Introduction
EduComply is committed to protecting personal data. This policy describes how we collect, use, and protect personal data in connection with the EduComply website, platform, and related services.
We have written this policy in plain English. If anything is unclear, please contact us using the details below.
Who we are
Privacy contact: contact@educomply.co.uk
In most cases, schools or Multi-Academy Trusts (MATs) using EduComply act as the data controller for the personal data processed through the platform. EduComply acts as a data processor on their behalf, processing data only in accordance with the customer's instructions and our data processing agreement.
Personal data we process
EduComply processes limited professional and operational data to support compliance management for schools and trusts. This includes:
Staff and user information
Names, professional email addresses, job titles, and roles of staff who use the platform or are referenced in compliance records.
Contractor information
Names, company details, and professional contact information for contractors associated with inspections, surveys, or remedial work.
Compliance documentation
Uploaded or emailed documents such as inspection reports, certificates, surveys, and risk assessments. These may contain professional contact details of the individuals involved.
Technical data
IP addresses, browser type, device information, and access logs generated through use of the platform. This data supports security monitoring and service reliability.
Data we do not intentionally process
EduComply is not designed to process pupil data.
The platform is built for managing statutory compliance records, safety documentation, and operational data. Customers should avoid uploading documents containing pupil personal data unless it is strictly necessary for compliance purposes. Where pupil data is included in uploaded documents, the school or trust remains responsible as data controller for ensuring this is appropriate and lawful.
How personal data is collected
Personal data may be collected through:
- •User account creation and profile setup
- •Document uploads by authorised users
- •Automated email ingestion of compliance documents
- •Records entered directly by users (inspections, tasks, assessments)
- •Technical logs generated through use of the platform
Purpose of processing
We process personal data for the following purposes:
- •Managing statutory compliance records for schools and trusts
- •Tracking inspections, certificates, and renewal dates
- •Managing tasks and remedial actions
- •Associating documents with schools, buildings, and compliance regimes
- •Maintaining audit records of compliance activity
- •Providing, securing, and improving the service
Lawful basis for processing
Where EduComply acts as a data processor, we process personal data on behalf of our customers in accordance with their instructions. The school or MAT, as data controller, is responsible for determining the lawful basis for processing.
Where EduComply acts as a data controller (for example, managing user accounts and providing the service), processing may rely on:
- •Legal obligation (Article 6(1)(c) UK GDPR) - where processing is necessary to comply with a legal requirement
- •Legitimate interests (Article 6(1)(f) UK GDPR) - where processing is necessary to provide, secure, and improve the service
Data storage and security
We take appropriate technical and organisational measures to protect personal data. These include:
- •Encryption of data in transit (TLS)
- •Encryption of data at rest
- •Role-based access controls within the platform
- •Authentication and access logging
- •Restricted administrative access to production systems
- •Secure cloud hosting in the UK and EEA
We regularly review our security practices and aim to follow industry good practice for protecting customer data.
Data sharing
We do not sell personal data. Personal data processed through EduComply is only shared with:
- •The customer organisation (school or trust) that controls the data
- •Authorised users within the customer organisation, based on their role and permissions
- •Trusted service providers and subprocessors needed to operate and support the platform (for example, cloud hosting and infrastructure providers)
We may also disclose personal data where required by law or to protect our legal rights.
Data retention
We retain personal data only for as long as necessary to provide the service, meet legal obligations, and fulfil any customer-defined retention requirements. When data is no longer needed, it is securely deleted or anonymised.
Customers can request deletion of their data at any time, subject to any applicable legal retention requirements.
Your rights
Under the UK GDPR, individuals have the following rights in relation to their personal data:
- •Right of access. You can request a copy of the personal data we hold about you.
- •Right to rectification. You can ask us to correct inaccurate or incomplete data.
- •Right to erasure. You can ask us to delete your personal data in certain circumstances.
- •Right to restrict processing. You can ask us to limit how we use your data.
- •Right to data portability. You can request your data in a structured, commonly used format.
- •Right to object. You can object to processing based on legitimate interests.
Where your personal data is processed by EduComply on behalf of a school or trust, requests should usually be directed to the relevant organisation first, as they are the data controller.
To exercise any of these rights directly with EduComply, contact us at contact@educomply.co.uk.
Changes to this policy
We may update this policy from time to time. The latest version will always be available on this page, with the date of the most recent update shown at the top.
Contact
If you have questions about this privacy policy or how we handle personal data, contact us at:
Email: contact@educomply.co.uk
Complaints
If you are unhappy with how your personal data has been handled, you have the right to complain to the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113
We would appreciate the chance to address your concerns before you contact the ICO. Please reach out to us first using the contact details above.