Legal
Data processing agreement
The terms on which Sendiphany Ltd processes personal data on behalf of a school using the service. It is written to meet Article 28 of the UK GDPR and forms part of our terms of service.
Last reviewed
How to read this page
1. Parties and roles
The school, academy or trust that holds the account (“the School”) is the data controller of the pupil, parent and carer, and staff-contribution data entered into Sendiphany. The School determines the purposes and means of that processing. Sendiphany Ltd (“Sendiphany”) is the data processor and processes that personal data only on behalf of the School and only in accordance with this agreement. For staff account data, billing and enquiries, Sendiphany is a controller in its own right as described in the privacy policy.
2. Details of processing
| Subject matter | Provision of the Sendiphany service: SEND register, deadlines and reminders, local authority communication log, safeguarding alerts, evidence documents, targets and progress, parent and staff contribution forms, and AI-assisted drafting of the School’s contribution to EHC plans. |
|---|---|
| Duration | The term of the School’s subscription or trial, plus the period needed to return or delete data under section 9. |
| Nature and purpose | Storage, retrieval, organisation, display, export, email notification and, where the School enables it for a pupil, pseudonymised transmission to an AI provider to generate a draft, all for the purpose of the School’s SEND administration. |
| Types of personal data | Pupil identifiers (name, date of birth, year group, UPN), SEN status and area of need, special educational, health and social care information recorded by staff (special category data under Article 9), safeguarding information, contact details of parents, carers, key workers and local authority caseworkers, the views of pupils, parents and staff, uploaded documents, and the audit record of actions taken in the account. |
| Categories of data subjects | Pupils, their parents and carers, School staff, and professionals named in records. |
3. Processing only on documented instructions (Article 28(3)(a))
Sendiphany processes personal data only on the School’s documented instructions, which are this agreement, the terms of service, and the School’s use of the service’s features (including recording consent for AI drafting for a pupil and opting in to local authority chase emails). This includes any transfer of personal data outside the United Kingdom, which happens only as set out in section 11. If Sendiphany is required by law to process the data otherwise, it will tell the School before doing so unless the law prohibits that. If Sendiphany believes an instruction infringes UK data protection law, it will tell the School immediately.
4. Confidentiality of personnel (Article 28(3)(b))
Everyone Sendiphany authorises to process the School’s data is bound by a contractual duty of confidentiality. Access to production data is limited to named staff who need it to operate or support the service, is protected by two-factor authentication, and is logged.
5. Security (Article 28(3)(c) and Article 32)
Sendiphany implements the following technical and organisational measures, which it may improve but will not weaken without notice:
- Encryption of personal data in transit (TLS) and at rest.
- Separation of each school’s data by row-level security in the database, enforced for every query, and private document storage scoped per school.
- Two-factor authentication available to every user; login lockout after repeated failures; a 30-minute idle time-out; password rules following NCSC guidance.
- An audit log of actions taken in the account and a log of every notification sent.
- Pseudonymisation of pupil identifiers before any content is sent to the AI provider, with real values restored only inside the service.
- Security headers including a content security policy, rate limiting on public endpoints, and protection against cross-site request forgery.
- Hosting with providers that maintain their own independent security certifications, listed on the sub-processors page.
Sendiphany does not yet hold Cyber Essentials or ISO 27001 certification in its own name. The security page is kept current on this point.
6. Sub-processors (Article 28(2) and (4))
The School gives general written authorisation for Sendiphany to use the sub-processors listed on the sub-processors page, which states each one’s purpose and the region in which it processes data where we can confirm it. Sendiphany will tell the School in writing before adding or replacing a sub-processor and allow a period of at least 30 days to object; if the School objects on reasonable data protection grounds and no resolution is found, the School may terminate and receive a pro-rata refund of prepaid fees. Sendiphany imposes data protection obligations on each sub-processor equivalent to those in this agreement and remains fully liable to the School for the sub-processor’s performance.
7. Data subject rights (Article 28(3)(e))
Taking into account the nature of the processing, Sendiphany assists the School with appropriate technical and organisational measures to respond to requests from data subjects to exercise their rights under Chapter III of the UK GDPR. In practice: the School can export every record itself from the app, can correct records directly, and can request deletion of a pupil record or the account from the app. If a data subject contacts Sendiphany directly about data the School controls, Sendiphany will refer them to the School and tell the School without undue delay.
8. Assistance with security, breaches and impact assessments (Article 28(3)(f))
- Personal data breaches: Sendiphany will notify the School without undue delay after becoming aware of a personal data breach affecting the School’s data, and in any event in time for the School to meet its 72-hour duty to notify the ICO, providing what is known about the nature of the breach, the data and data subjects concerned, the likely consequences and the measures taken.
- Security: Sendiphany assists the School in meeting its Article 32 obligations by maintaining the measures in section 5 and answering reasonable security questionnaires.
- Impact assessments and prior consultation: Sendiphany provides the information reasonably needed for the School’s data protection impact assessment of the service, including the description of AI processing on the responsible AI page, and assists with any prior consultation with the ICO under Article 36.
9. Return and deletion at the end of processing (Article 28(3)(g))
At the end of the subscription the School may export all of its data from the app. On the School’s written instruction, or 90 days after the account closes if no instruction is received, Sendiphany deletes the School’s personal data from live systems and from backups within the backup rotation period, and confirms deletion in writing on request, except where UK law requires retention. Deletion requests made from the app are verified and carried out after a seven-day cooling-off period because they are irreversible.
10. Information and audit (Article 28(3)(h))
Sendiphany makes available to the School all information necessary to demonstrate compliance with Article 28, including this agreement, the security and sub-processor pages, and the independent certifications of its hosting providers. Sendiphany will allow for and contribute to audits, including inspections, conducted by the School or an auditor mandated by the School, on reasonable written notice, no more than once a year unless required by a supervisory authority or following a breach, and in a way that does not expose other schools’ data.
11. International transfers
Sendiphany aims to keep pupil data in the United Kingdom or the European Economic Area. Where a sub-processor processes personal data outside the UK, the transfer is made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or under UK adequacy regulations. The sub-processors page states the region for each provider where we can confirm it and marks it for confirmation in your signed DPA where we cannot.
12. AI processing
AI drafting is disabled for each pupil until the School records its lawful basis and consent on that pupil’s record. When enabled, pupil identifiers are pseudonymised before transmission to the AI sub-processor, outputs are returned for the School’s review, and prompts and outputs are not used to train AI models. The School remains the controller of the content it supplies and of the draft it edits. Details are on the responsible AI page.
13. Signed copies and changes
This agreement takes effect when the School accepts the terms of service. For a countersigned copy, or to propose amendments for a trust-wide agreement, email privacy@sendiphany.co.uk. Changes to this page are dated at the top and material changes are notified to account owners in advance.