Legal information

Your school uses Lantern to keep track of your marks and how you are getting on, so teachers can spot early when you need help. Only school staff who teach or look after you can see your information. Poyralgo, the company that makes Lantern, looks after it for the school and never uses it for anything else. You or your parents can ask the school to see it, fix it or delete it.

Lantern is software made and run by Poyralgo for the school. The school decides what Lantern is used for and whose data goes into it, so the school is the owner and operator of that personal data (the “controller” in UK GDPR terms). Poyralgo processes the data only on the school’s written instructions, as a third party / processor acting for it.

Poyralgo does not use pupil or staff data for its own purposes: not for marketing, not for analytics about people, and not to develop other products or train AI models.

Lantern follows two sets of law: Kazakhstan’s Law “On Personal Data and Their Protection”, because the school and its pupils are in Kazakhstan, and, because this is a British school, the UK GDPR and Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025. Where they differ, Lantern meets the stricter rule.

The software, its design and its name are © Poyralgo. The school may use Lantern while its agreement with Poyralgo is in force. Lantern includes open-source components, each under its own licence.

This notice is shown to staff before they first sign in. Pupils and parents are told about this processing in the school’s own privacy notice and consent forms.

Whose data. School staff who use Lantern and the school’s pupils in Years 7–13. If the school switches parent messages on, also parents and guardians.

What data.

• Staff: name, staff code, school email address, roles, timetable, sign-in records and a log of the changes they make.
• Pupils: name, date of birth, gender, year, tutor group, house, classes, marks and grades, targets, academic concerns and the support planned for them.
• Parents (only if switched on): name and contact details.

Why. To record and track attainment, notice early when a pupil needs help, plan that help and report progress.

Legal basis. Under Kazakh law, consent: the school collects it from staff, and for pupils under 18 from a parent or other legal representative, in its admission and employment documents. That consent names the data, Poyralgo as the party processing it for the school, whether any data leaves Kazakhstan, and how long it lasts. Under UK GDPR, the school relies on its contract with parents to educate their child and its legitimate interest in tracking and supporting pupils’ progress.

Sensitive information. Lantern is not built to hold health, ethnicity, religion or other special category data. Staff should keep notes on support plans to what the school’s policy allows and record medical or safeguarding details in the school’s own systems for them.

Where it comes from. The school’s information system (iSAMS, or files the school provides) and what staff enter.

Who sees it. Access follows each person’s role: teachers see their own classes, tutors and housemasters their pupils, heads of department their department, senior leaders the whole school. Poyralgo staff look at data only when the school asks or to fix a fault. Data is never sold, published or shown to anyone outside the school.

How long it is kept. As set in the school’s retention schedule. When a pupil leaves, their records are deleted or anonymised once that period ends.

No automated decisions. Lantern flags pupils whose results fall below a line the school sets. A flag is a prompt for a teacher to look; every decision about a pupil is made by school staff, never by the software.

Staff, pupils and parents can:

• find out whether and how their data is processed, and get a copy;
• have wrong or incomplete data corrected;
• have data blocked, anonymised or deleted if it was collected or used unlawfully, or once it is no longer needed;
• restrict or object to its use, and receive their data in a format another system can read;
• withdraw consent, after which processing stops within 15 working days unless the law requires it to continue;
• ask for a person to review any decision about them;
• complain (see below).

Send requests to the school’s data protection lead. The school answers within one month. Poyralgo helps the school answer and carries out any correction or deletion it asks for.

By signing in you agree to:

• use Lantern only for your work at the school;
• keep your password to yourself and sign out on shared computers;
• not copy, export or share pupil data except as the school’s policies allow;
• tell the school’s person responsible for personal data straight away if you think an account or data has been misused.

Changes you make are recorded with your name. The school may suspend accounts that break these terms.

Lantern uses only cookies it needs to work. There are no advertising or tracking cookies, so no cookie banner is shown.

• has_session: keeps you signed in; ends when your session expires or you sign out.
• ui_theme: remembers your chosen theme, for one year.
• nav_collapsed: remembers whether the side menu is folded, for one year.
• has_google_flow, has_ms_flow: used for a few minutes while signing in with Google or linking Outlook.

Kazakhstan’s personal data law requires personal data of people in Kazakhstan to be stored in databases located in Kazakhstan. Before any real pupil or staff data is loaded, Lantern’s database will run in a data centre in Kazakhstan agreed with the school. Data is sent abroad only where both laws allow it and the consent covers it, and then under safeguards UK GDPR recognises, such as the UK’s international data transfer agreement.

Poyralgo uses these providers, each bound by a data-processing agreement:

• Cloudflare: hosting and network (this demonstration).
• Supabase: the database (this demonstration).
• Google and Microsoft: signing in, and sending email from a teacher’s own Outlook mailbox, only if the school turns these on.

Poyralgo tells the school directly, before the change, if it plans to add or replace a provider, so the school can object.

Data is encrypted in transit and at rest. Every request is checked against the user’s role in the database itself, passwords are stored only as secure hashes, and changes to marks, pupils, roles and settings are logged.

If there is a personal data breach, Poyralgo tells the school without undue delay. The school then notifies Kazakhstan’s authorised body within one working day and, where UK law applies, the Information Commissioner’s Office within 72 hours, and tells the people affected when there is a high risk to them.

Data is kept only while it is needed for the purposes above, or longer where a law requires. When the school’s agreement ends, Poyralgo returns the data to the school or deletes it, as the school chooses, and then deletes every remaining copy, backups included.

To help the school with its data protection impact assessment, Poyralgo gives it, free of charge, a description of how Lantern works, what it stores and the safeguards in place.

Questions about your data: contact the school’s data protection lead (its person responsible for personal data). Questions about the software: Poyralgo, through the school.

Complaints. If you are unhappy with how your data is handled, complain to the school first, in writing or by email; the school acknowledges your complaint within 30 days and tells you the outcome. If you are still not satisfied, you can complain to the authorised body for personal data protection in Kazakhstan (the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan) or, where UK law applies, to the Information Commissioner’s Office at ico.org.uk.