Schools Privacy Notice

Last updated: 2 June 2026 · Applies to the Digital Shields Schools Portal (B2B)

This notice explains how Infinity X Investments Ltd (trading as Digital Shields) processes personal data in connection with the Digital Shields Schools Portal — our online-safety teaching and safeguarding service for UK schools. It is written for school Data Protection Officers, Designated Safeguarding Leads and procurement teams.

1. The two roles — Controller and Processor

Under the UK GDPR, the school and Digital Shields play different roles depending on which data is being processed:

The remainder of this notice splits each topic by role.

2. Personal data we process

2.1 As Processor (on behalf of the school)

• Staff identifiers: full name, work email address, role designation (e.g. DSL / Admin / Staff).
• Authentication data: bcrypt-hashed password (cost factor 12), JWT session tokens stored in HttpOnly cookies. We never store plaintext passwords.
• Activity records: last-active timestamp, resource access logs, CPD completion records, threat-alert acknowledgements, policy-review timestamps.
• Incident records: School-authored free-text descriptions with pseudonymised pupil references only (initials and year group). The Schools Portal instructs the user not to enter pupil full names or other direct identifiers.
• Filtering events: Pseudonymised pupil identifier (the school's choice of format), URL or platform name, timestamp.

Pupils are not direct users of the Schools Portal. We do not collect pupil names, contact details, photographs, behavioural records or special-category data as a Processor.

2.2 As Controller (for our own purposes)

• Billing data: school name, billing email, Stripe customer ID, subscription dates. Card details are handled exclusively by Stripe — they never touch our servers.
• Supplier correspondence: emails to support@digitalshields.co, dpo@digitalshields.co or via in-app contact forms.
• Marketing data: only where you explicitly opt in to email updates about new resources or product announcements. You can unsubscribe at any time.

3. Lawful basis

3.1 As Processor

The lawful basis for processing rests with the school as Controller. The school is responsible for identifying its own Article 6 (and where applicable Article 9) basis before submitting personal data to the Schools Portal. Schools typically rely on:

• Public task (Article 6(1)(e)) — the safeguarding duty under Keeping Children Safe in Education (KCSiE) 2024 and the Children Act 2004.
• Legitimate interests (Article 6(1)(f)) — for routine staff CPD and resource access.
• Legal obligation (Article 6(1)(c)) — for filtering and monitoring records under the DfE Filtering and Monitoring Standards (2023).

Digital Shields acts strictly on the school's instructions under our Data Processing Agreement.

3.2 As Controller

• Billing data — performance of a contract (Article 6(1)(b)).
• Supplier correspondence — legitimate interests in running our business and supporting customers (Article 6(1)(f)).
• Marketing data — consent (Article 6(1)(a)) where you have opted in.

4. Recipients and sub-processors

We engage the sub-processors listed below to deliver the Schools Portal. Each is bound by written terms providing equivalent data-protection obligations. The current list is also available, post-login, at /api/schools/procurement/sub-processors for export to your DPO records.

We will give your school at least 30 days' written notice of any addition to this list, during which you may object on reasonable data-protection grounds.

5. International transfers

Primary processing takes place in the EEA (Railway's Frankfurt region). Where personal data is transferred to a sub-processor outside the UK / EEA — chiefly to the United States — we rely on the ICO's UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with supplementary technical and organisational measures equivalent to those required by the IDTA. The ICO ceased recognising bare EU Standard Contractual Clauses for UK GDPR transfers after 21 March 2024; all our transfer mechanisms use ICO-approved instruments.

6. Retention

As Processor, we retain school data for the duration of the subscription plus 30 days. After that window, all school data is permanently deleted by our automated retention purge — this is enforced in code, not just by policy, and runs daily.

As Controller, billing records are retained for 7 years to satisfy HMRC obligations. Supplier correspondence is retained for 3 years from last contact. Marketing data is retained until you unsubscribe.

7. AI and automated processing

The Schools Portal uses Anthropic's Claude large language model to generate daily threat-intelligence summaries and to power the optional AI chat feature.

• Anthropic's API does not use prompts or outputs to train its models (per Anthropic's published API data-usage policy).
• We do not submit pupil personal data to Anthropic. Threat alerts are generated from publicly available UK online-safety intelligence and contain no school-specific data.
• No decision affecting a data subject is made solely on the basis of automated processing within the meaning of UK GDPR Article 22.
• AI-generated content is clearly labelled at the point of use.

8. Data subject rights

For personal data we process as Processor (staff data, incident records, etc.), data subjects should direct their rights requests to the school as Controller. We will assist the school in responding within statutory timeframes, including via:

• Self-serve JSON data export — /api/schools/data-export (admin only).
• Self-serve account deletion — DELETE /api/schools/account (admin only).
• Direct ad-hoc rights support via dpo@digitalshields.co.

For personal data we hold as Controller (billing, correspondence, marketing), data subjects can contact us directly — see Section 12.

Data subjects also have the right to lodge a complaint with the Information Commissioner's Office: ico.org.uk.

9. Security

Detailed Technical and Organisational Measures are set out in Annex II of our Data Processing Agreement (available post-login at /api/schools/procurement/dpa). In summary:

• TLS 1.3 in transit; Postgres encrypted at rest.
• bcrypt-hashed passwords (cost 12); HttpOnly + SameSite + Secure cookies; CSRF double-submit.
• Helmet security headers; parameterised SQL; output escaping; rate limiting on auth endpoints.
• TOTP two-factor authentication available on every school account.
• Personal Data Breach notification within 72 hours to the school's admin email.
• Stripe-hosted checkout — no card data ever touches our servers.

We are Cyber Essentials certified by the IASME Consortium (the NCSC-appointed certification body) and enrolled in the UK National Cyber Security Centre's Active Cyber Defence programme — specifically Early Warning (same-day threat alerts against our domain and IP addresses), Web Check (NCSC vulnerability scanning of our public infrastructure) and Mail Check (DMARC, SPF and DKIM monitoring). A copy of the Cyber Essentials certificate is available to school DPOs on request.

10. Cookies

The Schools Portal sets only strictly necessary cookies — no analytics, advertising or third-party tracking cookies. See our Cookie Policy for the full inventory.

11. Changes to this notice

We will notify school admins by email of any material change to this notice at least 30 days before it takes effect. The current version is always available at www.digitalshields.co/schools/privacy.

12. Contact

Data Protection enquiries: dpo@digitalshields.co
General support: support@digitalshields.co
Controller (for our own processing): Infinity X Investments Ltd, Company No. 16998775, registered in England & Wales. ICO data-protection registration: see footer of Schools Portal procurement documents.

Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk · 0303 123 1113.