Sub-processors
The third parties we engage to deliver Coding Pathway. All stored data is hosted in the EEA, and the only sub-processor to which we send personal data outside the UK/EEA is the optional AI provider, which a school can switch off. We notify schools of material changes with an opportunity to object. See also our security overview.
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services | Cloud hosting, database, email delivery, secrets and logs — the core infrastructure. | All personal data the platform stores (accounts, learning records, student work, email content). | EEA — eu-north-1, Stockholm | Within EEA (UK adequacy); AWS GDPR DPA + SCCs. |
| OpenAI | Optional, staff-facing AI authoring aids. Disable-able per school. Students never interact with AI. | Task content and the student's own work (code/text). No names, emails or account identifiers. | US | Signed OpenAI DPA — UK Addendum to the EU SCCs (s.119A(1) DPA 2018). Not used to train models. |
| Stripe | Payment processing for school billing only. | School/finance contact and payment details. No student data. | Ireland / UK (Stripe group) | Contracted via Stripe's EU/UK entities; any non-UK/EEA group processing under Stripe's DPA (SCCs + UK Addendum). No student data. |
Sign-in (identity providers)
Users sign in with their school's or their own Google or Microsoft account. Those identity providers authenticate the user and return basic profile claims (name, email, account identifier) to Coding Pathway. They operate under the school's or user's own agreement with Google/Microsoft — they are not sub-processors engaged by Coding Pathway; we receive verified sign-in data rather than sending personal data out to them. We never store passwords for accounts that use single sign-on.
Last updated 5 July 2026. Coding Pathway is operated by Coding Pathway Ltd (registered in England and Wales, company number 17313032). Questions: schools@codingpathway.co.uk.