Data Subject Rights

Data Subject Rights
and Support Process.

How to submit a request, how Pocket Debate will handle it, and what to expect.

Published June 2026Controller Pocket Debate Ltd.
00

Overview.

A plain-English summary. Each row links to the relevant section for full detail.

Who can submitStudents, school staff, administrators, parents, guardians, and any individual whose personal data Pocket Debate processes.01
How to submitEmail contact@pocketdebate.com. No required form or legal language. Any channel is valid.02
What we holdAccount data, debate transcripts, AI feedback, ELO records, usage logs, communications. Audio is not held — deleted immediately on transcription.03
Identity checksProportionate verification before any data is disclosed or actioned. School email confirmation is generally sufficient for active users.04
Response deadline30 calendar days from receipt. Clock may pause for identity verification or clarification. Extensions of up to 2 further months for complex requests.05
Access responseYour personal data plus the Article 15 UK/EU GDPR supplementary information, in a commonly used electronic format.06
RedactionOther students' speech in transcripts will be redacted. Information subject to legal exemptions may be withheld with explanation.07
RefusalsWe will comply with all valid requests. Any refusal or limitation will be explained in writing, with details of your right to escalate.08
ComplaintsStatutory right to raise a data protection complaint directly with Pocket Debate. Acknowledged within 30 calendar days.09
EscalationYou may escalate to the ICO (UK), AEPD (Spain), or your local EEA authority at any time without exhausting internal channels first.10
01

Who This Document Is For.

This document explains how Pocket Debate handles data subject rights requests and data protection complaints from students, school staff, school administrators, parents and guardians, and any other individual whose personal data we process. It covers how to submit a request, how we handle it, and what to expect in response.

For a full description of your rights and the data we collect and how we use it, please refer to our Privacy Policy. This document is the operational companion to that policy.

02

How to Submit a Request or Complaint.

Contact us at contact@pocketdebate.com. There is no required form or phrasing; a request is valid if it is clear you are asking about your personal data, regardless of channel, language, or whether you reference GDPR or data protection law. You can submit by email, in writing, verbally, or via social media; for social media we will ask you to continue by email to keep communications secure.

For requests relating to student data, schools should contact us directly as they are the data owners for student personal data. Students and parents may also contact us directly.

We will acknowledge your request within 5 working days and respond in full within 30 calendar days. See Section 05 for more on timelines.
03

What Data We Hold and How to Access It.

When we receive an access request we conduct a reasonable and proportionate search of the systems most likely to hold your data. We will tell you which systems we searched and, where anything was excluded, why. The following data categories are held and can be provided on request.

·

Account data

Name, school email, year group, role, Microsoft account identifier.

Format: CSV

·

Debate transcripts

Text of spoken debate content, held for 7 days from session date.

Format: CSV or JSON

·

AI-generated feedback and verdicts

Arbiter AI scores and written feedback, held for the subscription duration.

Format: CSV or JSON

·

ELO rankings and tournament history

Held for the subscription duration.

Format: CSV

·

Device and usage logs

IP address, session duration, feature interactions, error logs, held for 90 days.

Format: CSV

·

Communications

Emails and support correspondence, held for 3 years from last contact.

Format: PDF or plain text

Audio data is not held. Audio is deleted immediately on transcription completion and is not stored by Pocket Debate or by Groq under Zero Data Retention. There is nothing to retrieve.

Your access response will include your personal data and the supplementary information required by Article 15 UK/EU GDPR. See Section 06 for the full breakdown.

04

Identity Verification.

We will verify your identity before disclosing or actioning any personal data, applying proportionate checks.

·

Active platform users

Confirmation of the school email address associated with your account is generally sufficient. We will not request government-issued ID from users already authenticated through your school's Microsoft system.

·

Parents and guardians

Acting on behalf of a student, we will confirm the relationship through the relevant school.

·

Third parties with authority

For example a solicitor — we will ask for written authority signed by the data subject.

·

Unconfirmed identity

Where identity cannot be confirmed from the outset, the response clock does not begin until verification is complete.

05

Timelines.

The standard deadline is 30 calendar days from the date of receipt. The clock starts when any member of the Pocket Debate team receives your request, regardless of channel.

