---
title: DPIA Support Pack
description: Everything your DPO needs to complete a DPIA for Top Marks.
---
[Skip to content](https://help.topmarks.ai/knowledge/dpia-support-pack#main-content)
.png?width=660&height=92&name=help-centre-banner-J-2x%20(2).png)
Open main navigation
Close main navigation
- [Get in touch](https://help.topmarks.ai/knowledge/getting-support)
[Get in touch](https://help.topmarks.ai/knowledge/getting-support?hsLang=en-gb)
How can we help you?
- There are no suggestions because the search field is empty.
1. [Top Marks AI Help Centre](https://help.topmarks.ai/knowledge?hsLang=en-gb)
2. [Accounts, Data & Security](https://help.topmarks.ai/knowledge/accounts-data-security?hsLang=en-gb)
# DPIA Support Pack
**About this pack**
This pack is provided to help schools and multi-academy trusts complete their own Data Protection Impact Assessment (DPIA) for their use of the Top Marks platform. It describes how Top Marks AI Ltd ("Top Marks") processes personal data as the school's processor, following the structure of the ICO's DPIA template. It is not a substitute for the school's own assessment, which remains the school's responsibility as controller.
The contractual commitments referred to in this pack are in Schedule 1 (Data Processing Agreement) to the Platform Terms and Conditions (topmarks.ai/terms), the Service Level Agreement (topmarks.ai/sla) and the sub-processor list (topmarks.ai/subprocessors). Where this pack and Schedule 1 differ, Schedule 1 prevails. This pack is reviewed at least annually. Questions may be sent to Top Marks' data protection lead (COO) at info@topmarks.ai.
---
**Nature of the processing activities**
### How will the data be collected?
Data will be collected through the following methods:
1. **Student data via Wonde integration:** Top Marks connects to the school's Management Information System (MIS) through Wonde's API. This occurs at the school's instruction, given by an authorised administrator when the integration is configured, and can be repeated at the school's discretion. The school specifies which categories of student and staff data are retrieved. Schools can disable the Wonde integration at any time, and retain control over MIS integration throughout the relationship. No data is retrieved from the school's MIS other than on the school's instruction.
2. **Student data via manual upload:** Schools can alternatively upload student information as CSV files or input student details individually through our platform interface.
3. **Assessment materials uploaded by teachers:** Essay and exam content is collected through our secure platform when teachers upload:
- Scanned handwritten scripts in PDF format (which we transcribe using our own software; see the next section)
- Word documents containing individual essays
- Plain text essays via copy/paste functionality
4. **Staff registration data:** Teacher and administrator information is collected through:
- Our account creation/sign-up process for school administrators
- Email invitation system where administrators invite additional teachers, who then complete their own registration
- Manual account setup by our team (with admin setting their own password)
All data collection occurs through our secure web-based platform with appropriate user authentication.
### How will the data be used and processed to achieve aim?
The shared personal data will be used and processed as follows to provide automated essay marking and feedback services:
**Data Processing Workflow:**
1. **Upload:** Teachers upload scanned handwritten scripts, word-processed documents or plain text through the platform. Each piece of work is linked to the student record by an anonymising identifier (for handwritten work, a QR code or barcode on the script).
2. **Transcription on Top Marks' own infrastructure:** Handwritten scripts are transcribed by an optical character recognition (OCR) model that Top Marks operates on its own Google Cloud Platform account, on a server in London, United Kingdom. In the standard flow the OCR sees anonymised, QR-coded scripts, which may only occasionally include a name a student has written within their answer. Where a school uses the Exam Decoder service, which matches unlabelled handwritten scripts to student records, the OCR reads the script including any handwritten student name, and the matching is performed by Top Marks' orchestration service hosted on AWS in Ireland. In either case, no third party receives the raw script.
3. **Identity separation and identifier removal:** Student identity is held separately from assessment content on Top Marks' servers, and the mapping between the anonymising identifier and the student is never shared with any external provider. Any names or other personal identifiers that the OCR transcribes from the script are detected and removed from the transcribed text before it goes any further.
