What we process

For Google Workspace and Google Classroom integrations, Elemental acts as a Data Processor under UK GDPR Article 28 for the following data from those systems:

• User profiles (student and teacher email addresses, first names and last names)
• Class rosters (class names and identifiers, teacher identifiers and student identifiers)
• Assignments (identifiers and statuses)

Our commitments on where Student Data is stored, how quickly we notify you of a breach, and how deletion and data subject requests are handled are set out in full in the Data Processing Agreement.

Permissions we request

These scopes and their associated permissions are defined and described by Google and are documented at https://developers.google.com/identity/protocols/oauth2/scopes.

Setting up

Prerequisites

• Google Workspace and Google Classroom
• Whitelisting of https://elementalmusic.app, https://*.elementalmusic.app and https://cognito-idp.eu-west-2.amazonaws.com (https://auth.elementalmusic.app and https://media.elementalmusic.app should explicit subdomains be required) in any firewalls or network / device policies
• Whitelisting of *@elementalmusic.app (support@elementalmusic.app should explicit email addresses be required) in any email spam policies

Signing in

Teachers and students sign in at elementalmusic.app/sign-in using the Sign in with Google button.

Elemental links users to a school account based on their email domain. If your school uses multiple email domains (for example @school.org and @students.school.org), contact us so we can add them to your account. New users are set up with Student permissions and have no access to other students' data. An administrator can grant Teacher or Admin permissions from the Department page.

Step-by-step guides, with short videos, are available for both signing in and creating an account:

• Signing in with Google
• Creating a Google Account

Granting the required permissions

A Google administrator is prompted to grant the permissions listed above the first time a teacher visits either of the Classes & Students or Manage Homework pages. No separate administrator link is needed.

If the prompt has not reached an administrator, or you want to grant access ahead of time or to specific organisational units (OUs), the permissions can be granted directly. Open Security › Access and data control › API controls › App access control in the Google Admin console, then:

1. Locate Elemental in the Configured apps list, shown as a Verified third-party web app.
2. Hover over the Access column on the Elemental row and select the Change access button that appears.
3. On the Scope step, choose Elemental (all users) to grant access for your whole organisation, or Select org units to grant it to the organisational units your staff and students belong to.
4. On the Access to Google data step, select Specific Google data. This is the most secure option, and the one we recommend, because it grants Elemental only the scopes it needs. Confirm Classroom shows 5 scopes and Google sign-in shows 3, so all 8 scopes are granted, then continue to the Review step and finish.

If any of the 8 scopes are missing under Specific Google data, select Update Google services or scopes, then Add more OAuth scopes, and add the missing scopes from the list below one at a time:

Checking it worked

Once permissions are granted, confirm that teachers can open the Classes & Students page and that the expected classes are listed. If too many classes appear, you can hide the ones you do not need.

To check the grant itself, open Security › Access and data control › API controls › App access control in the Google Admin console and confirm each of the following:

1. Elemental is listed with the correct App ID, marked Verified, and both Google sign-in and Classroom show all scopes granted (3 of 3 and 5 of 5 respectively).
2. Selecting either Scopes granted by users row lists each scope with the status Access granted.
3. Under Access to Google data, the status is Specific Google data with all eight permissions granted. We recommend Specific Google data because it grants Elemental only the scopes it needs.

A common cause of problems is the setting being correct for your whole organisation but different for the organisational unit (OU) your staff and students are in. An OU inherits its parent's app access setting until a policy is applied to that OU directly, and once one is, it stays in effect even if you later change the setting for the whole organisation. Use the org unit selector on this page to check the OU your users actually belong to; the status reads Overridden where an OU has its own policy.

To see the workflow teachers and students follow once connected, from assigning homework through to marks being returned to Google Classroom, read our Sharing Homework and Marks with Google Classroom help article.

Data Protection Impact Assessments (DPIAs)

We are happy to support the completion of a Data Protection Impact Assessment (DPIA), including any security questionnaires. Our DPIA information pack and a blank template are on the Documents page, and you can reach us at privacy@elementalmusic.app.