Data Sharing Agreement

This Data Sharing Agreement (the Agreement) sets out how Personal Data is shared between Smart School Councils and the schools and multi-academy trusts that use our Class Meeting Tool and related services. It was written in May 2018, was last reviewed in May 2026, and will next be reviewed in May 2027.

Parties

Smart School Councils The Gateway, 85-101 Sankey Street, Warrington, Cheshire WA1 1SR. Registered Charity number 1156110. Contact for data protection matters: greg@smartschoolcouncils.org

The school or multi-academy trust ("the School"): the educational institution that registers for and uses the Smart School Councils service.

Smart School Councils engages the following sub-processors to deliver its service:

  • Outlandish (149 Fonthill Rd, London N4 3HF), for the Class Meeting Tool platform and related WordPress hosting on AWS.

  • Supabase (London, eu-west-2 region), for school onboarding, partnership data, and the question bank.

  • Hostinger (UK servers), for marketing and tooling pages, the school search service, and the ActiveCampaign proxy.

  • ActiveCampaign, for email communications, sales workflows, and contact management.

  • Front, for handling email support enquiries.

  • Microsoft Clarity, for anonymous session-recording used to improve product usability.

  • Google Analytics, for anonymous website traffic analysis.

This list is reviewed annually. The current list is available on request.

Roles under UK GDPR

For Personal Data that the School enters into the Smart School Councils platform (including the Class Meeting Tool), the School is the Data Controller and Smart School Councils is its Data Processor, acting only on the School's documented instructions.

Smart School Councils is a Data Controller for its own business data, including staff contact details, invoices, and usage analytics.

Each party will meet its respective obligations under the UK GDPR and the Data Protection Act 2018, in particular Articles 5, 24 to 28, and Articles 32 to 34.

Lawful basis for processing

For pupil-related data shared by maintained schools, the lawful basis is UK GDPR Article 6(1)(e), performance of a task carried out in the public interest.

For pupil-related data shared by independent schools, the lawful basis is Article 6(1)(f), the legitimate interests of the School in supporting pupil voice and decision-making.

For staff contact details and invoicing, the lawful basis is Article 6(1)(f), legitimate interests in operating the membership service and administering the relationship.

No special category data (Article 9) is shared under this Agreement.

And no sensitive personal data is being shared in our programme.

Data shared

The following Personal Data is shared by the School and processed by Smart School Councils:

  • Pupil first name, class or form group, and school

  • Staff contact details (name, work email, role)

  • Usage data (login timestamps, feature clicks)

  • Website analytics in anonymised form

Smart School Councils does not collect or process pupil last names, contact details, dates of birth, special category data, or any other data beyond the list above as part of this Agreement.

Purpose

The data is processed to enable the School to track pupil involvement, surface pupil voice, and develop pupil decision-making and citizenship skills through Smart School Councils' Class Meeting Tool and related services.

Storage

All pupil and staff data is stored within the United Kingdom and the European Economic Area:

  • Class Meeting Tool data is held in a MySQL database hosted by Outlandish on AWS infrastructure in the eu-west-1 (Republic of Ireland) region.

  • Onboarding and partnership data is held in Supabase in the eu-west-2 (London, United Kingdom) region.

  • Marketing and tooling files are held on Hostinger servers in the United Kingdom.

The United Kingdom recognises the EEA as providing an adequate level of protection for Personal Data, and the European Union recognises the United Kingdom under its adequacy decision. No additional transfer safeguards are currently required for transfers between the UK and the EEA in either direction.

Sub-processors

By signing this Agreement, the School gives Smart School Councils general written authorisation to engage the sub-processors listed above to assist in delivering the service. Smart School Councils:

  • Will impose data protection obligations equivalent to those in this Agreement on any sub-processor it engages

  • Will inform the School of any intended addition or replacement of sub-processors, with at least 30 days' notice

  • Will give the School a reasonable opportunity to object to a new sub-processor; if the School objects, the parties will work in good faith to resolve the objection

Data subject rights

Data subjects (pupils, staff) have the following rights under the UK GDPR in respect of their Personal Data:

  • The right to be informed about how their data is used

  • The right of access

  • The right to rectification of inaccurate data

  • The right to erasure ("the right to be forgotten")

  • The right to restrict processing

  • The right to data portability

  • The right to object

  • Rights in relation to automated decision-making and profiling

Smart School Councils does not carry out automated decision-making or profiling that produces legal or similarly significant effects on data subjects.

Requests to exercise these rights should be made to the School (as Data Controller for pupil data) or to Smart School Councils at greg@smartschoolcouncils.org for the School's own business data.

Security

All data is encrypted in transit (HTTPS / TLS) and at rest. Access to systems is restricted on a need-to-know basis. CSVs and other exports are downloaded over secure (HTTPS) connections only.

Smart School Councils maintains a Security Policy, available on request.

Breach notification

If Smart School Councils becomes aware of a personal data breach affecting the School's data, Smart School Councils will notify the School without undue delay, and in any event within 72 hours of becoming aware, where feasible. The notification will include the nature of the breach, the categories and approximate number of data subjects affected, likely consequences, and any measures taken or proposed.

If the School becomes aware of a breach involving data shared under this Agreement, the School will notify Smart School Councils without undue delay by emailing greg@smartschoolcouncils.org.

Retention

Smart School Councils retains files and data for the period of the School's membership plus one year, after which data is deleted or anonymised.

The School may request earlier deletion of its data by contacting greg@smartschoolcouncils.org, except where Smart School Councils is legally required to retain data for longer.

Data Protection Lead

Smart School Councils is not legally required to appoint a Data Protection Officer under Article 37 UK GDPR. Greg Sanderson (Co-Founder) serves as Data Protection Lead and is the contact point for all data protection enquiries: greg@smartschoolcouncils.org.

Subject Access Requests

Subject Access Requests are processed within one month of receipt, as required by Article 12(3) UK GDPR. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests; the data subject will be informed within one month of receipt.

Complaints to the ICO

Data subjects who are not satisfied with how Smart School Councils has handled their data have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Cohort and partnership sharing

This Agreement covers the bilateral relationship between the School and Smart School Councils. Where a School chooses to participate in a partnership cohort (for example with a Local Authority, multi-academy trust, or diocese), an additional Cohort Data Sharing Addendum applies. The Addendum is set out at https://smartschoolcouncils.org/cohort-data-sharing-addendum and requires separate signature.

Review

This Agreement is reviewed annually. The next review is scheduled for May 2027. The person responsible for instigating the review is Greg Sanderson, Co-Founder, Smart School Councils.

Authorised agreement

Greg Sanderson, Co-Founder, on behalf of Smart School Councils Date: 13 May 2026

The School signifies its agreement to this Data Sharing Agreement by registering for the Smart School Councils service.