Data Protection for Schools & Organisations

Draft for review · Last updated 23 August 2026. This document describes how Aurelia World is designed to work. It is a working draft and should be reviewed by qualified legal counsel before public launch.

Clear data roles

A school or organisation may be the controller/business for education records it directs GSM to process for the contracted service, with GSM acting as processor/service provider. GSM may separately act as controller for account security, fraud prevention, child safeguarding, platform integrity, billing and its own legal obligations. The exact split is documented in the applicable institutional agreement and Data Processing Addendum.

Student and child data is not advertising inventory

Institution-provided child data is not sold, used for behavioural advertising or used to build unrelated commercial profiles. School-authorised data is limited to the agreed educational/service purpose and the safety/security processing necessary to operate the platform lawfully.

Private drafts remain private

Sponsoring a child account does not give an institution a general right to browse the child's private drafts. Teachers and administrators receive only the access the product role and relevant sharing/verification workflow permits.

US school deployments

Where applicable, institutional agreements can include FERPA and COPPA provisions. GSM does not place its own COPPA obligations onto a school. Where a school is legally able to authorise education-only processing on a parent's behalf, that authorisation is limited to the school context and does not permit unrelated commercial reuse of student data.

UK and EEA deployments

Institutional arrangements can include processor terms and cross-border transfer provisions required by UK GDPR or EU GDPR. Country-specific age, consent, representative and transfer requirements are assessed separately rather than assuming a single global threshold applies everywhere.

Security architecture

• verified role-based access and invitation-gated child onboarding;
• database-level row security and server-side privileged operations;
• private-by-default child projects;
• guardian permission and moderation workflows;
• audit records for sensitive actions;
• no open child directory or unrestricted adult-to-child messaging; and
• media uploads disabled until a protected scanning/quarantine pathway is operational.

Subprocessors and international transfers

GSM uses service providers only for defined operational purposes and expects appropriate confidentiality, security and data-protection obligations. Before broad institutional contracting, the production Subprocessor list, locations, transfer mechanisms and notification procedure will form part of the approved institutional data-protection pack.

Data rights, deletion and incidents

GSM's institutional DPA provides for reasonable assistance with verified data-subject requests, deletion/return at the end of service subject to lawful retention, and security- incident notification without undue delay where GSM acts as processor and an incident affects customer personal data.

Request the institutional pack

Schools, education groups and approved organisations can request the current security, privacy and DPA materials through our contact page. The signed customer agreement controls over this public summary.