4. **AI marking:** Anonymised essay content is sent, through an AI gateway (Portkey), to third-party large language model providers (OpenAI, Anthropic, Google, Amazon Bedrock and Together AI) for marking and feedback generation. Multiple models are used with load balancing and failover. All providers are engaged on paid business terms under which content is not used to train their models.
5. **Quality control:** Model outputs are cross-checked by other models for consistency and accuracy, and anonymised content may be checked for AI-generated text (GPTZero).
6. **Grade Standardisation:** Numeric grades are processed through proprietary in-house algorithms on our servers to align with standardisation materials and correct for known LLM marking variations.
7. **Class Feedback Generation:** Concatenated (anonymised) class essays and feedback are processed through LLMs to generate whole-class insights and recommendations.
**Access Controls:**
- Teachers can only access marking results for essays they have uploaded, unless they have admin privileges, or essays have been manually shared with them by another user
- Account-based access with optional SSO and MFA authentication
- Internal company access: the CEO, COO, and Chief Developer have database access (via MFA) strictly for troubleshooting purposes only
- Customer success staff access is limited to troubleshooting purposes, via a customer success interface.
- No routine access to student data by company personnel outside of troubleshooting scenarios
### Will any student, teacher, assessment or uploaded content be used to train AI models?
No. Under clause 5.2 of the Platform Terms and Conditions, Top Marks may analyse platform usage data and outputs, in anonymised or aggregated form, to maintain, secure and improve the platform for its customers as a whole, but it will not use school data, including student data, to train or fine-tune any AI model without the school's explicit prior written permission. Annex A to Schedule 1 (paragraph 3.2) confirms that Top Marks does not process personal data for the training, fine-tuning or improvement of AI models or the platform without such permission.
In addition, essay content is anonymised before it reaches any third-party model provider, the mapping between anonymous identifiers and students is never shared with those providers, and all providers are engaged on business terms that exclude the use of content for training their models.
### Is AI marking advisory only, with teachers retaining final judgement?
Yes. No score or feedback is passed to students by the platform. Teachers review, and can edit or moderate, AI-generated grades and feedback before anything is exported or shared with students. Clause 3.3 of the Platform Terms and Conditions requires the school to ensure that output is reviewed by a suitably qualified member of teaching staff before any grade or feedback is released to a student or used for any summative or reporting purpose. No decision producing legal or similarly significant effects on a student is made solely by automated means (Article 22 UK GDPR).
### How will the data be stored and secured?
**Data Storage Location:**
- Platform hosted on Render (Frankfurt, Germany)
- Primary data storage: MongoDB Atlas on AWS infrastructure (Ireland, EU)
- Temporary file storage: Amazon S3 (Ireland, EU)
- OCR transcription service: Top Marks' own Google Cloud Platform account (London, United Kingdom)
- All locations selected to keep personal data within the UK and the EU/EEA
**Backup Storage:**
- Automated backups via MongoDB Atlas, stored within the same AWS Ireland infrastructure
- Personal data is included in backups as part of operational data and is subject to the same encryption and access controls as primary storage
- Backup snapshots are retained for 35 days and then overwritten
**Technical Security Measures:**
- Encryption in transit (TLS/HTTPS for all communications) and at rest (AES-256)
- Network firewalls
- Role-based access controls (RBAC) applying the principle of least privilege
- Multi-factor authentication (MFA) required for all database access
- Password protection requirements for user accounts, with optional SSO and MFA available
- Full audit logging of system access, with timestamps and user identification
- Regular internal security reviews and continuous risk monitoring of systems
**Physical and Personnel Controls:**
- Physical security of data centres is provided by AWS, Google Cloud and Render, each of which holds ISO 27001 and SOC 2 certification
- Internal access controls: database access limited to the CEO, COO and Chief Developer, and customer success staff access via a customer support interface, for troubleshooting purposes only
- All internal access protected by MFA and audit logging
### How is access to personal data restricted and monitored?
Access to production data is strictly limited to the CEO, COO, Chief Developer, and customer success staff via a customer support interface (troubleshooting purposes only), all under mandatory MFA. All such access is logged and monitored, with timestamps and user identification recorded. This is consistent with Annex A (paragraph 3.2(d)) to Schedule 1 of the Platform Terms and Conditions, which limits support, troubleshooting and maintenance access to a small number of authorised personnel identified by role in this pack.
