Privacy Contact
Last updated: June 2026
GradeOrbit is operated by George Burgess (sole trader, trading as GradeOrbit), the Data Controller for account data and the Data Processor for student work submitted by schools. There is a single point of contact for all privacy matters.
48-hour response SLA
We acknowledge every privacy-related email within 48 hours (Monday to Friday). Where a request requires investigation, the acknowledgement will include an expected resolution date and the statutory deadline (typically one calendar month for DSARs under UK GDPR Article 12).
What to email about
Data Subject Access Requests (DSARs)
Requests from teachers, school staff, pupils, or parents/guardians for a copy of personal data we hold. Please include the account email address and, where relevant, the school name.
Data deletion and erasure requests
Requests to delete an account, remove specific records, or exercise the right to erasure under UK GDPR Article 17. School administrators can also use the in-app account-removal flow, which removes all personal data on completion.
Suspected security or data breach reports
If you believe you have found a vulnerability or have evidence of unauthorised access, please email us with the subject line[SECURITY] so we can triage it on the same business day.
Related documents
- Transparency Pack — DPIA summary, AI safety, security posture
- Sub-processors — third parties we share data with
- Privacy Policy — full statement on data processing
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) at any time.