What information do we process?
Below is a link to our Schedule of Processing and the contents in plain text below the link:
Subject matter of the processing
Data stored on the Contractors system is used specifically in conjunction with the Contractors software. The software is used by the school to help show small steps of progress for a student and to help the school show the progress either individually or aggregated into group data. The School can also evidence this progress in the form of media files being stored against a student’s record which can be shared with parents and allow them to interact with this evidence or add their own.
Duration of the processing
The processing of data runs on an annual contract which automatically renews. Schools are invoiced 30 days in advance of the expiry date and are contractually obliged to give 30 days’ notice in advance of the expiry if they wish to discontinue the service. The commencement of the service is set out in the original terms and conditions signed on commencement of the contract.
Nature and purposes of the processing
It is important to remember that the Contractors software gives the School a range of options and methods for processing data. The way this data is processed is understood by the School and is in line with their own requirements and needs, hence the purchase of the software and the Contractors processing service. It is at the decision of the School which of the reports they run and how they use it and that these methods are in line with their own obligations under the GDPR. The Contractor is not responsible for establishing consent or lawfulness of processing as the Contractor is not the controllers of the data.
My B Squared Website (uk.bsquared.cloud)
This site is specifically for storing personal details of students and users. What personal data is stored as a requirement is minimal (described in the next section). This data can be entered manually or via an import file from another system. Information is only accessible through a single portal and via API’s that Connecting Steps and Evisense utilise to pull this data across. This ensures data is not stored in multiple locations. The purpose of this site is to allow records to be stored against individuals via our other systems. An external transactional email system is used to provide notifications to users in the system when access has been granted to specific areas within the system. Once an account has been initially provisioned, the Contractor is not involved in any capacity with what happens with the data except within the realms of the software which is automated for which we are responsible for creating and maintaining. Dissemination of data in this system is only possible by the School by making it available by either exporting the data and transferring through a third-party system unrelated to us.
Connecting Steps (uk.connectingsteps.com)
Connecting Steps utilises the users and students stored within My B Squared. Against this data, records of specific skills are stored against the students. This data is then further processed to provide percentage representations of progress in a variety of formats as well as representations of the source data. Additionally, via the provision of an additional module in our system, schools can choose to further process their data to provide aggregated assessment data based on additional personal details they may choose to store.Data can be exported by the controller in the form of raw data, formatted data print-outs formatted into PDF. The functions are at the disposal of the controller to use when appropriate to do so.
Evisense utilises the users and students stored within My B Squared. Media files can be attached to a student’s record and then viewed in chronological order and additionally can be filtered based on criteria set for each post such as curriculum area or category.Reports can be generated using the same filtering techniques on screen and these are generated into PDF files before printing.All the Contractors systems are self-auditing providing full audit trails of data transformation. Aspects of the system give access to this audit trail however the Contractor can provide the School on request a full audit trail of changes. This will only be made available to the main system administrator as specified by the School.The Contractor is not responsible for any data that leaves their system via export or manual copying nor are they responsible for any additional processing that may happen with this data.At the request of the School, certain designated members of the Contractors team can provide assistance with issues and additional processing requirements for the school. The Contractor will erase the data at contract end in line with the deletion policy described further down.
Type of Personal Data
The Contractors system is capable of holding:
- First Name
- Last Name
- Date of Birth
- Registration Group**
- Admission Date**
- Leaving Date**
- Email Address
- EHC/Statement Date
- First Language
- Free School Meals
- Gifted and Talented
- Looked After
- Parents/Guardians Address
- Parents/Guardians Daytime Number
- Parents/Guardians Home Telephone
- Parents/Guardians Mobile
- Pupil Premium
- SEN Type
- Service Child in Education
- Assessment data
- Media (photo’s, video’s, audio and documents)
- Comments and general text in the context of a student
The fields in bold are required for the system to function properly and are required of students and users in the system (fields marked with ** are not required of users (teachers, parents, etc.)) The remaining fields are not required as standard and it is up to the school to decide whether to put information in these fields for students. These are used in our Analysis module which allows data to be viewed in the context of these as the school’s requirements dictate. The fields in UNDERLINE are identified in Article 9. It is a School’s responsibility to ensure they are able to comply with Article 9 in full.
Categories of Data Subject
The categories of personal data are easily described by the varying roles our system has that can be attached to each data subject in our system:
- Learning Assistant
- Assistant Headteacher
- Super Administrator
- Data Manager
- IT Administrator
- Executive Headteacher
- Deputy Headteacher
- Teaching Assistant
- Vice Principal
- Executive Principal
- Assistant Principal
- Student Administrator
Plan for return and destruction of the data once the processing is complete UNLESS requirement under union or member state law to preserve that type of data
The School’s data will be retained for 30 days after contract end. To keep a balance between security/privacy and accessibility, the Contractors approach is:
- School informs Contractor no less than 30 days prior to expiration they wish to cancel
- Contractor extends the licence to 30 days past the original expiration
- School can now use this time to use the systems in-built functionality to export and download a copy of their data
- Unless otherwise notified that the data has been successfully retrieved, once the new expiration passes, we retain the data for another 30 days
- After this 30 days passes, the data is then deleted from our servers and School notified of deletion by email.
The Contractor runs a rolling contract that renews automatically and invoices the School for the additional sum for the years hosting. If the School fails to notify the Contractor they wish to cancel in the pre-agreed timescale, access to the system is stopped until payment has been received.