### Has the processor been independently audited or certified for security, and is penetration testing performed?
Top Marks holds Cyber Essentials certification (basic level), assessed by IASME, covering the full organisation, and is registered with the ICO (reference ZB903015). Top Marks does not hold ISO 27001 or SOC 2 certification itself; its hosting providers (AWS, Google Cloud, Render and MongoDB Atlas) hold ISO 27001 and SOC 2 certification for the infrastructure on which the platform runs.
Penetration testing: security testing is carried out internally by Top Marks' engineering team. No independent third-party penetration test has been commissioned to date.
### Is system access and activity logged, and how long are these logs retained?
Yes. Comprehensive audit logging tracks all access to personal data and all database access, with timestamps and user identification. Access and authentication logs are retained for 12 months. Support communications are logged and retained for 24 months.
### How will the data be deleted / disposed of?
Upon termination of the agreement, or on the school's instruction at any time, Top Marks will delete or return personal data in accordance with paragraph 11 of Schedule 1 (Data Processing Agreement) to the Platform Terms and Conditions:
- **Customer option for return or deletion:** Schools have 60 days from the end of the contract to tell us whether they want their personal data returned, deleted, or returned and then deleted. We give effect to that instruction within 30 days of receiving it, and confirm in writing when it has been done.
- **Automatic deletion:** If no instruction is given, we delete all personal data within 90 days of the end of the contract. Where a school has asked for its data to be returned, deletion follows within 30 days of that return being completed, and in no event later than 120 days after the end of the contract.
- **Export period:** Deletion does not begin before the end of the school's 60-day export period under clause 13.4(e) of the Terms and Conditions, unless the school asks for earlier deletion. Trials are subject to a shorter 30-day cycle under the Trial Agreement.
- **Exception:** Some data may be retained where required by applicable law, held segregated and not processed for any other purpose
**Secure Disposal:**
- All data deletion follows secure disposal procedures to ensure data cannot be recovered
- Deletion applies to primary storage (MongoDB Atlas on AWS Ireland), temporary file storage (Amazon S3) and backup systems
- Personal Data persisting in encrypted backup media after deletion from live systems is isolated from all processing, protected from further access, and deleted on expiry of the backup rotation cycle of 35 days; Top Marks will confirm the deletion date on request
**Right to Deletion:**
Schools can instruct Top Marks to delete personal data at any time by contacting info@topmarks.ai, and Top Marks will give effect to such instructions in accordance with paragraph 11 of Schedule 1. Where a data subject contacts Top Marks directly requesting erasure, Top Marks acknowledges the request and refers it to the relevant school as Data Controller for decision.
### Will the data be shared/disclosed to third parties?
**Sub-Processors That Handle Personal Data:**
A full, current sub-processor list, showing each provider's role, the data it processes and its hosting location, is published at topmarks.ai/subprocessors and is authorised under paragraph 8 of Schedule 1. Providers that receive only anonymised assessment content (the AI gateway, the model providers and AI-generated text detection) are listed separately on the same page.
**Sub-Processor Contracts and Liability:**
Any sub-processor handling personal data operates under a contract imposing data protection obligations on that sub-processor equivalent to Top Marks' own obligations under Schedule 1, covering processing only on documented instructions, appropriate technical and organisational security measures, confidentiality, assistance with data subject rights and breach notification, and deletion or return of data on termination (paragraph 9 of Schedule 1). Top Marks remains liable to the school for its sub-processors' performance of those obligations.
**Changes to Sub-Processors:**
Top Marks will give the school at least 30 days' written notice before engaging any new sub-processor to process personal data or materially changing an existing sub-processor's role, identifying the sub-processor, its role, its location and the reason for the change (paragraph 8 of Schedule 1). The school may object on reasonable data protection grounds within 20 days, and where an objection cannot be resolved within 30 days the school may terminate and receive a refund of fees for the unexpired term. Where a change is required urgently to maintain security or availability, Top Marks notifies the school as soon as possible afterwards, and the school's objection and termination rights still apply. Notices go to the school's data protection contact named in its contract.
