Last updated: 13 October 2026
This policy explains what personal data CourseworkHQ collects, why, and what rights you have over it. It's written to be genuinely readable rather than just legally defensible — if anything here is unclear, contact us using the details in Section 13.
This policy reflects how CourseworkHQ actually works and is drafted to meet the requirements of the EU General Data Protection Regulation (GDPR) and Ireland's Data Protection Act 2018.
CourseworkHQ is operated by COURSEWORK HQ LIMITED ("we," "us"), a company registered in Ireland under company number 825909, with its registered office at 9 Aisling Drive, Clareview, Limerick, V94 P9YK. Depending on how your school uses CourseworkHQ, the data controller — the party legally responsible for deciding why and how your personal data is processed — is one of the following:
Teachers usually find CourseworkHQ themselves, and can create an account and use it before their school has agreed to anything. That account holds the teacher's own details and the teaching material they build — projects, rubrics, comment banks, marking templates — and nothing else. No student can be enrolled until the school has applied for a trial and accepted our Data Processing Agreement. There is no period during which we hold a child's data for a school that has not agreed to how it is handled, because there is no way to create that data first.
We do it this way because the alternative isn't tenable. Processing a student's data rests on the school's basis for delivering education (see Section 3), and a student under 16 cannot validly consent to an online service on their own behalf. A school that has agreed to nothing is not in a position to instruct us — so rather than accumulating children's personal data on an unclear footing and hoping the paperwork catches up, we don't take it at all until the school has said yes.
Nothing a teacher builds in the meantime is lost or has to be rebuilt. It carries over the moment their school applies.
Whichever applies, the categories of data collected, how long we keep it, and your rights are the same — set out below.
| Category | What it includes | Who it's from |
|---|---|---|
| Account data | Name, email address, hashed password, role (teacher/student), school affiliation (via class membership) | You, when you register |
| Class & enrolment data | Class names, class join codes, which students are enrolled in which class | Teachers, when creating classes; students, when joining with a code |
| Submitted coursework | The text, or uploaded Word/PDF file, that a student submits for an assignment. A student may choose the file from the computer in front of them or, where their school allows it, by signing in to OneDrive and picking it there — see Handing up a file from OneDrive below. Where the teacher asks for them, photographs the student adds to the work (kept, marked as removed, if the student removes one), and the link to a video the student holds in their own school OneDrive or Google Drive — the video itself stays there and is not copied to us | Students |
| Feedback & grading data | Rubric scores, written comments, highlighted-text annotations left by a teacher on a student's work | Teachers |
| AI-tool-use declarations | Which AI tools (if any) a student says they used for a submission, and a description of how | Students |
| Rubrics & comment-bank content | Marking criteria and reusable feedback comments a teacher writes and saves | Teachers |
| Portfolio reflections (Transition Year) | Reflective writing a student produces about their own Transition Year experiences, the drafts saved along the way, and the developmental indicators they tag each reflection with. Each reflection is private to its author unless the student publishes it to their portfolio, which is what makes it readable by the staff who run their Transition Year group, and that choice is reversible at any time | Students |
| Goals and self-assessment (Transition Year) | Goals set across the four Student Dimensions, the steps and review notes written against them, and the student's own rating of their progress at each checkpoint. The staff who run a student's Transition Year group — the coordinator and the core group they name — can read a student's goals and the reviews written against them, on that student's page. Nobody else can: not their subject teachers, not staff at the same school who are not on the year group, and not us. Goals appear in no report or export, are never marked or scored, and every time a member of staff opens a student's page it is written to the access log. The staff who run the year group see how many goals were set and how many times they were reviewed, and where a school's own credit scheme counts one of these — the default scheme includes a line for reviewing goals at checkpoints — the credit table shows the same figure. In both places it is how many, and never a word of what they said | Students |
| Collected evidence (Transition Year) | Notes, photographs, audio recordings and documents uploaded as portfolio material. Photographs and audio are only accepted where the school's TY coordinator has turned them on for that year group (see Section 6) | Students |
| Portfolio entries (Life, Community and Work) | Writing a student produces about their own learning experiences for the LCW digital portfolio, the drafts saved along the way, and the two tags on each entry — which unit or Applied Learning Task it came from, and which of Participating, Reflecting or Applying it evidences. An entry is a draft or it is submitted; there is no separate privacy setting. A student may instead upload a file they wrote elsewhere, with a short note on what it is and why they chose it, and that counts as an entry. While it is a draft the staff running the cohort can see that it exists and its date and nothing else, not even its title; submitting it is what makes it readable by them, and the student can take it back to a draft at any time, which removes their access immediately. Nobody marks it: the subject's own guidelines say teachers should not mark portfolio work, and there is no rubric, grade or score anywhere in this part of the product | Students |
