e.g. first name)	Teacher	Shown on the class leaderboard.
Class password	Teacher	Lets the pupil log in; retrievable by the teacher to hand out.
School & class name	Teacher	Organises pupils into classes.
Scores (countries found, attempts, time, region, date)	Generated by play	Class leaderboard and progress.
Session token	Generated at login	Keeps the pupil signed in on their device.

Please advise pupils to use a first name or nickname rather than their full name, and not to enter any other personal information. An inappropriate-name filter blocks offensive usernames.

3. Sub-processors

We use the following providers to run the service. Each processes data under contract and on our instructions:

Sub-processor	Role	Location
Supabase	Database & authentication (stores class and pupil data)	EU (Ireland)
Netlify	Website hosting & content delivery	Global CDN; company US-based
Resend	Teacher account emails (confirmation, password reset)	US-based

Transfers to providers outside the UK/EU are covered by an approved safeguard (such as UK/EU Standard Contractual Clauses or an adequacy decision).

4. Security

All traffic is encrypted in transit (HTTPS).
Pupil and class data is stored in a database in the EU (Ireland).
Row-level access rules ensure a teacher can only see their own school’s classes and pupils; pupil records are not readable by other pupils or by the public.
Teacher account passwords are hashed and not visible to anyone.
Class passwords are stored so a teacher can retrieve and distribute them; they should be treated as low-value shared passwords, not personal secret credentials.

5. Retention and deletion

We keep class and pupil data while your class is in use. As a teacher you can, at any time:

edit or remove an individual pupil;
rename or delete a whole class; and
request that we erase all of your school’s data.

To request full deletion or a copy of your school’s data, email privacy@completethemap.co.uk from your school account.

6. Handling pupil and parent requests

As the controller, your school handles requests from pupils and parents (access, correction, erasure). Most can be actioned directly in the teacher tools. If you need our help to fulfil a request, contact us and we will assist promptly.

7. Data Processing Agreement

If your school requires a signed Data Processing Agreement (DPA) or further information (such as records of processing, security details, or our data protection registration) before using Complete the Map, please email privacy@completethemap.co.uk and we will provide one.

8. Contact

Complete the Map is operated by Callum Cleary. For any question about pupil or school data, contact privacy@completethemap.co.uk. You may also raise concerns with the Information Commissioner’s Office at ico.org.uk.