**No Third-Party Marketing:**
Personal data is never sold or shared with other companies for third-party marketing purposes. Top Marks may separately send its own marketing communications (for example, about new platform features) where it has appropriate permissions, or in reliance on the 'soft opt-in' where a recipient has previously enquired about or purchased its services; recipients can opt out of these at any time.
**Educational Institution Access:**
Schools retain access to their students' grading and feedback data through the platform interface, but this constitutes data controller access rather than third-party sharing.
### What types of processing identified as likely high risk are involved?
**Data Breach Risks:**
- **Anonymisation failure:** Edge-case risk where a student writes a personal identifier (for example, their name) inside an assessment response. Mitigation: automated identifier detection and removal after transcription, before any content leaves Top Marks' infrastructure; residual risk is limited to anonymised content reaching a model provider bound by no-training business terms.
- **Sub-processor breaches:** Risk of a security incident at a third-party provider. Mitigation: UK/EU hosting, contractual flow-down of Schedule 1 obligations, and use of providers holding ISO 27001 and SOC 2 certification.
- **Unauthorised access:** Mitigated through MFA on all internal access, role-based access control, audit logging, and optional SSO and MFA for school users backed by the school's Google or Microsoft identity provider.
**Individual Rights Limitations:**
- Risk: a data subject's request could be delayed by being routed through two organisations
- Mitigation: administrators can export a Student's assessment data directly from the Platform, so most access and portability requests do not depend on Top Marks' response times at all
- Mitigation: requests received directly by Top Marks are referred to the school within 2 Business Days, and the school's instructions are actioned within 10 Business Days (paragraph 4(a) of Schedule 1)
- Residual limitation: some data may be retained where required by Applicable Law
**Cross-Border Processing:**
- Anonymised essay content is sent to US-based model providers. Because student identity and incidental identifiers are removed first, this is not a transfer of personal data, and the residual privacy risk is minimal.
**Organisational Measures:**
- Staff training on data protection responsibilities for all personnel with access to personal data
- Cyber insurance (Hiscox) including data breach cover
- Contractual safeguards with all sub-processors handling personal data
**Children's Data Protections:**
- Under UK GDPR, no additional parental consent is required beyond the school's own basis for processing, as services are contracted through schools acting in their educational capacity
- Data minimisation: only the information necessary for assessment marking is collected; student email addresses are not collected and students are never contacted directly
- Anonymisation before any external processing, and teacher review of all output before use
**Incident Response:**
- Defined procedures for breach notification and containment, with clear escalation paths and support for the school's regulatory reporting (see the breach notification section below)
- Regular monitoring of sub-processor compliance and security standards
### How and when does Top Marks AI notify a school of a personal data breach?
Top Marks maintains a formal, structured Security Breach Incident Response Plan, with a response team comprising the CEO, COO, Chief Developer, and Customer Success staff, and documented procedures for technical remediation and forensic analysis. The plan covers immediate containment and investigation, impact assessment and remediation steps, notification to affected schools' contacts and DPOs, support for the school's own ICO notification obligations where required, and ongoing progress updates throughout investigation and resolution.
Contractually, under paragraph 4(b) of Schedule 1 to the Platform Terms and Conditions, Top Marks will notify the school without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting the school's data, describing the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Where all of that information is not available at once, it is provided in phases. Notices go to the school's data protection contact named in its contract.
As the school is the Data Controller, the duty to notify the ICO (within 72 hours where required) sits with the school; Top Marks' role is to support that notification, not to make it directly.
---
**Scope of processing activities**
### Categories of personal data
**Student Data:**
- Full name (or student ID as alternative identifier where school opts for this)
- Class/year group information (where explicitly provided by the Customer)
- Exam or essay responses, including handwritten responses converted into text
- Assessment results and feedback generated by the platform
**Staff Data:**
- Full name
- Email address
- Institution name
- Communication records
- Account identifiers and login credentials (hashed)
- Teacher account identifiers (linking uploaded work to specific teacher accounts)
**Technical/Usage Data:**
- Device Information: IP address, browser type, operating system
- Usage Data: Pages visited, interactions with platform, time spent on platform
- Cookies and tracking technologies for analytics and user experience (see the Cookie Policy at topmarks.ai/cookies)
- Authentication and access logs
**Metadata:**
- Submission timestamps (when work is uploaded to the platform)
- Teacher-work associations (which teacher uploaded which assessments)
- Subject/course information (as provided by schools during upload process)
- QR code/barcode identifiers used to link anonymised assessment content to student identity records held on Top Marks AI's servers
- Standardisation and marking scheme references associated with uploaded assessments
All data collection is limited to what is necessary for the automated marking and feedback services, with schools maintaining control over what student information they choose to share through Wonde integration or manual uploads. This list matches paragraph 4 of Annex A to Schedule 1.