| Work experience diary (Transition Year) | A student's diary of a work placement: the employer's name and address, the dates and position, a description of the workplace, the student's own account of each day, which may name people at the workplace, and any file they attach, such as the employer's evaluation form. Private to its author until the student finishes and publishes it, when it can be read by the staff who run their Transition Year group and by nobody else. The employer is never given access. Only a finished diary counts towards credits, and what it says is never read to decide that | Students |
| Applied Learning Tasks (Life, Community and Work) | The four task workspaces — a personal statement, a career progression plan, a reflection on a group task, and a workplace plan — each with every draft the student chose to keep and their own note on what changed between them. The current version is readable by the staff running the cohort; earlier drafts are readable only by the student | Students |
| Collected evidence (Life, Community and Work) | Notes, links, photographs, audio, video and documents a student gathers as raw material. This inbox is private to the student — not readable by any member of staff — until an item is attached to an entry they have submitted, or to one of their tasks. Photographs, audio and video are only accepted where the cohort's lead teacher has turned them on | Students |
| Sources and AI acknowledgements (Life, Community and Work) | What a student cites in their portfolio, written out the way the subject’s guidelines ask: the title, who made it, who published it, when it was published, the edition or version, a web address and the date they used it, as far as the student knows each. Where the source is an AI tool, the student must also record what they used it for, and the prompt they used where there is no link to the conversation to share — naming the tool alone is not an acknowledgement. All of it is text the student types | Students |
| Teacher engagement records (Life, Community and Work) | A record of a teacher reading a student's entry, commenting on it, or talking to the student about it, with the date. This exists because the subject's guidelines ask teachers to engage regularly with portfolio work in order to facilitate the State Examinations Commission's authentication process. It carries no mark, score or grade, and there is no field in which one could be recorded | Teachers, and a record of opening a page generated automatically |
| Certificates and micro-credentials | Certificates a student records — title, issuing body, date, whether accredited — and optionally a scan or photograph of the certificate | Students |
| Credit records (Transition Year) | Where a school uses the credit scheme: the credits recorded for a student under each of the school's own credit lines, which teacher entered a figure, and the reason recorded where an automatically counted figure was changed by hand | Teachers, and figures counted automatically from the student's own portfolio activity |
| Portfolio export records | A record that a student downloaded their own copy of their portfolio, and when | Generated automatically |
| Technical data | An authentication token and basic profile info stored in your browser's local storage so you stay logged in (and, only for a student choosing a file from OneDrive, Google Drive or Dropbox, one cookie that lasts ten minutes) (see our Cookie Policy); server request logs kept by our hosting provider for security and reliability; an internal record of when one account views or changes another account's data (deleted after twelve months, unless a legal hold applies), and error reports generated when the application encounters a technical fault | Generated automatically |
| Visits to our public pages | A count of visits to the public part of the site — which page, and the site or campaign that linked you to it. It does not include your IP address: your address and browser description are hashed together with a random value we replace every day, and only that 32-character result is stored, so once the day's value is destroyed nothing links a record to an address. Nothing is stored in your browser, no third party is involved, and nothing you do while signed in is counted. See the Cookie Policy for the full description | Recorded by our own server when you open one of those pages |
| Demo requests and our mailing list | If you fill in one of our request forms — the demo request, the Code of Practice download, or the quotation form on the pricing page: your name, your school, your email address, and which of teacher, SCR coordinator, programmes coordinator or senior management describes you. We also store which form you used, the exact sentence you were shown about what we would do with it, the date you sent it, the date you were given what you asked for, and — if you unsubscribe — the date you did. A quotation request also stores how much of the school it is for and roughly how many teachers, because that is what a price depends on. Nothing is taken from you automatically; every field is one you typed | You, on the request form |
