DPIA Summary
Version 1.2 — 4 October 2026 (first published 10 June 2026)
Source (markdown) · Press ⌘P to save this page as a PDF.
This document is a redacted, public-facing summary of the Data Protection Impact Assessment (DPIA) conducted by andBeyond.digital Ltd, the company that operates C3NTR, for the C3NTR knowledge platform, in accordance with UK GDPR Article 35. The full internal DPIA is available to school leaders under NDA on written request to info@c3ntr.app.
1. Why a DPIA is required
A DPIA is required under UK GDPR Article 35(3) because C3NTR processes, on a large scale, Personal Data relating to children (school students who may be under 18, including under 13). The processing falls within the indicative list maintained by the Information Commissioner’s Office (ICO) of operations likely to result in a high risk to the rights and freedoms of natural persons: large-scale processing of children’s personal data in an educational setting. C3NTR processes no biometric data.
C3NTR has therefore conducted this DPIA before commencing large-scale Processing.
2. Description of Processing
2.1 Nature
C3NTR is a school knowledge platform: a mobile application and web portal that schools use to deliver structured curriculum content (articles, glossary terms, video, audio) to their members and to manage their roster.
2.2 Scope
Each School is the data controller for its own members’ Personal Data. C3NTR (the Processor) provides shared infrastructure. Data is segregated per school by school identifier at the Firestore-rules layer.
2.3 Context
- Schools choose to subscribe to C3NTR; students join because their school has done so.
- Most schools using C3NTR are martial-arts, dance, music, fitness, or academic enrichment schools.
- A meaningful proportion of student users are under 18; some are under 16.
2.4 Purposes
Limited to: delivering curriculum content; tracking individual reading progress for the student’s own resume-where-you-left-off experience; providing aggregate engagement analytics to school leaders; sending announcements; authentication.
C3NTR does not process student data for:
- profiling for advertising,
- automated decision-making with legal or similarly significant effect,
- third-party data resale or analytics syndication,
- any purpose outside the school’s documented instructions.
3. Necessity and Proportionality
3.1 Lawful basis (the School’s responsibility as Controller)
Most Schools will rely on UK GDPR Article 6(1)(b) (performance of a contract) for its instructor and administrator members, and on Article 6(1)(f) (legitimate interests) for its students, giving parental notice where the student is a child. The legal basis assessment is the School’s. C3NTR does not verify a member’s age itself. A school leader records an age band (under 13, 13 to 17, or 18 or over) when inviting or approving each member. For a member under 13 the leader must also record a parent or guardian contact before the member can be approved, and can record that the parent or guardian has been told.
3.2 Data minimisation
C3NTR collects only the data described in the DPA Annex I. It does not collect geolocation or payment-card details. A school leader may choose to import selected contacts (name and phone number) from their own device to invite members; only the contacts they select are uploaded. C3NTR does not check age at account creation: eligibility rests on the School’s enrolment and on the age band the School records (section 3.1). Accounts a School marks as under 18 get higher-privacy defaults: the words typed into search are not kept, crash reports are off, and the app does not offer a profile photo.
3.3 Retention
Reading-progress and engagement data are retained for as long as the user has an account. A daily retention job deletes other records once the periods published in the Privacy Policy have passed (for example invitation entries, support feedback, audit logs and abandoned checkouts). Data is also deleted when a member deletes their account, when a School deletes itself or asks us to, or on request.
3.4 Data subject rights
The Right of Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Portability (Art. 20), and Objection (Art. 21) are honoured. In the mobile app a member can download a copy of their data (a JSON file, after re-verifying by SMS) and delete their account. Deletion removes the account and the records linked to it, including memberships, favourites, reading progress, invitation entries, feedback, attendance responses, grading history, push tokens and the profile photo. A school leader can download the School’s data and delete the School, which removes its content, media and members’ access. Requests can also be made in writing to info@c3ntr.app.