Top Marks AI does not require or deliberately collect special category personal data (as defined in Article 9 UK GDPR) or criminal convictions data (Article 10 UK GDPR) as part of its standard service (Annex A, paragraph 4). Where a school believes that assessment content may incidentally contain special category data, it should notify Top Marks AI prior to upload. Free-text responses may incidentally contain Article 9 data; it is processed only as part of the assessment content and is never used for profiling.
### Length and frequency of processing
**Processing Duration:**
- Active processing: Data is processed immediately upon upload, with each essay taking approximately 5 minutes for transcription, AI marking and feedback generation
- One-time processing: Each essay undergoes a single marking process - once completed, the data moves to static storage
**Data State After Processing:**
- At rest: Following initial marking, student essays, grades, and feedback are stored in MongoDB database and remain inactive unless accessed
- Periodic access only: Stored data is only reprocessed when:
- Users access individual student results and feedback
- Teachers request whole class feedback generation (which aggregates previously processed individual feedback)
- Teachers make use of the Moderation feature to adjust and regenerate feedback for a student's response.
**No Continuous Processing:**
- Data is not in constant use or subjected to ongoing automated processing
- No background reprocessing or analysis occurs without explicit user action
- Platform does not use customer data for training or improvement purposes without the school's explicit written permission (clause 5.2 of the Platform Terms and Conditions)
Retention is addressed in the next section.
### How long will the data be retained for?
**Standard Retention Periods:**
- Student assessment data and staff accounts: retained for the school's licence period. Top Marks does not delete school data on grounds of inactivity unless instructed to do so by the school; where a school has given a standing instruction to that effect, it is recorded in its Subscription Contract.
- Post-contract: returned or deleted in accordance with paragraph 11 of Schedule 1, as set out under 'How will the data be deleted / disposed of?' above (school's election within 60 days; action within 30 days of instruction; automatic deletion within 90 days, or 120 days at most where return is requested).
- Backups: follow the same deletion timeline as live data, plus the backup rotation cycle of 35 days
- Access and authentication logs: 12 months; support communications: 24 months
- Legal retention: some data may be retained longer where required by applicable law, held segregated and not processed for any other purpose
**Retention Reviews:**
Retention compliance is reviewed every six months as part of standard operating procedure, with additional reviews triggered by changes to school agreements or regulatory requirements. The annual review of this pack includes a full assessment of retention policies and their implementation.
---
**Context of processing**
### What is the lawful basis for processing?
The school, as controller, determines the lawful basis for the processing of student and staff data on the platform. For maintained schools and academies this is normally public task (Article 6(1)(e) UK GDPR), as part of the school's function of providing education; independent schools typically rely on contract (Article 6(1)(b)) or legitimate interests (Article 6(1)(f)). Top Marks processes this data solely as processor on the school's documented instructions and does not rely on a lawful basis of its own for it (paragraph 2 of Schedule 1).
Neither Top Marks nor the school relies on consent (Article 6(1)(a)) for this processing. The MIS integration operates on the school's documented instruction as controller, given by an authorised administrator, and not on consent. The school confirms that it has identified and will maintain its lawful basis, and has provided the required privacy notices, when it signs its Subscription Contract or Trial Agreement (paragraph 12 of Schedule 1).
Where Top Marks acts as controller in its own right (website analytics, enquiries and business contacts, marketing, security and legal compliance), its lawful bases are set out in its Privacy Policy (topmarks.ai/privacy).
