1. Name of the third party involved in the processing activity
CS Ninja, a homework and practice service for Computer Science and IT. CS Ninja acts as a data processor on the school's instructions.
Data protection
Data Protection and DPIA Information
Last updated 14 September 2026
This page is intended to help schools assess their use of CS Ninja as part of their own data protection processes. It is written for data protection officers, IT managers and procurement teams. Your school remains the data controller and should carry out its own assessment.
Who uses CS Ninja
School administrators, teachers and students at schools with a CS Ninja licence. Accounts only exist within a school; there are no public or individual accounts.
Information processed
- Account details: name, school email address and role.
- School and class information: school name, classes and class membership.
- Learning records: homework set, answers given, scores, progress, points and badges.
- Licence and billing details for the school, visible only to school administrators.
Purpose of processing
To let teachers set and review Computer Science and IT homework, to mark students’ answers and to show progress to teachers and students. Data is not sold or used for advertising.
Security and data protection measures
- Data is hosted in the UK (London region).
- Student personal details are encrypted, apart from the email address needed for sign-in.
- Access is restricted by role, so students only see their own work and teachers see their own school.
- AI marking (Ninja AI plan) sends only the question, mark scheme and the student’s answer — no personal data. If a student types personal data into an answer, that text will be sent.
Retention
Learning records are deleted when the school asks or when the school’s account is closed. Schools that remain inactive for a long period are deleted, with warning emails sent beforehand.
Hosting, access, security and support
- Hosting. The service and its database are hosted in the United Kingdom (London region) with our cloud hosting provider. Pupil and school data does not leave the UK, other than the limited AI marking transfer described above on the Ninja AI plan.
- Administrative access. Access to the live systems and database is restricted to the small number of CS Ninja staff who need it to run and support the service. Pupil personal details (other than the email address needed for sign-in) are encrypted in the database, so even CS Ninja staff cannot read them. Within the service, access is role-based: students see only their own work, teachers see only their own school, and school administrators manage only their own school.
- Security testing. The service is protected by row-level access controls in the database, encrypted connections, and sign-in through school Microsoft accounts or school-issued credentials. We run automated security scanning on the application and its database configuration, and we fix the issues it finds. If your DPO needs more detail, contact us at the address below.
- Maintenance and support. CS Ninja is actively maintained: we monitor the service for errors and failures, apply updates and security fixes, and take regular backups as part of the hosted platform. Support is provided by email, and teachers can also use the built-in help assistant in the app.
- Third-party services. We use a small number of processors: our hosting and database provider (stores the service data), our email provider (delivers service and billing emails), our payment provider (handles school subscriptions — card details never reach us), Microsoft (where a school chooses Microsoft sign-in), and an AI marking provider on the Ninja AI plan only, which receives just the question, mark scheme and the student’s typed answer. Every provider is bound by a written processing agreement.
Sub-processor agreements
The services listed below process personal data on our behalf, and each is bound by a written processing agreement. That agreement is the provider’s own published terms and data processing agreement, which your DPO can download or read from the provider’s legal pages:
- Hosting, database and email (Lovable Cloud, UK region). Our hosting provider runs the service, stores the database and delivers service and billing emails. Its data processing agreement and terms of service apply.
- Payments (Stripe). Card payments for school subscriptions are handled by Stripe; card details never reach CS Ninja. Stripe’s data processing agreement and service terms apply.
- Microsoft sign-in (optional). Where a school enables sign-in with school Microsoft accounts, Microsoft’s product terms and data protection terms for the Microsoft Entra authentication service apply. No pupil data is shared with Microsoft beyond the sign-in itself. Microsoft sign-in uses CS Ninja’s own Microsoft Entra app registration; the sign-in handshake passes briefly through our hosting provider’s secure sign-in gateway at
oauth.lovable.app. If your school filters web traffic, allow bothcsninja.co.ukandoauth.lovable.app(as well as Microsoft’s own sign-in addresses) so Microsoft sign-in is not blocked. - AI marking (Ninja AI plan only). Exam-style marking runs through our AI gateway, so it is covered by the hosting provider’s agreement above, together with the underlying model provider’s terms. Only the question, mark scheme and the pupil’s typed answer are sent — no personal data.
If your DPO needs confirmation of the providers in place at the time of your assessment, contact us at the address below and we will confirm the current list in writing.
Supporting documents
Read our privacy policy and our terms of service, which include the data processing agreement schools accept at sign-up. You can also learn more about CS Ninja or compare school pricing. The DPIA screening guide below walks through the questions most school forms ask.
DPIA screening guide
Most schools and trusts complete a Data Protection Impact Assessment (DPIA) before introducing a new system that processes pupil information. Many use a two-part form: Part A is a short screening assessment, and Part B is only needed if the screening shows the processing is likely to be high risk.
This guide sets out the usual screening questions with the information you need about CS Ninja, so you can complete your own form quickly. Your school remains the data controller and is responsible for the answers it gives, so please check each one against your own use of the service and share the completed form with your data protection officer.
If your DPO needs anything that is not covered here — a data processing agreement, our security details or a copy of our privacy notice — email privacy@csninja.co.uk and we will send it.
Part A — screening assessment
The details below relate to CS Ninja. Fill in your own school name, start date and whether the assessment is retrospective.
2. Describe the processing activity
What data is processed, why and how? What is the objective and intended outcome?
CS Ninja sets, marks and tracks Computer Science and IT homework. Teachers choose topics; the system generates questions, marks pupil answers automatically and reports progress.
Staff details processed: name, school email address, role and school. Pupil details processed: name, school email address, class membership and, where the school uploads a roster, a roster entry before the pupil first signs in. Learning records: homework and practice attempts, answers, marks, feedback, experience points, streaks and badges.
