Helping students
find their future

GDPR FAQs

Unifrog takes its data protection responsibilities seriously. In relation to the Unifrog Website, both we and our partner institutions are treated as data controllers under the GDPR (now incorporated into UK law and known as "the UK GDPR". When we refer to the GDPR in these FAQs, we mean the UK GDPR).

Everything is covered in our Service terms and Privacy Policy, but we’ve set out answers to the most common queries we receive from partner institutions relating to data protection below.

a. Where is our contract with Unifrog?

Our Service terms govern our relationship with partner schools and colleges.

These Service terms also refer to:

• our Privacy Policy, which sets out how we process personal information; and
• our Website terms, which sets out the rules that apply when using the Unifrog Website.

b. Don't we need a signed Data Processing Agreement (DPA) to give personal data to you?

No. As detailed in section 15.2 of our Service terms, both Unifrog and the partner institution are acting as data controllers in respect of the relevant personal data, meaning that a Data Processing Agreement is not appropriate. (Please see Why is Unifrog treated as a controller and not a processor? below).

c. Why is Unifrog treated as a controller and not a processor?

We (Unifrog) act as a controller in relation to student, teacher and other staff data which we process (or use) in connection with the Unifrog Website because we determine how and why we process that data, rather than simply processing it as directed by our partner institutions. This is in line with the definition of controller in the GDPR.

For example, we decide what personal data to collect, the purpose and lawful basis for collecting and using that data, and how long to keep it. We make these decisions independently, without taking instructions from our partner institutions. This is necessary so that we can operate the Unifrog Website effectively. Being a controller also means we have a higher level of compliance responsibility under the GDPR.

d. Are Unifrog and the partner institution “joint controllers”?

No. Not all controllers are “joint controllers” (within the meaning of the GDPR), even if they work with other controllers to determine how and why certain data should be processed. Joint controllers work together to “jointly decide the purpose and manner of processing”. Other types of controllers independently decide the purpose and manner of processing, even when sharing data, and often use the data for different purposes. This is an important distinction since the GDPR only requires agreements between joint controllers (and between controllers and processors).

Unifrog and the institution are acting as independent controllers rather than joint controllers. In brief, this is because Unifrog determines what data it collects from students and teachers on its own, rather than in collaboration with any particular institution. Unifrog has also independently designed the Unifrog Website, and the processing involved as part of its operation.

e. We're a partner institution located in the European Economic Area (EEA) or a third country with the benefit of a UK adequacy regulation. Do you have a copy of our signed Data Sharing Agreement (DSA)?

Section 15 of our Service terms sets out the data sharing agreement that we have in place with our partner institutions in the EEA and other countries where the UK government is satisfied that there is an adequate level of data protection without the need for implementing additional safeguards (known in the UK as an adequacy regulation). Each institution agrees to these Terms of Service digitally during our onboarding process.

f. Aren’t we required by the GDPR to have a signed Data Sharing Agreement (DSA)?

No. In fact, there is no requirement under the GDPR to put in place any data sharing agreement in these circumstances (please see Are Unifrog and the partner institution “joint controllers” above). However, we cover data sharing in our Service terms in order to protect the data that we, and the partner institution, process. Since we ask each institution to agree to our Service terms as part of our onboarding process, there is no need for a separate signed copy. We can however send you a PDF of our Service terms for your records.

g. We're a partner institution in a country outside the EEA without the benefit of an UK adequacy regulation. Do we need to sign a DSA?

Yes. The GDPR prohibits the transfer of personal data to such countries unless appropriate safeguards are implemented to bring the level of protection to that required under UK law. With that in mind, the DSA incorporates Standard Contractual Clauses (SCCs). The DSA also includes a data transfer impact assessment, which is required where SCCs are used, to legitimise restricted cross-border transfers.

You will agree to the DSA at the same time as you agree to our other terms, during the onboarding process at the beginning of your school’s Unifrog subscription.

h. We're a partner institution located in the European Economic Area (EEA). Do we need to enter into Standard Contractual Clauses (SCCs) or adopt other safeguards for our transfers of personal data to Unifrog?

No. The European Commission has adopted an adequacy decision for the UK under the GDPR. This means transfers of personal data from the EEA to the UK can continue without the need for further safeguards, such as SCCs. Data transfers from the UK to the EEA can also continue to flow freely, since the UK recognises EEA member states as providing an adequate level of protection of personal data.

i. What personal data is processed by, and shared between, Unifrog and the partner institution?

Clause 15.2 of our Service terms sets out the types of data that we and our partner institutions process and share with each other in relation to the Unifrog platform, and the categories of data subjects.

Our Privacy Policy, including the sections headed “INFORMATION WE COLLECT (INCLUDING WHEN AND HOW WE COLLECT IT)” and “SHARING / ENABLING OTHERS TO PROCESS YOUR INFORMATION”, provides full details of our processing.

j. When processing special category data, what GDPR conditions do Unifrog and the partner institution rely on?