### What is the relationship with the user/data subject?
In relation to student and staff personal data processed to provide the Platform, Top Marks AI acts as a Data Processor for the school (the Data Controller), processing personal data solely on behalf of the school and according to the school's instructions to provide automated marking and assessment services (paragraph 2 of Schedule 1 to the Platform Terms and Conditions).
### Where can I find your UK GDPR Data Processing Agreement?
The Data Processing Agreement is set out as Schedule 1 of Top Marks AI's Platform Terms and Conditions (topmarks.ai/terms), which is incorporated into the school's Subscription Contract (section 1.1) or Trial Agreement (clause 1.2) and constitutes the written agreement required by Article 28(3) UK GDPR between the school (as controller) and Top Marks AI (as processor). The processing particulars required by Article 28(3) are set out in Annex A to Schedule 1. The version of the Terms and Conditions in force on the contract's Effective Date applies for the whole licence period (clause 1.4).
### How much control will the data subject have over the shared personal data?
Data subjects retain their full rights under UK GDPR. Those rights are exercised through the school as Data Controller, which decides whether and how each right applies. Top Marks supports the school by making the underlying data available (administrators can export a Student's assessment data directly from the Platform) and by acting on the school's documented instructions where Top Marks' own action is needed, for example for erasure, rectification or restriction.
- Parents and guardians can request access to or deletion of their child's data by contacting the school or Top Marks directly at info@topmarks.ai. When they contact Top Marks directly, Top Marks acknowledges the request, notifies the school within 2 Business Days and coordinates the response through the school as controller.
Students and parents are informed about the processing through the school's own privacy notices.
Some data may be retained where required by law. The detailed process for each right is set out under 'How do you support data subject rights?' below.
### Are there prior concerns over this type of processing or security flaws?
As at 1 September 2026, Top Marks has not experienced a personal data breach, and no concerns about its processing have been raised by a regulator or a school. The known risks of this type of processing, and the mitigations in place, are set out under 'What types of processing identified as likely high risk are involved?' above.
---
**Assess necessity and proportionality**
### Can the school respond to a subject access request without Top Marks' involvement?
In most cases, yes. Administrators can export a Student's assessment content, transcribed responses, grades and feedback directly from the Platform, without needing to contact Top Marks. This means a school can respond to an access request (Article 15 UK GDPR) or a portability request (Article 20) within its own timescales, using its own processes, without a dependency on Top Marks' response times.
Export is available in CSV and Word format.
Top Marks' involvement is needed only for:
- categories of personal data that are not available through self-serve export; and
- erasure, rectification and restriction, which require action on Top Marks' primary storage and backups and are therefore actioned by Top Marks on the school's documented instruction.
Because the school is the Data Controller, decisions about whether and how a right applies always rest with the school. Top Marks' role is to make the underlying data available and to give effect to the school's instructions.
### How do you support data subject rights?
As Data Controller, the school decides whether and how a data subject right applies to its Students' and staff's personal data. Top Marks acts as Data Processor and supports the school in two ways: by making the underlying data available to the school directly, and by acting on the school's instructions where Top Marks' own action is required.
**Access and portability requests**
- Administrators can export a Student's assessment content, grades and feedback from the Platform directly, so most access and portability requests can be answered by the school without contacting Top Marks
- Where a request covers data not available through self-serve export, Top Marks will locate and provide that data to the school on request
- Top Marks does not respond substantively to access requests received directly from data subjects; such requests are acknowledged and referred to the relevant school
**Correction and rectification**
- Actioned by Top Marks on the school's documented instruction
- Corrections are applied across primary storage and, where applicable, are reflected in exported Output
- Where the data in question is AI-generated feedback, the school can amend Output within the Platform using the review and moderation features
**Erasure**
- Actioned by Top Marks on the school's documented instruction, not on a data subject's direct request
- Deletion is applied to primary storage, temporary file storage and backups
- Some data may be retained where required by Applicable Law, held segregated and not processed for any other purpose
**Objection and restriction**
- Restriction is applied by Top Marks on the school's documented instruction
- Objections to processing are decided by the school as Data Controller, since Top Marks does not determine the lawful basis for the processing of Student or staff data
**Requests received directly by Top Marks**
Where a data subject, parent or guardian contacts Top Marks directly, Top Marks will acknowledge receipt, notify the relevant school without undue delay and in any event within 2 Business Days, and confirm to the requester that the request has been referred to their school as Data Controller. Where the school instructs Top Marks to take action, Top Marks will do so within 10 Business Days of receiving the instruction (paragraph 4(a) of Schedule 1).
