Education
EU

Lumora Learning

Online K-12 tutoring platform with 1.2M students across the EU, processing minors' data and special category data (educational records).

Systems
  • Customer-facing web app
  • Internal tutor matching tooling
  • Postgres + analytics warehouse
  • Live classroom video (third-party)
Regulatory exposure
  • GDPR (special category data — children)
  • ePrivacy
  • National education-data regimes
Relevant frameworks
  • GDPR
  • ISO 27001
  • SOC 2
Top risks
  • Minor data profiling
  • Video vendor breach exposure
  • Profiling bias under AI recommendations
  • Cross-border data transfer
Control priorities
  • Lawful basis per processing
  • Data minimisation in AI recommendations
  • Vendor DPIAs
  • Parental consent flows
Audit concerns
  • Records of processing activities (Art. 30)
  • DPIAs for AI features
  • Sub-processor list completeness
Your task
Plan the privacy program uplift before launching the new AI-recommendation feature. Produce the DPIA outline, the data-minimisation argument, and the parental-consent UX changes required.
Vendor risk
Live classroom and AI-evaluation vendors are the long pole; both process minors' data.
BCP/DR
Vendor-managed failover for live video; database backup cadence quarterly.