UK school schedule · version 2026-08-21
School data processing
1. Parties and roles
The School is the controller for learner and school-directed teacher information. Benjamin Bowler, trading as Literacy Guide, is the processor for the core service when acting only on the School’s documented instructions. Each party remains responsible for any processing for which it independently determines purpose and means.
2. Subject matter and duration
Processing is limited to providing and securing the early-literacy platform, supporting classroom use, storing progress and evidence, producing school reports, fulfilling rights/deletion instructions and returning or deleting data. It lasts for the agreed beta period and the limited deletion, backup, security and legal-record periods that follow.
3. People and information
- People: pupils (normally ages 4–7), teachers, reading specialists, school administrators and authorised support contacts.
- Teacher data: email, name/display name, school, role, classes, account/security and service activity.
- Pupil data: first/chosen name, class, picture credential material, accessibility/support settings, answers, reading and assessment evidence, progress, reports, interventions and reward state.
- Potential special-category data: only where a school-selected accessibility/support setting reveals health or SEND information. Free-form health and safeguarding data is prohibited.
4. Documented instructions
The School instructs Literacy Guide to process the listed data only to provide the configured service, apply the School’s retention/deletion choices, support rights requests, protect the service, and meet applicable law. If an instruction appears unlawful, Literacy Guide will inform the School unless prohibited by law and may pause the affected processing.
5. Processor commitments
- Process personal data only on documented instructions or as legally required.
- Ensure authorised people are bound by confidentiality.
- Use proportionate technical and organisational security, including scoped access, row-level security, server-validated learner sessions, encrypted transport, restricted logs, backups and recovery procedures.
- Assist the School with access, correction, erasure, restriction, objection, portability and child-appropriate communication, taking account of the nature of processing.
- Assist with security, breach assessment, DPIAs and regulator consultation using available information.
- Notify the School without undue delay after becoming aware of a personal-data breach affecting School data and provide available facts needed for the School’s assessment.
- Return or delete School data at the end of service unless law requires retention, and provide available deletion-propagation evidence.
- Keep records needed to demonstrate these obligations and make reasonable audit information available without exposing other customers or weakening security.
6. Subprocessors and locations
| Provider | Function | Current known position |
|---|---|---|
| Supabase | Authentication, database, functions, backups and platform support | Production project in Sydney, Australia (ap-southeast-2). Provider entity, executed DPA and UK transfer safeguard must be recorded for the School. |
| Vercel | Web hosting, global content delivery and request/security logs | Global network; published DPA states US primary processing. Account plan/DPA applicability, subprocessors, log settings and UK transfer safeguard must be recorded. |
The School gives general authorisation only after receiving this verified register. Material new subprocessors require notice and a reasonable opportunity to object on data-protection grounds. Authoring tools are not subprocessors for School data and must never receive it.
7. International transfers
The parties must identify restricted transfers and document an applicable UK adequacy regulation or appropriate safeguard, plus the current ICO data-protection test and any supplementary measures, before UK learner data is transferred. Provider-published standard clauses do not replace confirming that they bind the actual account and processing chain.
8. Retention and end of service
The School selects a permitted policy. Current defaults are 365 days to inactivity, 90 days from archive to learner deletion, 30 days for provider-deletion evidence and 35 days for backup-expiry evidence. The School may instruct earlier active-record deletion through the verified workflow. Security/legal evidence is separated and retained only as necessary.
9. School commitments
The School will document its lawful basis and any Article 9/DPA 2018 condition, provide required notices, verify authorised users, complete any required DPIA/Children’s Code and safeguarding assessments, configure appropriate retention, avoid unnecessary data, handle frontline rights requests and tell Literacy Guide promptly about access changes or suspected incidents.
10. Agreement details to complete
Before this schedule becomes binding, the written agreement must name the School/controller, its address and DPO/privacy contact; name the processor and geographic service address; state the start/end date; identify the approved provider contract and transfer mechanism; and record any School-specific instructions. Contact benjamesbowler@gmail.com to complete it.