My DC use TT Rockstars for school and when logging into their accounts it's possible to see the full names of all of the children in the school. Is this allowed under GDPR legislation?