The short version
When your school uses Class League with pupils, your school is the data controller for that pupil data and Class League is the data processor. That means your school decides what pupil data goes in, and I handle it securely and only to run the service for you. This page sets out what I commit to as your processor.
Who the parties are
Controller: your school (the organisation that decides to use Class League with its pupils).
Processor: David Riley, operating Class League, also the creator of Triptico.
What the processing covers
- Subject matter: running a classroom fantasy-football game.
- Duration: for as long as the school uses the service. Data is removed when a league is deleted or the account is closed.
- Nature and purpose: storing and displaying class lists, team picks, points and league tables so a class can play.
- Types of personal data: a pupil name or nickname entered by the teacher, plus in-game data (team name, picks, points). No emails, passwords, dates of birth or contact details are collected from pupils.
- Categories of data subject: pupils in the class, and the teacher running it.
What I commit to as your processor
- Act on your instructions. I process the pupil data only to provide Class League, not for my own purposes, and never to advertise or to profile pupils.
- Keep it confidential and secure. Data is held in Google Firebase with access controls, and pupil names are kept private to the teacher who owns the league. Pupils and outsiders see team names only.
- Minimise the data. Pupils never create accounts. The only personal data about a pupil is the name the teacher types, and I encourage first names, initials or nicknames.
- Store it in the EU. The database is hosted in Google Cloud's European region (Belgium and the Netherlands).
- Help with rights requests. If a pupil, parent or your school asks to see, correct or delete data, I will help you respond. Teachers can already edit names and delete a league or account at any time.
- Tell you about any breach. If there is a personal-data breach affecting your pupils, I will let you know without undue delay so you can meet your own obligations. Because pupils have no accounts, emails or passwords in Class League, the only pupil data that could be involved is the names you enter.
- Return or delete data. When you stop using the service, deleting your league or account removes the pupil data. I can confirm deletion on request.
- Be open about sub-processors. See below. I will give you reasonable notice before adding a new one.
Sub-processors
I use a small number of trusted providers to run the service:
- Google Firebase (Google Ireland / Google LLC) for sign-in, the database and hosting. The database is in the EU.
- Google Fonts and Google Analytics (cookieless, on teacher pages only, not the pupil pages).
- Web3Forms relays enquiry emails sent through the homepage forms. This only ever involves adult enquiry details, never pupil data.
These are the only third parties. There are no ad networks, embedded widgets or social trackers.
International transfers
Pupil and league data is stored in the EU. Where a provider processes data outside the UK or EU, it does so under the safeguards required by UK and EU data protection law (such as Google's standard contractual clauses).
How long this lasts
This agreement applies for as long as your school uses Class League. It ends when you close your account, at which point the pupil data is deleted.
Related pages
This agreement sits alongside the privacy page (what is collected and why) and the terms of use. Together they describe how Class League handles data.
Contact
Class League is built and operated by David Riley. To ask a question, request a countersigned copy of this agreement, or raise a data request, reach me through the Contact form on the homepage.
Updates
I'll list any changes to this agreement here, with a date. The current version is the first publication, dated 1 June 2026.