4. Risks Identified
| # | Risk | Likelihood | Severity | Inherent risk |
|---|---|---|---|---|
| R1 | Unauthorised access to student data via account-takeover | Low | High | Medium |
| R2 | Excessive data collection / function creep over time | Medium | Medium | Medium |
| R3 | Profile photo of identifiable minor disclosed unintentionally | Low | High | Medium |
| R4 | Behavioural data (reading patterns) used for evaluation without consent | Low | Medium | Low |
| R5 | Sub-processor data breach (e.g. Sub-processor compromise) | Low | High | Medium |
| R6 | International transfer outside UK/EEA without valid mechanism | Very low | High | Low |
| R7 | Failure to deliver Data Subject Rights within statutory window | Low | Medium | Low |
| R8 | Personal-data breach undetected for extended period | Very low | High | Low |
5. Mitigations Applied
| # | Risk | Mitigation | Residual risk |
|---|---|---|---|
| R1 | Account-takeover | Phone-number OTP authentication; magic-link email for the web portal; Firebase App Check on every request; rate-limiting on auth attempts; server-side role checks with claims revoked when a staff member is removed. There are no passwords and no second factor in the product. | Low |
| R2 | Function creep | A published data inventory (28 September 2026); the Data Protection Lead commits to reviewing it at least annually and whenever a field is added to the member model. | Low |
| R3 | Photo disclosure | Profile photos are optional and readable only by the member, staff of a school they belong to, and C3NTR (Storage rules check membership in Firestore). The app does not offer a profile photo on an account a School has marked as under 18. On-screen disclosure at upload time is planned. | Low |
| R4 | Behavioural data | Aggregated engagement only — never per-student reports for school leaders; no advertising or product-analytics SDK (crash reports go to Firebase Crashlytics without an account identifier; a member can switch them off, and they are off for accounts a School marks as under 18); members’ search terms are aggregated per school without user identifiers and are visible to school staff; on-device semantic search runs entirely on the user’s device. | Low |
| R5 | Sub-processor breach | Sub-processors listed at /subprocessors (Google, Stripe, Pexels, Cloudflare, and — only when a leader turns on AI writing with their own key — Anthropic or OpenAI; Google Workspace for transactional email); SCCs / UK IDTA in place; 30-day change notice. | Low |
| R6 | International transfer | Primary data residency in europe-west2 (London). Where ancillary processing routes outside the UK, the UK IDTA applies. | Very low |
| R7 | DSR delivery | One-month statutory response window tracked in the Data Protection Lead’s mailbox queue; internal target of 14 days. | Low |
| R8 | Undetected breach | Cloud Function errors and security events are written to Google Cloud Logging and privileged super-admin actions to an audit log; automated alerting on anomalous patterns is planned; 72-hour breach notice to school leaders is documented in the DPA. | Low |
6. Conclusion
The DPIA concludes that the Processing of Personal Data, including that of children, by the C3NTR platform can be conducted in a manner consistent with UK GDPR after application of the mitigations described above. Residual risks have been assessed and accepted by the Data Protection Lead on behalf of andBeyond.digital Ltd.
No prior consultation with the ICO under UK GDPR Art. 36 is currently required because no residual risk remains high after mitigation.
This DPIA will be reviewed at least annually, or whenever a material change to Processing is proposed (including: a new Sub-processor, a new data category, a change in data residency, or a new purpose).
7. What changed in this version, and what is still planned (4 October 2026)
Version 1.1 listed five controls as planned. They are now live:
- An age band on each invitation and membership, a parent or guardian contact for members under 13, and higher-privacy defaults for accounts marked as under 18.
- Explicit, recorded acceptance of the Terms and Privacy Policy before using the app or the web portal, and again when they change.
- Account deletion that covers the linked records listed in section 3.4, and a school-level deletion path.
- A daily retention job with published retention periods, and a self-service data export for members and for schools.
- A switch to turn off crash reporting.
The following remain planned, not live; this summary will be re-issued when each ships:
- On-screen disclosure of who can see a profile photo, at upload time.
- Automated alerting on anomalous patterns in security logs.
- Server-side enforcement of the no-profile-photo default for accounts marked as under 18 (the app enforces it today).
8. Sign-off
| Data Protection Lead | andBeyond.digital Ltd (operator of C3NTR) |
|---|---|
| Date of assessment | 10 June 2026; revised 28 September 2026 (v1.1) and 4 October 2026 (v1.2) |
| Next scheduled review | 2 June 2027 |
| DPIA reference | C3NTR-DPIA-2026-01 |
Questions about this DPIA: info@c3ntr.app.