Agreement between SchoolWorkSpace Ltd and a School/Education Establishment.
SchoolWorkSpace provides software services to Schools and Education Establishments. These services include Organising Exams, Parents Evening and Meetings, Class Layouts, Gradebooks, Curriculum Planning and Homework.
To provide these services an accurate list of parents/contacts, staff and students is required. SchoolWorkSpace integrates with Groupcall Xporter or Wonde and maintains a secure copy of required data within the SchoolWorkSpace data store.
For the purpose of allowing authorised users to use SchoolWorkSpace, the system requires specific personal information.
Personal information about pupils who are currently on roll:
Internal MIS record ID
Unique Pupil Number (UPN) *
Unique Candidate Identifier (UCI) **
Unique Learner Number (ULN) **
Examination Candidate Number **
Name
Gender *
Date of Birth *
Home/mobile phone numbers ***
Email address(es) ****
Year group, registration group
school house group *
Class or lesson groups
School record photograph
Attendance Marks (AM and PM) *
Free School Meal (FSM) *
English as Additional Language (EAL) *
Additional Learning Needs (ALN) *
Gifted and Talented *
Achievement and Behaviour Details *
Examination Entries **
Examination Timetables **
Examination Access Arrangements **
Personal information about adults currently in the employ of the school (Staff):
Internal MIS record ID,
Teacher Number *
National Insurance Number *
Name and title
Gender *
Date of Birth *
Association with class, lesson, year, registration or house groups *
Home Address *
Mobile, home and work phone numbers ***
Email address(es) ****
School record photograph *
Personal information about pupil contacts with parental responsibility: *
Internal MIS record ID,
Name and title
Address *
Mobile, home and work phone numbers ***
Email address(es) ****
Relationship with Student (Father/Mother/etc...)
Information about your school:
School name and establishment number
School phone number
School email address
Head teacher’s name
Full school address
Seating plans
Additional Data
Any data you upload manually into SchoolWorkSpace e.g. exam entries
Data that users enter into the system e.g. Exam Attendance, Homework Assignments and Submissions
* Optional - can be included if required and the MIS and Groupcall Xporter / Wonde support these data items.
** Exams - Imported if Exams Enabled
*** Optional - Phone numbers are used for messaging direct from SchoolWorkSpace and also for displaying to Staff incase they need to contact the staff/student/parent.
**** - Email addresses used for login and communications.
Many fields can also be blocked at the Groupcall Xporter / Wonde data sharing level
This Data Sharing Agreement policy is provided for schools to ensure that, as data controllers they have the ability to share data, and that they consider there to be appropriate measures in place, ensuring that the data is held securely and confidentially.
SchoolWorkSpace and its suppliers will be acting as ‘data processors’ as defined by GDPR. SchoolWorkSpace has taken all reasonable measures to ensure the safety and security of personal information and continues to review these measures on an on-going basis. SchoolWorkSpace will only process customer data in response to written instructions from the data controller unless required by law to act without such instructions and will tell the controller immediately if asked to do something infringing GDPR. We will only transfer personal data to a third country or international organisation on the written instructions of the data controller.
The information from your school is held inside the SchoolWorkSpace web platform, which is hosted in Microsoft’s Azure platform in the UK South territory. The data in Azure is protected from exposure by multiple layers of fire-walling, authentication and physical access control. All employees, not already under a duty of confidentiality by law, will be required to complete a commitment to confidentiality prior to being given access to any customer personal data.
When a trial or subscription expires and a school is no longer a customer, after 2 months the school will be eligible for deletion and set as pendingDelete then in the next monthly delete cycle the school data will be deleted. This can be sooner on request. Obviously, account level information will be retained e.g. subscription history, invoices etc.
Your rights - accessing, erasing and updating your personal information
In most cases the personal data in SchoolWorkSpace is imported from the school's MIS so corrections or deletions are simply a matter of updating the source and this delete/edit will flow in the next data sync. Most other cases in SchoolWorkSpace the school is in full control of the data and it is all shown on the screen as the software is used. SchoolWorkSpace (data processor) will assist the School (data controller) in providing subject access and allowing data subjects to exercise their rights under GDPR. We will also assist schools in meeting its GDPR obligations in relation to the security of the processing, the notification of personal data breaches and completion of their DPIA.
Should you have any queries or complaints in relation to how we use your information please contact us at : gdpr @ schoolworkspace.co.uk
You have the right to access the personal information we hold about you and to ask us to:
make any changes to ensure that any personal information we hold about you is accurate and up to date;
erase or stop processing any personal information we hold about you where there is no longer a legal ground for us to hold it; or
transfer any information we hold about you to a specified third party
If you have a GDPR related request e.g. a subject access request (SAR) then please email gdpr @ schoolworkspace.co.uk
In accordance with GDPR requirements SchoolWorkSpace will, on request, submit to audits and inspections and provide the controller with whatever information it needs to ensure that we are both meeting our responsibilities and obligations to ensure the security of personal data. SchoolWorkSpace will tell the controller immediately if it is asked to do something infringing UK GDPR or other data protection law of the UK. (Article 28).
Should you wish to take any complaints or queries further, you have the right to contact the Information Commissioner's Office regarding such issues. Further information about how to make a complaint can be obtained at www.ico.org.uk
Age Appropriate Design Code
https://ico.org.uk/childrenscode
The service we offer at SchoolWorkSpace is focussed around the school data to assist with the education of the student.
For the ExamsAssist product the main function for Students and Parents is to display the data the school has regarding the student, exam entries, timetables and access arrangements.
Best interests of the child: All our functions in SchoolWorkSpace are developed to help students, parents and staff in the education process and ultimately improve student outcomes
Age Appropriate The service is designed for children 13+ and purely for educational focused activities.
Transparency: The personal information held regarding students is only to assist staff with providing education of the student, or inform parents/students.
Detrimental use of data: Data is only to support the education of the student.
Default settings: Data is not shared with 3rd parties and there is no advertising. Data is only visible to those that need it.
Data minimisation: Schools have lots of control to minimise the data in SchoolWorkSpace to the minimum required for them to use the software.
Data sharing: Data is not shared unless required to support the school processes (e.g. exam entries to the exam board)
Geolocation: Location is not tracked
Parental controls: There are no parental controls.
Profiling: There is no profiling
Nudge techniques: There is no nudging
Connected toys and devices: Sorry no connected (or unconnected) SchoolWorkSpace or Exams Assist toys are available yet.
Online tools: The online help should be able to guide children to talk to the school data controller.
A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Upon becoming aware of a data breach or security incident, the affected party shall inform the other party without undue delay and shall provide all information and cooperation as the other party may reasonably require. In order for both parties to fulfil its data breach reporting obligations under (and in accordance with the timescales required by) Applicable Data Protection Law.
The parties shall each further take all such measures and actions as are reasonably necessary to remedy or mitigate the effects of the incident and shall keep the other party up-to-date about all developments in connection with it.
To report a data breach email data breaches to gdpr @ schoolworkspace.co.uk with a subject starting "Data Breach in School Name" for immediate escalation to the on-call engineer. Include in the body of the email details of what has happened and a phone number if you need us to call.
If SchoolWorkSpace becomes aware of a data breach affecting your personal data then we will notify you by email and/or in platform notification as soon as possible,
The ico has a useful tool for self assessment of data breaches : ico.org.uk/for-organisations/report-a-breach/personal-data-breach-assessment/
We are registered with the ICO with ref ZA352393
We take care to protect the privacy of customers and users of SchoolWorkSpace. The full privacy policy can be found here.
Full terms and conditions of can be found here.
SchoolWorkSpace