Privacy statement UpGrade
1. What this privacy statement covers
This privacy statement explains how UpGrade handles personal data.
UpGrade supports schools and teachers with grading, assessment and feedback on student work. This may involve processing personal data such as teacher account details, school details, student work, assessment results and technical data.
Privacy matters because education data can be sensitive. Schools, teachers, students and parents must be able to trust that data are handled carefully, securely and transparently.
2. Our role in relation to personal data
The roles around personal data depend on the product and service. Where Southbeach processes personal data on behalf of an educational institution, Southbeach acts as processor and the arrangements are documented in a data processing agreement.
For personal data Southbeach processes for its own purposes, such as website contacts, administration, invoicing and service security, Southbeach acts as controller.
3. Which data we process
We may process the following categories of data:
Account and contact data
For example name, email address, school name, role, login information and support communication.
School and usage data
For example information about the school environment, settings, user roles, usage statistics and selected functionality.
Education and assessment data
For example tests, assignments, rubrics, correction instructions, student answers, feedback, scores, analyses and adjustments made by teachers.
Technical data
For example IP address, device and browser data, log files, error messages, security logs and session data.
Payment and contract data
For example invoice details, subscription information, offers and contractual arrangements.
We ask schools and users not to upload unnecessary sensitive data. If sensitive data are nevertheless included in documents, UpGrade processes them only insofar as needed to provide the service and according to the agreements with the school.
4. Why we use data
We use personal data for the following purposes:
- creating and managing accounts;
- providing the UpGrade service;
- processing documents, tests and student answers;
- generating draft feedback, draft score proposals and analyses;
- enabling teachers to review and adjust AI output;
- improving the security, reliability and operation of the service;
- support, troubleshooting and communication;
- administration, invoicing and contract management;
- complying with legal obligations;
- preventing misuse, security incidents and unauthorized access.
Student data are not sold or used for advertising. Customer data are not used to train our general AI models. If external AI services are used, the applicable data-use terms are those agreed with the relevant provider and school.
5. AI and human review
UpGrade uses AI to support teachers. AI can help, for example, with document recognition, rubric matching, draft feedback, score proposals or analyses.
AI output is not automatically final. A teacher or authorized school employee must review the output and can adjust, reject or supplement it.
UpGrade is intended as a tool for the teacher, not as a replacement for the professional assessment by the school.
6. Legal bases
For data we process on behalf of schools, the school determines the legal basis.
For data for which Southbeach B.V. is controller, we use one of the following legal bases depending on the situation:
- performance of a contract;
- legitimate interest, for example security, support and service improvement;
- legal obligation, for example administration;
- consent, for example for certain cookies or marketing communication.
7. With whom we share data
We share personal data only where necessary for the service, security, support, legal obligations or agreed arrangements.
Possible recipients include:
- hosting and infrastructure partners;
- secure cloud and storage services;
- AI, OCR or document-processing services, where used;
- support and communication services;
- administrative or legal service providers;
- competent authorities where legally required.
We publish or provide schools with a current list of subprocessors. New subprocessors are added according to the agreements in the data processing agreement.
8. Where data are stored
UpGrade aims to process data within the European Economic Area.
If data are processed outside the European Economic Area, this will only take place with appropriate safeguards, such as contractual arrangements and lawful transfer mechanisms.
Personal data are hosted in an EduCloud environment provided within the OCRE 2024 Framework for European research and education institutions.
Where external AI, OCR or document-processing services are used for specific processing steps, the relevant arrangements on location, transfers and safeguards are documented in the data processing agreement and/or subprocessor list.
9. How long we keep data
We do not keep personal data longer than necessary.
The exact retention periods may differ per school or agreement. In principle, the following starting points apply:
- account data: as long as the account is active and then for a reasonable administrative period;
- student work and assessment data: according to the agreements with the school;
- support data: as long as needed for handling and quality control;
- security logs: as long as needed for security, investigation and audit;
- invoice and administration data: as long as legally required.
Schools can agree shorter retention periods, automatic deletion or export.
10. Security
We take appropriate technical and organizational measures to protect personal data.
Examples include:
- access control and role management;
- secure connections;
- logging and monitoring;
- limiting access to authorized employees;
- agreements with subprocessors;
- backups and recovery measures;
- procedures for security incidents;
- privacy and security by design in product development.
The concrete security measures are further described in the data processing agreement, security appendix or school documentation.
11. Data breaches and incidents
If we discover a security incident that may affect personal data we process on behalf of a school, we inform the school according to the agreements in the data processing agreement.
We cooperate with investigation, damage limitation and the information the school needs to meet its own legal obligations.
12. Rights of data subjects
Students, parents and staff have privacy rights, such as the right of access, correction, deletion, restriction, objection and data portability.
If the request concerns data we process on behalf of a school, the request usually goes through the school. We help the school handle such requests.
If the request concerns data for which Southbeach B.V. is controller, such as website or contact data, a request can be sent to privacy@southbeachpublishing.com.
13. Cookies
Our website may use cookies or similar technologies.
Necessary cookies are needed for the website to function properly. For analytical or marketing cookies we ask consent where legally required.
Non-essential analytics or marketing cookies are placed only after consent has been provided through the cookie banner where that consent is legally required.
14. Children and students
UpGrade is aimed at schools and teachers. Students use UpGrade only if the school allows and organizes this.
We do not target children directly for marketing purposes.
15. Changes
We may update this privacy statement. For important changes, we inform schools and users in an appropriate way.
The latest version is always available on our website.
16. Questions
For privacy questions, contact:
privacy@southbeachpublishing.com
Southbeach B.V.
Chamber of Commerce number: 97953466
Last updated: September 13, 2026