| School agreement records | If you accept our Data Processing Agreement on behalf of a school: your name, your role, your school email address, the date and time you confirmed it, the IP address the confirmation came from, and a copy of the exact wording you confirmed — both the sentence saying you are authorised to act for your school and the agreement you then accepted. The copy is kept so that the school can always be shown exactly what was put in front of the person who accepted, whatever the agreement says later. The current version of the agreement is the one in force between us, and every change to it is published, dated, at courseworkhq.ie/school-terms.html. Held for as long as the agreement stands | You, on the agreement form |
| Sign-in security data | For every staff account, always: a six-digit code emailed to you when you sign in on a device you have not used before, stored hashed and deleted once used or after ten minutes. If you choose “don't ask on this device”, an opaque token stored in your browser and, hashed, by us for thirty days. That token records nothing about the device — no make, model, browser or location | Generated when you sign in |
We do not ask for or knowingly collect any special category data (health information, disability or additional-needs status, religion, ethnicity, and similar) as a defined field anywhere in CourseworkHQ. If a teacher or student happens to type something like that into a free-text field (a comment, a submission), it's incidental to what you chose to write, not something we ask for or use.
One part of the service deserves a plainer warning than the paragraph above. The Transition Year portfolio asks students to write reflectively about their own lives — a work placement that went badly, a community project, something they found hard. Writing of that kind can contain information about health, family circumstances, beliefs or identity, not because we ask for it but because that is sometimes what honest reflection contains. We don't ask for it, we don't analyse, score or profile the content of a reflection, and we don't use it for any purpose beyond showing it to the people the student chose. It's also why a reflection is private to its author unless the student decides otherwise, and why that choice can be reversed at any time, including after a teacher has read it. Schools should treat portfolio content as capable of containing special category data when deciding which members of staff have access to a year group.
Some school laptops have no OneDrive app signed in on them, so a student's own coursework can be impossible to reach from the machine they are sitting at. Where a school has this switched on, the file panel therefore offers a second route: the student signs in to OneDrive — or Google Drive, or Dropbox — and picks the file there instead of from the computer. The same route is offered wherever a student uploads a file in the portfolio — the Transition Year “Saved for later” page, a reflection or diary, and the Life, Community and Work collect inbox — and everything below applies there too.
What this does and does not involve is worth stating plainly:
The route is off unless a school's own Microsoft administrator has allowed it, and a student who does not use it is not asked to sign in to anything.
| Purpose | Legal basis |
|---|---|
| Providing the core service — accounts, classes, assignments, submission, grading | Performance of a contract with the school (or with you, where we're the controller) — Article 6(1)(b) GDPR |
| Providing the Transition Year portfolio — reflections, goals, evidence, certificates and any credit records the school keeps | Performance of a contract with the school — Article 6(1)(b) — on the school's own basis for delivering the Transition Year programme |
| Letting a student download and keep their own copy of their portfolio | Compliance with the right to data portability — Article 20 — and performance of contract |
| Deleting a year group's portfolio data once the programme has ended | Legal obligation — the storage limitation principle, Article 5(1)(e) |
| Keeping the service secure (password hashing, authentication, abuse prevention) | Legitimate interests in running a secure service — Article 6(1)(f) |
| Telling you when we launch, and occasionally writing about what is new | Your consent — Article 6(1)(a) GDPR, and Regulation 13 of S.I. 336/2011 for electronic marketing. You gave it by filling in the form, and you can withdraw it from any email or by writing to us |
| Preparing and sending a quotation to a school that asked for one, and answering questions about it | Steps taken at your request before entering into a contract — Article 6(1)(b) GDPR. Asking what something costs is not marketing: a quotation request does not put you on our mailing list, and the sentence recorded against it says so |
| Counting visits to our public pages, so we know whether anyone is finding the site | Legitimate interests in knowing whether our own website works — Article 6(1)(f). The balancing test is short because the data is: nobody is identified, nothing is stored on your device, no third party receives it, and the records are deleted after 13 months |
| Responding to support queries | Legitimate interests / performance of contract |
| Complying with legal obligations (e.g. responding to a lawful request from the Data Protection Commission) | Legal obligation — Article 6(1)(c) |
A note on students and consent. Under Irish law, a person must be 16 or older to give their own valid consent to an "information society service." CourseworkHQ isn't used on that basis — students use it because their school has decided, as part of directing their education, that they will complete Leaving Cert coursework through it. That means the legal basis for processing a student's data is the school's own basis for delivering education (typically performance of its educational functions, not the student's individual consent), whether the school is the controller directly or has appointed us as processor under Section 1.
