Privacy Policy
Last updated: 23 May 2026
Who we are
School Dashboard ("we", "us") is operated from the United Kingdom. We provide the School Dashboard SaaS platform at app.schooldashboard.uk and the marketing site at www.schooldashboard.uk.
For data that schools upload to our platform (pupil records, staff records, behaviour events, survey responses), the school is the data controller and School Dashboard is the data processor. We act only on the school's documented instructions and within the scope of our processing agreement.
What data we process
- Pupil data — name, year group, tutor group, ethnicity, SEND status, disadvantaged status, contact details for parents/carers, and behaviour records the school creates within the platform.
- Staff data — name, email address, role, department, and (where the school uses Microsoft Entra sync) the Entra object ID.
- Parent/carer data — name and email address, used only to send detention and behaviour notifications on the school's behalf.
- Usage data — IP address, browser fingerprint, and pages visited within the app, for security auditing and product improvement.
Lawful basis
The school's lawful basis for processing pupil and parent data is the public task of providing state-funded education (UK GDPR Article 6(1)(e)) and, where applicable, the legitimate interests of running the school. Special-category data (such as ethnicity or SEND status) is processed under the substantial public interest condition in Schedule 1, Part 2, paragraph 6 of the Data Protection Act 2018.
Where data is stored
Production data is stored on servers in the United Kingdom and the European Economic Area. No personal data is transferred outside the UK/EEA. Daily encrypted backups are held in the same region.
Retention
We retain pupil and staff records for as long as the school's contract with us is active. On contract termination, the school may export all its data; 30 days after termination we delete all production records, and after a further 60 days we delete encrypted backups.
Sub-processors
We use the following sub-processors:
- Cloudflare, Inc. (USA, EU PoPs) — DNS and edge networking
- Resend, Inc. (USA, EU region) — transactional email delivery
- Microsoft Corporation (Ireland) — Entra ID sign-on and directory sync (only when the school enables it)
- Anthropic PBC (USA / EU region) — AI-assisted features (only when the school enables them; requests are limited to the school's own aggregated data)
Your rights
Pupils, parents and staff have the right to access, rectify, erase, restrict or object to processing of their personal data, and the right to data portability. To exercise these rights, contact the school in the first instance, as the school is the data controller. We will assist the school in responding to your request.
Contact
Data protection enquiries: privacy@schooldashboard.uk.
General enquiries: hello@schooldashboard.uk.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).