Clause 15.8 of our Service terms states that Unifrog and the partner institution rely on either the substantial public interest condition or the statistical purposes condition, when processing data concerning health, ethnicity, "SEN" and "looked after" status. The substantial public interest is the equality of opportunity or treatment. We have put appropriate safeguards in place to protect special category data.

k. What security measures does Unifrog have in place to protect personal data?

We make sure we comply with the GDPR’s “security principle” when we process personal data. We use security measures that (a) ensure the confidentiality, integrity and availability of our systems, and the data we process within them; and (b) enable us to restore access to data quickly in the event of any incidents. Further details about our security measures can be found here.

l. Do we need to alter our own privacy policy to explicitly name Unifrog as a third party with which we share data?

Yes. And this is the case whether you choose to upload students and teachers onto the Unifrog platform, or choose to have students sign up to the platform using a unique code.

m. Do students give their consent for Unifrog to process their data?

No. Because of the type of data we collect, the purposes for which we collect it and the processing we carry out in operating the Unifrog website, we are not required to obtain consent from students to collect, store and use their data. Instead, we rely on other lawful bases under the GDPR for processing, including pursuing our (or the institution’s) legitimate interests and the need to process it to perform our contract with the institution.

However, we do ask students to acknowledge that they have read and understood our Privacy Policy, which sets out all of our processing activities.

n. Do students have to give consent for our teachers and staff to see their Personal statements, CVs, Activities etc.?

No, for the same reasons set out above; please see “Do students give their consent for Unifrog to process their data?”.

Our Privacy Policy describes in detail all types of student personal data (including personal statements, CVs, activities, etc.) which will be shared with, and accessed by, teachers and others.

o. Do we have to delete students’ or teachers’ data obtained in connection with the Unifrog Website when they leave our school/college?

The general principle under the GDPR is that you and we should only keep this personal data for as long we each need it.

In respect of the student and teacher data that you hold and process, there is no specified retention period, and no express requirement to delete data after the individual has left the institution. However, you will need to comply with your own data retention policy, and the general principle above. Please also see “What do we do if a student or teacher asks us to delete their data in connection with the Unifrog Website?”.

In respect of the student and teacher data that we hold and process, we keep this for as long as the individual continues to use the Unifrog Website. We will automatically delete any account after 4 years of inactivity. We keep users’ information and their accounts live for this 4-year period so that they can continue to access useful information, such as personal statements and CVs after they have left the relevant institution. Please see the section headed “RETAINING YOUR INFORMATION” in our Privacy Policy for more information.

p. If we delete students’ or teachers’ accounts from the Unifrog Website (for example, after they have left the school), does Unifrog retain a copy of their data within those accounts?

When a teacher account is deleted, it is instantly removed from the live database.

When a student account is deleted, there is at 180-day holding period in case it was deleted in error. After 180 days, the data is deleted from the live database.

In each case, after account deletion, both student and teacher data remains in our monthly database backups for a further 365 days. These database backups are not easily accessed, and are only retained for disaster-recovery purposes.

q. What do we do if a student or teacher asks us to delete their data in connection with the Unifrog Website?

Typically student and teacher data is deleted by the relevant school or college rather than by us, however - depending on the circumstances - we may need to delete the relevant data. We will generally notify you if a request is made to us. Before deleting a user's data we will normally ask the user to prove their identity.

r. What happens if a student asks Unifrog to access his or her personal information (known as a ‘subject access request’)?

We will acknowledge receipt of the request and, if necessary, request proof of ID (e.g. a copy of their passport). After obtaining proof of ID, we will normally disclose to the student all personal information that relates to him- or herself (including everything that teachers have written or uploaded about that student on the Unifrog Website, but not references). For more information, please see “If a Student makes a subject access request to Unifrog, will he or she be given access to all relevant predicted grades, and interactions, etc. recorded by teachers and other staff on the Unifrog Website?” below.

We will normally try to notify the partner institution if we receive a subject access request from one of its students, but we cannot do so in all cases.

s. If a Student makes a subject access request to Unifrog, will he or she be given access to all relevant predicted grades, and interactions, etc. recorded by teachers and other staff on the Unifrog Website?

Broadly speaking, yes. This will be the case whether teachers record this information in Microsoft Word or Excel, SIMS or on paper before they upload it, and even if a partner institution has chosen not to permit students to access their predicted grades on the website.

As explained above (see What happens if a student asks Unifrog to access his or her personal information (known as a ‘subject access request’)?), we will normally disclose all data relating to the student in question, with the exception of references given by teachers and others. This includes everything (other than references) that teachers have written or uploaded about them on the Unifrog Website (including predicted grades, interactions and any other comments or opinions). As such, teachers should not write or submit anything that they would not want a student to see.

It is our policy not to disclose references about students given by their teachers or others. 

t. What happens if a parent requests access to their child's data?

