Data Protection & International Transfers

Overview

RevHub is a revision platform designed for use by schools. It processes limited personal data only where necessary for user account creation, user access, platform administration, and revision management.

For school use, the school remains the data controller for personal data provided for use within the platform. RevHub acts as a service provider (data processor), processing that data for the purposes of account creation, access management, revision tracking, and platform administration.

RevHub uses established third-party infrastructure and service providers to support secure hosting, storage, logging, email transmission, analytics, and related platform functions. The compliance and security controls described in this document are based on the current contractual and published documentation for those service providers.

Personal Data Processed by RevHub

RevHub is designed to operate using only the minimum personal data required for school administration and platform use.

Processor and Third-Party Compliance

RevHub relies on contracted third-party service providers for elements such as data hosting, storage, email delivery, logging, analytics, and technical platform support.

• The underlying platform provider states that its sub-processors are subject to data processing terms materially similar to its own Data Processing Agreement, and that risk assessment is undertaken before any new sub-processor is engaged.
• The platform provider remains liable to its customers for breaches of the Data Processing Agreement caused by its sub-processors.
• The current documented sub-processor list includes providers used for data storage and hosting, email transmission, server services, analytics, AI services, media hosting, and logging.

The documented technical and organisational security measures include:

• Encryption and strong authentication for access control
• Annual access reviews
• Logging of data access and changes with timestamps
• Annual penetration testing
• Regular automated backups
• Documented incident and breach notification procedures
• An annually reviewed information security policy

The platform provider also states that it holds SOC 2 Type II and ISO 27001 certification, with further supporting security documentation available through its published compliance materials.

International Transfers of Personal Data

RevHub currently operates using infrastructure for which app data is stored and processed in the United States by default.

Where personal data is transferred outside the UK or EEA, the applicable Data Processing Agreement requires one of the following lawful transfer mechanisms:

• Transfer to a country benefiting from an EU or UK adequacy decision
• The EU–US Data Privacy Framework
• EU Standard Contractual Clauses incorporated into the Data Processing Agreement

For transfers originating from the UK, equivalent mandatory contractual protections are stated to apply on the same basis.

Accordingly, RevHub's current position is that international transfers are safeguarded through contractual and regulatory transfer mechanisms including the EU–US Data Privacy Framework and/or Standard Contractual Clauses, with equivalent contractual protections applied to transfers from the UK.

Data Minimisation and Access Control

RevHub is intended to use only the personal data required for school administration, teacher access, student access, class allocation, and revision management. It is not intended to require unnecessary categories of personal data in order to operate.

Access to data within the platform is role-based, so that students, teachers, and school administrators are provided with access appropriate to their role and responsibilities within the school.

Supporting Documentation

The following supporting materials may be referenced for due diligence or DPIA purposes:

Contact

For data protection queries, contact RevHub at support@revhub.uk.