We don't sell personal data, and we never share it with anyone else for their advertising or marketing. The only marketing we do is our own, to people who asked us to on the form described in Section 2, and even then it goes no further than us and the email service that carries it. Data is shared only with the following — the same list, with a dated record of every change to it, is published at courseworkhq.ie/sub-processors.html:
If CourseworkHQ is ever acquired, merged, or its assets transferred, personal data may transfer as part of that deal — you'd be notified in advance if that changed how your data is handled.
Retention is tied to the class, not to a fixed time period. As long as a teacher keeps a class active in CourseworkHQ, everything associated with it — enrolments, submitted coursework, rubric scores, and feedback — remains available, since a student's coursework and feedback needs to stay accessible to them and their teacher, often well beyond the school year it was created in. When a teacher deletes a class, all of that class's data — its projects, assignments, student submissions, and feedback — is permanently and immediately deleted. This action cannot be undone.
Account data (your name, email address, and login details) is kept for as long as the account exists, independently of any individual class.
Deactivating an account is not the same as deleting it. An account can be deactivated — by the person themselves, or by their school — which stops it being used and takes it out of class lists, but keeps it, so it can be switched back on if it was deactivated by mistake or the person comes back. Reactivation is done by us at the school's request, by writing to admin@courseworkhq.ie. An account that has been deactivated, or simply not used, for 18 months is written to, and deleted a further 30 days later if nobody has signed in by then. An account under a legal hold survives that, in the same way the access log described in Section 2 does. We set a limit because an account nobody has opened in a year and a half is not a dormant account, it is a pile of a person's data with no reason to exist.
When an account is deleted, it is deleted. We delete an account at the request of the account holder or their school, and if a school stops using CourseworkHQ entirely we delete its accounts within a reasonable period. A teacher’s account can only be erased once it no longer holds anything belonging to somebody else — a class of students’ coursework, marks or comments written on another person’s work, a Transition Year year group, an LCW cohort. We tell you what is in the way and what has to happen first, and the 18-month rule above respects the same limit rather than forcing past it. Deleting a student's account also permanently removes their submitted coursework, the feedback and grades on it, their Transition Year portfolio, including anything they kept private, and their LCW portfolio, including entries they never submitted. Deleting a teacher's account removes their rubrics, saved comments and project templates. None of it can be undone, by the school or by us, so we ask people to export what they want to keep first.
One thing survives a deletion, deliberately: the internal access log described in Section 2 — the record of when one account viewed or changed another's data. The link to the deleted account is removed, but the entry stays — and every entry carries the email address of whoever performed the action, because a record that cannot say who did something is not a record. So a deleted person’s email address remains in the access log until the log’s own twelve-month limit removes it. That log is deleted after twelve months in any case. We keep it because it is the evidence behind our breach-response and data-rights processes, and it is the one record we are least entitled to lose. We may also keep account data longer where we are required to for a legal reason — for example, to defend a legal claim, or where a legal hold has been placed on a student's portfolio.