We will acknowledge to the parent receipt of the request, and we will refer the parent to the child's school or college. The school or college should then review the request, taking into account its own obligations under data protection law, as well as any safeguarding issues. Under the UK GDPR and the GDPR where a child is competent to exercise their rights over their personal data, such as the right to access their data, a parent has no right to access it.

u. Should students be granted access to the “teacher-only” side of the Unifrog Website to access data that relates to them, if requested?

No. The “teacher-only” sections of the Unifrog Website include personal information relating to other students and teachers, some of which may be sensitive. As such, we do not permit students to access these sections in any circumstances.

Instead, we deal with requests from student to access their personal data on a case-by-case basis. Please see What happens if a student asks Unifrog to access his or her personal information (known as a ‘subject access request’)?.

v. We would like to keep in touch with students after they leave our school. Do we need consent to do this, and can Unifrog help?

Yes, you do, and yes, we can! When students complete their registration and log in to the Unifrog Website for the first time, they will be presented with an optional tick-box requesting consent to allow us to share certain basic contact details with their school/college so that it can keep in touch with them after they have left. We clearly identify the types of information that Unifrog will share with the school/college for these purposes, so that the student can give informed consent.

This is explained in further detail in the section “SHARING / ENABLING OTHERS TO PROCESS YOUR INFORMATION” in our Privacy Policy.

Please remember, if you decide to send emails to students after they have left your school/college, you need to ensure there is an ‘unsubscribe’ option in each email you send, in order to comply with the rules on direct marketing. Also, you should tell us if any students change their mind about being contacted for alumni purposes (i.e. if they “opt-out”).

w. Will Unifrog share information with us about our students’ further education or employment after they have left our school? Does Unifrog need consent to do this?

We may give our partner institutions details about where their students go to university or where they start work, so that the institutions can see how their students progress after they have left.

There is no requirement to obtain consent for this. Instead, we rely on the lawful basis of “legitimate interests”. Specifically, we share this information to enable the institution to pursue its legitimate interests in analysing how its students progress after they have left the institution. This is set out in the section headed “HOW WE USE YOUR INFORMATION AND OUR LEGAL BASIS FOR DOING SO” in our Privacy Policy

x. We note that Unifrog uses certain service providers to operate the Unifrog Website and shares personal data with them. Which companies are these?

We describe our service providers by category (e.g. survey providers) as we may change them from time to time. We select these providers carefully and we only share personal data with them to the extent necessary to operate the Unifrog Website. We also give very specific instructions to them about how they must handle this data, and ensure that they take security measures to protect it in line with our policies. For example, we use:

• survey providers, e.g. SurveyMonkey;
• newsletter sending services, e.g. Campaign Monitor; and
• servers, e.g. Amazon Web Servers.

y. Do we need to get consent from our teachers and other staff to give their data to Unifrog to create their accounts?

No. As with students’ personal data, since we are only collecting and processing certain types of personal data relating to teachers, we are not required to obtain their consent.

We rely on other lawful bases under the GDPR for processing, including pursuing our (or the partner institution’s) legitimate interests, and the need to process this data to perform our contract with the partner institution.

z. What about parent accounts?

On Unifrog, as well as accounts for students and teachers, there are parent accounts. Here's how parent accounts are created:

• First: A parent has to have their email address added by the school/college to their child’s Unifrog profile, in the dedicated fields for these;
• Then: a parent can create their account either by using SSO on the normal Sign in page, or by using their email address on this page.

The school/college must:

• Only add the details of parents who have parental responsibility for students;
• Remove the link between a student's account and their parent's account on Unifrog after receiving notice that the relevant parent has ceased to have parental responsibility for the student;
• Remove the link between a student's account and their parent's account on Unifrog if that student asks the school/college to do so; and
• Not add to Unifrog or otherwise share with Unifrog any personal data about a student which creates a safeguarding risk or is otherwise capable of causing mental or physical harm to any student.

aa. On what basis can schools/colleges add parent email addresses to Unifrog?

The school/college can rely on legitimate interests to add parent email addresses to Unifrog; they do not need to get parents' consent beforehand. This is because the school/college and Unifrog have a legitimate interest in inviting parents to create their own Unifrog accounts, so that parents can view more information about their child's activities and opportunities on Unifrog, helping parents to support their children in relation to their decisions about careers, apprenticeships and higher education, improving outcomes for children. Parents can ask for their email addresses to be removed at any time, which is explained in our privacy policy. Unifrog has conducted a legitimate interest assessment as required by the GDPR; read it here.

ab. How should we send the teacher and student data to Unifrog?

Send teacher and student data to us in a password protected format with the password sent via a separate channel of communication. For example if you email us a password protected file, give us the password over the phone.

ac. I want to know more about users’ rights regarding their data!

No problem! You’ll find everything you need in our Privacy Policy.