**Data for which Top Marks is Controller**
Where Top Marks processes personal data as Controller in its own right — for example, website enquiries and its own business contacts, as described in clause 4.2 of the Platform Terms and Conditions and in the Privacy Policy — Top Marks handles rights requests directly.
### How do you safeguard international transfers?
**Personal data: no international transfers**
All personal data processed on behalf of schools is stored and processed within the UK and the EEA:
- Platform hosted on Render (Frankfurt, Germany)
- Database and backups: MongoDB Atlas on AWS (Ireland); temporary file storage and the Exam Decoder orchestration service: AWS (Ireland)
- OCR transcription: Top Marks' own Google Cloud Platform account (London, United Kingdom)
- Other sub-processors handling personal data (Amplitude, Brevo) are EU hosted, as set out at topmarks.ai/subprocessors. Wonde, through which schools share MIS data with Top Marks, is engaged and authorised by the school and is not a Top Marks sub-processor.
**Anonymised content:**
For AI marking, only anonymised assessment content, from which student identity and incidental identifiers have been removed, is sent through the AI gateway to model providers, some of which are US-based. As no personal data is transferred, international transfer safeguards are not required for this processing (Annex A, paragraph 7).
Should a transfer of personal data outside the UK or EEA ever become necessary, paragraph 7 of Schedule 1 requires Top Marks to rely on UK adequacy regulations or an EU adequacy decision, or to put in place the UK International Data Transfer Agreement or Addendum (for transfers from the UK) or the EU Standard Contractual Clauses (for transfers from the EEA).
### What are your incident response commitments?
- **Incident priority targets (SLA section 3.3):** These are targets, not guarantees. Supported Hours are 06:00–22:00 daily; Business Hours are 09:00–17:00 on weekdays excluding public holidays.
| Priority | Initial response | Resolution target |
| --- | --- | --- |
| P1 (Critical, e.g. platform-wide outage, data loss, security breach) | 2 Supported Hours | 8 Supported Hours |
| P2 (High) | 4 Supported Hours | 2 Business Days |
| P3 (Medium) | 1 Business Day | 5 Business Days |
| P4 (Low) | 2 Business Days | Best efforts |
- **Personal data breach notification:** within 48 hours of Top Marks becoming aware of a breach (paragraph 4(b) of Schedule 1)
- **Data subject requests:** referred to the school as Data Controller within 2 Business Days; where the school instructs Top Marks to act, actioned within 10 Business Days (paragraph 4(a) of Schedule 1). Schools can export a Student's assessment data from the Platform directly without contacting Top Marks
- **Data deletion:** within 30 days of a written instruction, or within 90 days of the end of the contract (120 days at most where return is requested) if no instruction is received (paragraph 11 of Schedule 1)
Document information
| Document title | Top Marks AI - DPIA Support Pack |
| --- | --- |
| Version | 2.0 |
| Owner | Alex Chapman, COO, Top Marks AI Ltd |
| Review date | August 2027 |
| Company number | 11580241 |
- [Getting Started](https://help.topmarks.ai/knowledge/getting-started?hsLang=en-gb)
- [Marking & Feedback](https://help.topmarks.ai/knowledge/marking-feedback?hsLang=en-gb)
- [Accounts, Data & Security](https://help.topmarks.ai/knowledge/accounts-data-security?hsLang=en-gb)
- [Troubleshooting](https://help.topmarks.ai/knowledge/troubleshooting?hsLang=en-gb)
- [Integrations](https://help.topmarks.ai/knowledge/integrations?hsLang=en-gb)
- [FAQs](https://help.topmarks.ai/knowledge/faqs?hsLang=en-gb)
[](https://help.topmarks.ai/?hsLang=en-gb)
[mailto:hello@topmarks.ai](mailto:hello@topmarks.ai)
Copyright © 2026, Top Marks AI