Standard deadline
30 calendar days from the date of receipt by any team member, by any channel.
Clock pause — identity
Where we need to verify your identity and were not able to do so from the outset, the clock pauses until verification is complete.
Clock pause — clarification
Where clarification is genuinely needed to understand the scope of your request. Both pause mechanisms are on a statutory footing under the Data (Use and Access) Act 2025.
Extension
For complex requests, we may extend the deadline by up to a further two months. We will notify you within the original 30-day period with a revised date, which will be no more than 3 months from receipt.
06

What an Access Response Includes.

Every access response includes your personal data in a commonly used electronic format and the supplementary information required by Article 15 UK/EU GDPR. The table below sets out each required item and the specific answer for Pocket Debate.

Required Item (Article 15 UK/EU GDPR)Pocket Debate Answer
Processing purposesPlatform delivery, AI adjudication and feedback, school reporting, content moderation, security, and legal compliance. See Privacy Policy Section 03.
Categories of personal dataAccount data, debate transcripts, AI feedback and ELO records, device and usage logs, authentication data. See Privacy Policy Section 02.
Named recipientsAmazon Web Services (EU regions eu-west-3 and eu-central-1) and Groq Inc. (US, under EU Standard Contractual Clauses and Zero Data Retention). Anthropic is accessed via AWS Bedrock EU; no identifiable data passes to Anthropic. No other recipients.
Retention periodsAudio: deleted immediately. Transcripts: 7 days. AI feedback: subscription duration. Account data: subscription plus 12 months. Usage logs: 90 days. Communications: 3 years. See Privacy Policy Section 07.
Other rights availableSee Privacy Policy Section 08.
Right to complain to the controllerStatutory requirement under the Data (Use and Access) Act 2025. Contact: contact@pocketdebate.com.
Source of data not collected directlyName, school email, and Microsoft account ID are received from Microsoft Entra ID at authentication. All other data is collected directly from the user during platform use.
Automated decision-makingArbiter AI generates formative scores and feedback evaluating argument structure, delivery, and rebuttals against WSDC and BP rubrics. No automated output produces legal, disciplinary, or otherwise significant effects without human review. Teachers and administrators retain override authority at all times. See Privacy Policy Section 09.
International transfer safeguardsThe sole transfer outside the EEA is audio to Groq Inc. (US) for transcription, under EU Standard Contractual Clauses (Module 2) and the UK IDTA. Zero Data Retention ensures audio is not stored beyond the API call. See Privacy Policy Section 06.
07

Redaction and Exemptions.

Some information may be redacted or withheld. The most common case at Pocket Debate is debate transcripts: a transcript contains the spoken contributions of multiple students, and only your own contributions will be provided. Other students' speech will be redacted unless those students have consented to disclosure.

Other information may be withheld where a legal exemption applies, for example where it is protected by legal professional privilege. Where anything is withheld, we will tell you what has been withheld, the specific exemption relied upon, and your right to challenge the decision.

08

Partial and Full Refusals.

We will comply with all valid requests. Where we are unable to comply fully or at all, we will provide in writing:

·

Reason for refusal

The specific reason for the refusal or for withholding information.

·

Internal complaint right

Your right to raise a complaint with Pocket Debate at contact@pocketdebate.com.

·

Supervisory authority

Your right to complain to the Information Commissioner's Office (UK) or the Agencia Española de Protección de Datos (Spain).

·

Judicial remedy

Your right to seek a judicial remedy through the courts.

We may refuse a request, or charge a reasonable fee before complying, if it is manifestly unfounded or manifestly excessive. We assess each request individually and will explain our reasoning.
09

Data Protection Complaints.

If you believe Pocket Debate has infringed data protection law in the way it has handled your personal data, you have the right to raise a complaint directly with us. This is a statutory right under the Data (Use and Access) Act 2025. No formal language is required and you do not need to have submitted a prior request.

You are not required to use this procedure before complaining to the ICO or seeking a judicial remedy; however, raising concerns with us first allows us to address issues quickly.