The Transition Year portfolio has its own, shorter lifecycle within that. Each year group is closed by the school's TY coordinator when the programme ends. Closing it makes the portfolio read-only, opens a download window of at least seven days — set by the coordinator, typically around sixty — during which every student is emailed and can download their own copy, and then lets the coordinator delete the year group permanently. Deletion removes every reflection, work experience diary, goal, self-rating, uploaded file, certificate and credit record for every student in that year group, and can't be undone by the school or by us. A coordinator can place a hold on an individual student's portfolio — for a child protection matter, an unresolved complaint, or an access request that's still open — and a portfolio under a hold survives deletion until the hold is lifted.
The Life, Community and Work portfolio runs on a longer clock than the Transition Year one, and on a different kind of clock. It is kept against the exam cohort — the group sitting the Leaving Certificate together — rather than against a school year, because the portfolio spans both years of the course and has to survive the move from fifth year into sixth. Nothing about it moves when a school year turns over: a class is linked to the cohort and the group carries forward. Closing a cohort cannot even begin until 1 December of the exam year, which is after the examination and after the period in which results can be appealed; from that point it follows the same path as a Transition Year group — read-only, a download window in which each student can take their own copy, and then permanent deletion by the lead teacher. As in Transition Year, a hold can be placed on an individual student's portfolio and it survives deletion until the hold is lifted.
The count of visits to our public pages is kept for 13 months and then deleted automatically — thirteen rather than twelve so that one September can be compared with the one before it. Nobody is identified in it, so there is nothing in it to ask us for or to correct.
Demo requests and the mailing list are kept on a different clock, because they are not tied to a class or a school. We keep your details until you unsubscribe or ask us to delete them, and in any case a row with no contact either way for two years is deleted automatically overnight. A record that you unsubscribed is kept rather than deleted on that timer, because it is the only thing that stops us writing to you again by accident; ask us and that goes too. Unsubscribing stops the emails immediately; we keep a record that you unsubscribed, because that is the only way to be sure we do not write to you again by accident. Ask us and that goes too.
This part of the service works differently from the rest, because it asks students to write about themselves rather than about a subject. There's a plain-language version of this section written for students.
Every reflection a student writes is private to them unless they choose otherwise. Sharing is per reflection, not a single setting, and it's reversible: a student can take back a reflection they shared, and their teachers lose access to it immediately. A student's goals, their checkpoint reviews and their self-ratings are their own working-out, and their subject teachers cannot read them. The staff who run a year group can read a student's goals and the reviews written against them. Until 1 September 2026 they could not, and this policy said so; it was changed deliberately, so that a coordinator can see what a student is working towards and how it is going rather than only how often they logged in. It is still narrow: only the coordinator and the core group they name, only on that student's page, never in a report or an export, never marked or scored, and always written to the access log. Self-ratings are not included — the number a student puts on their own progress at each checkpoint stays private to them.
A student’s own subject teachers see nothing of the portfolio, even where that subject earns credits. The people who can see a year group are its TY coordinator and a core group of colleagues at the same school whom the coordinator adds, or who join with a link the coordinator sends — which only works for a teacher account at that school — who need not teach the student. A colleague added by name sees what the coordinator sees, and can also enter credits and pull reports, but cannot set the year up, close it or change who else is in the group. A colleague who joined with the link is view-only: they can open the list of students and read what students have published — reflections, finished work experience diaries and goals — and nothing else: no credits, no reports, no settings. Neither can see a reflection a student has kept private or has not marked finished, and both can see how much work a student has done — so that a student who writes honestly and privately is never mistaken for one who has done nothing.
Photographs and voice recordings are switched off for a year group unless the school's TY coordinator turns them on. Turning them on is the coordinator stating that the school's own photo-consent position covers students adding photographs and recordings to their portfolios. We can't create that consent and don't attempt to: the school holds the relationship with students and parents, and is the only party that knows what its consent covers. Text notes and documents work either way.
