Data protection for universities

Version 1.3, 7 October 2026

This page explains how personal data is handled when a university or other institution (“the Institution”) takes out a JEKrayPro University Licence, and forms part of that agreement. It is written for the Institution’s data protection, information security and procurement teams. How we handle each person’s data in general is set out in our Privacy Policy.

1. Who is responsible for what

• Each person’s account. Staff and students sign in to JEKrayPro themselves, with Google or Microsoft, under our Privacy Policy, and the account and its benches are theirs. JEK Systems is the controller of that data. The Institution does not decide how it is used, and we do not process it on the Institution’s behalf.
• What the Institution gives us. Its email domains, Microsoft tenant identifiers and organisation identifiers (not personal data), and the names and work email addresses of its contacts for the licence and for invoices. We use these only to run the licence and to invoice, as a controller.
• What the Institution receives from us. The number of people who used JEKrayPro through the licence in each month. These are counts only. We do not tell the Institution who its users are, or anything about their benches.
• Licence administrators. People the Institution names look after the licence in JEKray: they see the monthly counts, can invite people who have no qualifying address, and can take people off, each by email address. We use an address they give us only to include or exclude that person, and each of us is a separate controller for that sharing. Taking someone off gives the same answer whether or not that person has an account, so it never tells the Institution who uses JEKray.

Because we do not process personal data on the Institution’s instructions, the licence does not by itself make us the Institution’s processor. If the Institution later uses features that let it manage named users, or otherwise asks us to process personal data for it, the processor terms in section 7 apply to that processing.

2. What we hold about the Institution’s people

For each person covered by the licence, in addition to what our Privacy Policy describes for every account:

• that the licence covers them, and how: their email domain (of the address they sign in with, or of an Institution address they confirm by a code we email to it), the Institution’s Microsoft tenant, or an invitation from its licence administrators;
• the months in which they used JEKrayPro through the licence.

We do not receive data from the Institution’s own systems. When someone signs in with their Institution Microsoft account, Microsoft tells us only who they are (as above); we read nothing else from the Institution’s directory.

3. Providers who handle the data

Google and Microsoft confirm who a person is when they sign in with them, under their own privacy policies. They are not our processors.

Transfers outside the UK. Some of these providers process data in the United States and elsewhere. Where they do, the transfer is protected by UK adequacy regulations (including the UK extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, under each provider’s data processing agreement with us.

4. Security

Our technical and organisational measures are described in the Security overview. In short: sign-in through Google or Microsoft with no passwords held by us; sessions in secure, HttpOnly cookies whose tokens are stored only as hashes; every request checked against the person’s workspace and role; encryption in transit and at rest; version history, a 30-day bin and database recovery.

5. Keeping and deleting data

• Accounts and benches are kept while the person has an account. Anyone can export everything and delete their account at any time from the account menu; their personal workspace and benches are then deleted at once.
• When the licence ends, people keep their accounts and can open and export their benches; they decide whether to keep or delete them.
• Monthly usage records are kept for the life of the licence and six years afterwards, as the basis of what the Institution was invoiced. When an account is deleted, its usage records are no longer linked to any name or email address.
• Invoices and payment records are kept for six years, as UK tax law requires.

6. Incidents and requests

• If a personal data breach affects people covered by the licence, we will tell the Institution’s contact without undue delay, and aim to do so within 48 hours of becoming aware of it. We notify the Information Commissioner’s Office where the law requires.
• People can exercise their data protection rights directly with us at [email protected]. If the Institution receives a request about JEKrayPro, we will help it respond.
• We will answer the Institution’s reasonable security and data protection questionnaires, and provide the information it needs for its own records or impact assessments.

7. Processor terms (where they apply)

Where we process personal data on the Institution’s behalf (section 1), we will, as Article 28 of the UK GDPR requires:

1. process it only on the Institution’s documented instructions, which are this agreement and its use of the service, unless the law requires otherwise (in which case we will tell the Institution first unless the law forbids it);
2. ensure that anyone authorised to process it is bound to confidentiality;
3. take the security measures in the Security overview;
4. use only the providers listed in section 3, under written terms giving the same protection, and give the Institution 30 days’ notice of a new one, during which it may object; if we cannot address the objection, the Institution may end the licence and receive a refund for the unused part of the Licence Period;
5. help the Institution respond to requests from individuals, and meet its obligations on security, breach notification, impact assessments and consultation with the ICO, taking into account the nature of the processing;
6. at the end of the licence, delete or return the data as the Institution chooses, unless the law requires us to keep it;
7. make available the information needed to show that we meet these obligations, and allow and contribute to audits, normally by answering written questions and providing documents;
8. tell the Institution if we think an instruction infringes data protection law.

Subject matter and duration: providing JEKrayPro for the Licence Period. Nature and purpose: storing and serving users’ accounts and benches and managing who the licence covers. Types of data: names, email addresses, account and usage records, and the benches users save. Data subjects: the Institution’s staff, students and others it includes.

Contact

Data protection questions: [email protected]. University licences: [email protected].