How DNEP uses personal information
Last updated 17 October 2026. This notice explains what personal information the DNEP website and apps use, why, and your rights.
1. Who we are
DNEP Education ("DNEP", "we") is the trading name of DNEP Ltd, a company registered in England and Wales (company number 17525679), registered office 1146 High Road, London, England, N20 0RA. Its directors are Despina Nicolaou and Erich Pohl. We make the DNEP Lesson Planner, Topic Assessment Tracker, Cover Work Builder and Exam Builder for schools, for every subject they teach, at dnep.co.uk.
Contact us about privacy using the contact form. Postal address: 1146 High Road, London, N20 0RA.
2. Two different roles
When a school uses DNEP, the school decides what information about its staff, pupils and parents goes into DNEP and why. The school is the controller and DNEP is its processor: we only use that information to run DNEP for the school, under a written agreement with the school. Pupils and parents should contact their school first; we will help the school answer.
For our own website (the front page, the demo and the contact form), DNEP is the controller.
3. What we use, and why
| Who | What | Why, and the lawful basis |
|---|---|---|
| School staff | Name, school email, staff code, role, the classes they teach, what they enter in the apps (plans, notes, marks, tests, papers they upload) | To run DNEP for the school (the school's public task or legitimate interests; DNEP acts on the school's instructions) |
| Pupils | Name, class, marks for each question, answers to online tests, school email (only if the school uses online tests), extra time as a percentage (no reason is stored) | To track progress and give feedback, on the school's behalf (the school's public task) |
| Pupils, optional | Groups the school chooses to add, such as SEND or Pupil Premium. Stored encrypted and shown only on a staff page, never to pupils or parents | Analysis of progress by group, on the school's behalf. Some groups are special category data: the school's condition is substantial public interest (equality of opportunity), as set out in the agreement with the school |
| Parents and carers | Only a scrambled, one-way form (hash) of the email address the school adds; we do not store the address itself. A sign-in email is sent when the parent asks for one | So a parent can see their own child's progress page (the school's public task) |
| Anyone who signs in | A sign-in cookie and the time of signing in. Google or Microsoft tells us your name and email address; we never see your password | Security and keeping you signed in (legitimate interests) |
| Contact form | Your name, email, school (optional) and message | To reply to you (legitimate interests) |
| Website visitors | Your IP address reaches our host and the font service for each page; we keep a count of contact messages per IP address for one hour to stop abuse | To deliver and protect the website (legitimate interests) |
We do not sell personal information, we do not use it for advertising, and we do not use pupils' information to train artificial intelligence.
4. Who else handles it (sub-processors)
| Company | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting the website, apps, database and files | The database and files are stored in the European Union. Pages are delivered, and short-lived sign-in sessions kept, through Cloudflare's network worldwide |
| Google (Google Sign-In) | Signing in with a school Google account | Google's data centres |
| Microsoft (Entra ID) | Signing in with a school Microsoft account (coming soon) | Microsoft's data centres |
| Anthropic | Only if a school uses it: reading an uploaded paper, and "Claude mode" in the Exam Builder. Papers and question wording are sent; pupils' information is not | United States |
| Web3Forms | Delivering contact-form messages to us by email | Web3Forms' servers (outside the UK; see below) |
| Google Fonts | The website's fonts (your browser asks Google for them) | Google's data centres |
Where information leaves the UK, it is protected by the UK's adequacy regulations or by the International Data Transfer Addendum to the EU Standard Contractual Clauses in each company's data processing terms.
5. Cookies and storage in your browser
DNEP uses only cookies that are needed for the site to work, so we do not ask for consent for them. There are no analytics or advertising cookies.
- dnep_s: keeps staff signed in (12 hours).
- dnep_pupil: keeps a pupil signed in for an online test (6 hours).
- dnep_parent: keeps a parent signed in (90 days, or until they sign out).
- dnep_oauth: used for 10 minutes while you sign in with Google or Microsoft.
The website also remembers in your browser that you have seen the "Coming soon" message (until you close the tab). The demo keeps your changes in your own browser only; nothing in the demo reaches us.
6. How long we keep it
- School information: while the school uses DNEP, then deleted within 90 days of the school leaving, unless the school asks for a copy first.
- Contact messages: 2 years after our last reply.
- Sign-in links: 15 minutes. Sessions: as listed above.
- Backups: up to 30 days.
7. Keeping it safe
Everything is sent over encrypted connections. Pupil groups are encrypted in the database, parents' email addresses are stored only as a scrambled hash, file links expire after five minutes, and each school can only ever see its own information. Only the two of us can reach the systems.
8. Your rights
You can ask to see the personal information held about you, have it corrected or deleted, restrict or object to its use, or receive a copy to take elsewhere. If your school uses DNEP, ask the school: it decides about its own records, and we will help it. For our website and contact form, ask us. We reply within one month.
If you are unhappy, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
9. Children
Pupils only use DNEP through their school, with an account the school gives them. We do not show pupils advertising, and pupils and parents never see the staff-only group page.
10. Changes
If we change this notice we will update the date at the top, and tell schools about important changes before they apply.