Where a school uses the credit scheme, figures counted automatically are counted from what a student did — how many reflections they completed, how many indicators they evidenced, whether they reviewed their goals — and never from the content or perceived quality of anything they wrote. Any counted figure can be overridden by a teacher, who must record a reason, and the reason is shown wherever the figure is. Where a school converts a hand-filled line into a counted one, the figures already entered are marked as having been entered by hand before the change, rather than appearing as unexplained overrides. A student sees their own credit total only if their coordinator has turned that on, which is off by default.
A student can download their whole portfolio at any time, as a web page they can open on any computer together with their own photographs, recordings and files. It includes the reflections they kept private. The privacy choice a student makes is about who at school can read something; it has never been about whether the work is theirs.
CourseworkHQ's database and file storage are hosted with Render, in Render's Frankfurt, Germany region. Your data is stored inside the EU/EEA, and no international transfer outside the EU/EEA takes place in the ordinary course of providing the service.
Passwords are never stored in plain text — they're hashed using bcrypt before being saved. Access to the application is authenticated using signed, time-limited tokens: a student is signed out after two hours of not using the service, a teacher after thirty days, and every session ends ninety days after it began however active it has been. Every staff account is protected by a second factor — a six-digit code emailed when signing in on a device not used before. It is not optional and there is no setting to turn it off, because a teacher account opens a year group of children’s work; a school does not have to require it or check that its staff have switched it on. Students are not asked for one. Anyone, staff or student, can end every other session on their account at any time from their account settings, and changing a password does the same. The site is served over HTTPS. Administrative (teacher/admin) actions are checked against your account role on every request, not just hidden in the interface. We keep an internal log of when one person's account views or changes another person's data (for example, a teacher opening a student's submission), so that any misuse of access can be investigated. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable, industry-standard steps to protect your data and will notify affected users and, where required, the Data Protection Commission without undue delay if we become aware of a personal data breach affecting you.
Under GDPR, you have the right to:
How to ask, and how long we take. Write to privacy@courseworkhq.ie from the address on your account. We acknowledge a request within 5 working days and answer it in full within one month, which is the period the GDPR allows; in practice a teacher asking for a copy of their own account data is usually answered the same week, because producing it takes us a few seconds. If a request is complex enough to need longer, we will tell you inside that month, say why, and give you a date.
A student does not need to ask anybody for their own work: the whole portfolio — reflections, goals, uploaded files, photographs and recordings, including the reflections kept private — downloads from the portfolio page at any time, as a web page that opens on any computer.
If your school is the data controller, the quickest route is usually to ask your school directly, since they hold the primary relationship with you — but you're welcome to contact us and we'll either action it (if we're the controller) or pass it to your school promptly (if we're the processor).
Many CourseworkHQ users are secondary school students, some of whom are under 18. We collect no more data from students than is needed to deliver the coursework and feedback the school has asked us to support, we don't use student data for advertising or profiling, and access to a student's coursework is limited to the teachers of the classes they are in, and to themselves. The Transition Year portfolio works differently and Section 6 sets out exactly who can see what. Section 3 explains the legal basis for processing student data in more detail.
The Transition Year portfolio raises this further than the rest of the service does, because it invites students to write about themselves rather than about a subject. Three things follow, and they're built into how the product works rather than being promises about how we behave: a reflection is private until its author decides otherwise; nothing a student writes is scored, analysed or profiled by us; and a school can't keep a portfolio indefinitely — it's deleted when the coordinator closes the year group, and students are given a window and a reminder to take their own copy first. Students also have their own version of this policy, written to be read by the people it's about.
See our separate Cookie Policy.
We'll update this page if what we collect or how we use it changes, and update the "last updated" date at the top.
For material changes to how student data is collected or used, we'll give your school 30 days' written notice before they take effect, and a choice. A school that objects can end its agreement and take its data out, without penalty and with a refund of anything paid for the unexpired part of the term. We make that promise because it is the answer to the question every school ought to ask a small supplier — what stops you changing the deal once we have four hundred students in here — and "we'll make reasonable efforts to notify you", which is what this section used to say, is not an answer to it.
For any question about this policy or your data: privacy@courseworkhq.ie.