Data protection impact assessment (DPIA): draft

Tool: Rostrum Supplier: MLN Learning LLC (Virginia, USA)
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-03). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	lesson planning / AI-generated learning modules
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: no - a content tool for adults (educators and creators); learners can work through modules and mastery checks without an account, with progress kept in the browser [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	processor (service provider) for any education records an institution chooses to enter (institution is controller); not stated for teacher account data
Where data is stored	not stated - US operator; sub-processors Anthropic (prompts only, no account identifiers), Vercel and Vercel Postgres, Stripe, Resend, PDFShift; storage region and UK transfer safeguards not stated
Trains AI on inputs	no - says it never trains models on your data
How long inputs are kept	generated modules kept while the account is active; server logs about 30 days; modules and personal data removed within 30 days of account deletion
Data processing agreement	on request for schools and districts (contact form, topic: Partnerships) Signs individual DPAs: yes - DPA available on request for schools and districts
Supplier DPO / UK representative	not stated (privacy@contact.rostrum.site)
Minimum age	18+ - terms describe it as a tool for adults; not directed at under-13s; no child accounts
Other safety notes	not SOC 2 certified; no org accounts, roles or SSO; US law (Virginia) governs the terms and the privacy page is written for US schools (FERPA, COPPA); output may be inaccurate and must be reviewed; sister site of EduConnect
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Amber, pupils Red.

Risk	Suggested measure	Likelihood / severity	Residual risk
Data may be stored outside the UK/EU (Not stated)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: 18+ - terms describe it as a tool for adults; not directed at under-13s; no child accounts	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://www.rostrum.site/privacy
https://www.rostrum.site/terms
https://www.rostrum.site/