StageActionsDeadline
ReceiptAny allegation that Pocket Debate has infringed data protection law in the handling of personal data is a complaint. No specific wording or format is required and any channel is valid.Day 0
AcknowledgementAcknowledge in writing. Confirm the complaint is being investigated, that the requester will receive an outcome without undue delay, and state their right to escalate to the ICO if dissatisfied.Within 30 calendar days (statutory)
TriageDistinguish between: a data protection complaint (allegation of infringement, handle under this procedure); a DSAR embedded in the complaint (run the DSAR process in parallel); and a general support enquiry (handle through normal channels). A complaint and a DSAR can run simultaneously.Within 5 working days
InvestigationInvestigate the substance of the complaint. For DSAR-related complaints, review the original request log and DSAR Register entry. Keep the complainant informed of progress.Without undue delay
OutcomeCommunicate the outcome in plain language. Include what was found, any remedial action taken, the right to escalate to the ICO or AEPD, and the right to seek a judicial remedy.Target within 3 months
Log and closeLog the complaint in the DSAR Register under a separate complaint reference. Record: reference number, date received, channel, nature of complaint, date acknowledged, investigation summary, outcome, and date of outcome. Retain minimum 3 years.On date outcome communicated
10

Escalation to Supervisory Authorities.

If you are not satisfied with our response to a request or complaint, you have the right to escalate or to seek a judicial remedy at any time, without needing to exhaust internal channels first.

United Kingdom — Information Commissioner's Office at ico.org.uk

Spain — Agencia Española de Protección de Datos at aepd.es

Other EEA jurisdictions — The data protection authority in your country of residence or place of work.

11

Internal Handling and Export Process.

The following table documents how Pocket Debate handles every request internally, including the export and secure delivery of personal data. It is included for transparency and for the benefit of institutional partners and data protection officers reviewing this document for procurement or compliance purposes.

StageActionsDeadline
ReceiptLog in DSAR Register immediately. The clock starts on the date of receipt by any team member, by any channel. Route to contact@pocketdebate.com the same day if received elsewhere.Day 0
AcknowledgementConfirm receipt in writing. State the response deadline, that identity verification may be required, and include the Privacy Policy link. Include the requester's right to complain to Pocket Debate if dissatisfied.Within 5 working days
Identity verificationConfirm identity before disclosing or actioning any data. Verification must be proportionate; do not demand excessive documents from users already authenticated via Microsoft SSO. For parents or guardians, confirm the relationship through the school. Clock does not start where identity was in doubt at receipt.Before data is disclosed
Scope clarificationIf the request is genuinely unclear and clarification is reasonably necessary, seek it promptly. The clock pauses until clarification is received and resumes immediately (statutory under the Data (Use and Access) Act 2025). Document the decision; do not use as a delay tactic.Seek immediately
School notificationFor student data requests, notify the relevant school administrator. Schools are the data owners for student personal data. Coordinate the response with the school.Within 5 working days
Data retrievalConduct a reasonable and proportionate search of the systems most likely to hold the relevant data (statutory standard under the Data (Use and Access) Act 2025). Document which systems were searched, search terms used, results found, and which systems were excluded and why. Systems covered: RDS database (account data, debate transcripts, AI feedback, ELO records); communications; usage logs within the 90-day retention window. Audio: not held.Complete by Day 20
Review and redactionRedact third-party personal data unless consent is obtained or disclosure is otherwise reasonable. Apply DPA 2018 Schedule 2 exemptions where applicable, with specific statutory reference and documented reasoning. Exemptions may apply to both personal data and supplementary information.By Day 25
Export and deliveryGenerate the data export in CSV or JSON from the platform database. Package related files into a clearly labelled set. Deliver securely via an encrypted, password-protected archive or a time-limited secure file link. Do not send personal data as a plain email attachment. Confirm receipt with the requester. Include the Article 15 supplementary information summary alongside the export.Within 30 calendar days
Log and closeUpdate DSAR Register with outcome, response date, exemptions applied, delivery method, and delivery confirmation. Retain for minimum 3 years.On date of response
Staff who receive a request or complaint through any channel route it to contact@pocketdebate.com the same day. Every request is logged in the DSAR Register from receipt to closure, with entries retained for a minimum of three years. The register is available to institutional partners on request.
A

Optional Request Scoping Form.

Not required. Completing it helps us locate and provide the right data more quickly. Return to contact@pocketdebate.com, or simply describe your request in plain language in an email. Your request is valid without this form.

Full name
Email used on Pocket Debate
School or institution
Role
Student / teacher / administrator / parent / guardian
If acting on behalf of another person
Name of data subject and your relationship to them.
Type of request
Access · Rectification · Erasure · Restriction · Portability · Objection · Human review of AI decision · Data protection complaint · Other
Scope (optional)
Specific data or system, date range, preferred format (CSV / JSON / Either).

This document was published in June 2026.

For the full Privacy Policy see pocketdebate.com/privacy.