Data Processing Agreement

This Data Processing Agreement forms part of the terms under which SchoolBudi provides its services to schools.

For the purposes of UK GDPR, the school is the Data Controller and SchoolBudi is the Data Processor in relation to personal data entered into the SchoolBudi platform by or on behalf of the school.

SchoolBudi processes personal data only to provide the daily check-in, classroom management, analytics, and related wellbeing services described on our website and agreed with the school.

The categories of personal data processed include pupil first names, class details, daily mood scores, selected wellbeing tools, optional 'request to talk' flags, and school staff account details.

We do not process children's surnames, dates of birth, home addresses, contact details, or precise location data.

SchoolBudi processes personal data only on documented instructions from the school, including any lawful instructions given through use of the platform.

We ensure that staff authorised to process personal data are subject to a duty of confidentiality.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage.

We do not engage another processor without the school's prior specific or general written authorisation. Any sub-processors we use are bound by equivalent data protection obligations.

All data is encrypted in transit using HTTPS/TLS and encrypted at rest by our managed cloud database provider.

Access is controlled through role-based permissions, secure authentication, and database-level security rules.

Backups are retained by the platform provider and protected with the same encryption standards.

We maintain records of processing activities and access logs where required for support or security purposes.

Schools remain responsible for responding to data subject requests from pupils, parents, guardians, and staff.

SchoolBudi will assist the school by providing tools to access, export, correct, and delete data held on the platform.

If a data subject request is received directly by SchoolBudi, we will forward it to the relevant school without undue delay.

Schools can download or delete pupil check-in data at the end of each academic year.

Schools can also archive or delete pupils, classes, or their full school record at any time through the platform or by contacting us.

If a school does not subscribe after its free trial ends, its data is retained for 90 days so it can sign up and seamlessly convert to a paid account; after that period the data will be deleted in line with this agreement.

On termination of the school's use of SchoolBudi, the school may request deletion of its data. We will return or delete data in accordance with the school's instructions, except where retention is required by law.

SchoolBudi uses trusted third-party service providers for hosting, authentication, and embedded widgets.

A current list of sub-processors is available on request by emailing hello@schoolbudi.co.uk.

SchoolBudi will cooperate with reasonable audits and inspections by the school to demonstrate compliance with this agreement.

We will notify the school without undue delay if we become aware of any personal data breach affecting data processed on the school's behalf.

Personal data is stored in the United Kingdom. Where any transfer outside the UK becomes necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR.

If you have any questions about this Data Processing Agreement, please contact us at hello@schoolbudi.co.uk.

We will respond to data protection enquiries as quickly as possible and within the timeframes required by UK law.