Data reaches CS Ninja either by staff adding pupils, uploading a roster file, or pupils signing in with their school Microsoft account. There is no direct link to the school MIS.
The objective is to reduce marking workload, give pupils immediate feedback and repeated practice, and give teachers reliable data on where classes are struggling.
3. Why is this the least intrusive method of achieving the purpose?
CS Ninja only needs the minimum needed to run homework: a pupil's name, school email address and class. No date of birth, UPN, address, attendance, SEN, ethnicity or other demographic data is required or requested.
Pupil details other than the email address used to sign in are held encrypted, so CS Ninja staff cannot read them. Schools can only see their own staff and pupils.
The alternative — marking homework by hand or through general-purpose spreadsheets and email — would involve more manual handling of pupil work and no access controls.
4. What personal data will be shared? Is a data sharing or processing agreement required?
Pupil: name, school email address, class membership, homework and practice answers, marks and progress.
Staff: name, school email address, role.
School: plan, billing frequency, licence status and payment references held by the payment provider.
Yes — a data processing agreement is required, because CS Ninja processes personal data on the school's behalf. CS Ninja's terms and conditions contain a standard data processing agreement. When registering, the school's administrator will need to agree to this. If you need a bespoke DPA, please request this from privacy@csninja.co.uk.
5. Does the processing involve special category data?
For example health, ethnicity, religion, biometrics or data revealing racial origin.
No. CS Ninja does not ask for or store SEN status, ethnicity, health data, free school meal or pupil premium eligibility, or any other special category data.
Schools should avoid entering such information in free-text fields, for example in a class name.
5a. Does the processing involve criminal offence data?
No.
6. Lawful basis
Schools normally process pupil data for CS Ninja under UK GDPR Article 6(1)(e) public task, as part of providing education, or Article 6(1)(f) legitimate interests where a school prefers that basis. Consent is not normally required.
For staff accounts and school billing, CS Ninja relies on the contract with the school and on its legitimate interests in running the service.
No special category condition is needed, because no special category data is processed.
7. Will the processing involve automated decision-making or profiling?
No decision with a legal or similarly significant effect is made automatically. Multiple-choice and short answers are marked automatically, and on the Ninja AI plan exam-style answers are given AI-generated marks and feedback.
These are formative marks to support teaching. Teachers see every result and can override it, and no grade, set placement or report is produced automatically.
8. Will the processing involve systematic monitoring of individuals?
No. CS Ninja records homework and practice activity only. There is no CCTV, location tracking, screen monitoring or monitoring of general online behaviour.
9. Will the processing involve large-scale processing? How many data subjects?
Schools typically enrol whole Computer Science and IT cohorts. Record the number of pupils and staff you intend to enrol (commonly 100–1000 in a single secondary school).
10. Will data be transferred outside the UK or EEA?
Pupil and school data is stored in the United Kingdom (London region).
On the Ninja AI plan, exam-style answers are sent to an AI marking provider for feedback, which may process them outside the UK under appropriate safeguards such as the UK International Data Transfer Addendum. Only the exam question, its mark scheme and the pupil's typed answer are sent; no name, email address, school, class or pupil identifier is included, so the request is not linked to an identifiable pupil. If a pupil types personal data into the answer itself, that text is sent as part of the answer. Answers are not used to train the provider's models. Schools that prefer no such transfer can use the Ninja Core or Ninja Plus plan, which do not use AI marking.
11. Does the processing involve innovative technology or novel use of data?
Only on the Ninja AI plan, which uses a large language model to mark exam-style answers against a mark scheme and give written feedback. Marking is always visible to, and can be changed by, the teacher.
The request to the model contains only the question, the mark scheme and the pupil's answer text — no personal data is attached. The only way personal data reaches the model is if a pupil types it into their answer, so remind pupils to keep personal details out of their answers.
Ninja Core and Ninja Plus use fixed question banks and rule-based marking with no AI.
12. Any other factors or risks for the DPO to consider?
Pupil details other than sign-in email addresses are encrypted at rest so that CS Ninja staff cannot read them.
Access is restricted to the pupil's own school; staff only see their own school's pupils and classes.
Sign-in is by school Microsoft account or by a username and password set by the school.
School accounts that are dormant for a long period are marked for deletion and then erased, with warning emails beforehand.
Annex — mitigations to record
These are the points a DPO usually wants evidenced alongside the screening form.
International transfers
Core service data is hosted in the UK. If you use AI marking, record the transfer and the safeguards relied on, and reference the data processing agreement.
You can record that the AI marking transfer contains only the question, mark scheme and the pupil's typed answer, with no identifying data attached, unless a pupil types personal data into their answer.
Special category data
Not applicable — CS Ninja does not process special category data.
Data minimisation and retention
Only enrol the pupils who need the service, and remove leavers at the end of the year. Learning records are deleted when the school asks or when the school's account is closed.
Security and access
Encrypted pupil details, school-scoped access, role-based permissions for staff, and sign-in through the school's Microsoft accounts where used.
Rights and transparency
Add CS Ninja to your pupil and staff privacy notices as a processor. Requests for access, correction or deletion come to the school, and CS Ninja will help you meet them.
Do you need Part B?
When a full DPIA is usually needed
Most schools find the CS Ninja screening does not show high risk, because no special category data is involved and there is no automated decision-making with significant effects.
If you use the Ninja AI plan, your DPO may ask you to complete Part B to record the AI marking and the related international transfer. We can supply the detail you need for those sections.
Ask us for anything missing at privacy@csninja.co.uk.