Schools Privacy Notice

This notice explains how Infinity X Investments Ltd (trading as Digital Shields) processes personal data for the Digital Shields Schools Portal, our online safety teaching and safeguarding service for UK schools. It is written for school data protection officers, designated safeguarding leads and procurement teams.

1. Controller and processor

Under the UK GDPR, the school and Digital Shields play different roles depending on the data:

• We are the processor for everything a school keeps in the Schools Portal: staff accounts, CPD records, PSHE curriculum records, pupils' records, policy reviews, alert reviews, filtering records and, for schools that use Careers, the pupils' careers area. The school is the controller, and we act only on its documented instructions under our Data Processing Agreement, which a school admin accepts with our school licence terms.
• We are the controller for data we collect in our own right: billing details, supplier correspondence, visits to our public website, and marketing data. Section 3.2 gives the lawful basis for each.

2. Personal data we process

2.1 As processor, on behalf of the school

• Staff identifiers: full name, work email address and role (admin or staff).
• Authentication data: passwords hashed with bcrypt (cost factor 12), session tokens in HttpOnly cookies, and two-step verification secrets and hashed backup codes (two-step verification is required for school admins and our team, and optional for other staff unless the school requires it for everyone). We never store plain-text passwords. Failed sign-ins (the email address typed, the reason and the IP address) are kept for 90 days to spot attacks.
• Activity records: CPD completion records, threat-alert reviews and notes, and policy review dates. Which resources were opened is recorded for the school; who opened them, and when each member of staff last used the portal, only while the school has turned on staff activity tracking (it is off unless the school turns it on), and only from the day it did.
• CPD library records (Complete Shield): each staff member's module quiz attempts (the score and whether it was a pass), the verification code on each certificate, the modules the school has made required, and topics staff ask us to cover. Anyone holding a certificate can use its code to confirm the name, school, module and date printed on it; nothing else is shown. Topic requests go to the Digital Shields team to plan new modules, and stay with the school without the staff member's name if they leave.
• Suggestions staff send us (every licence): what a member of staff asks us to change through “Suggest a change” in the portal (the part of the platform, a title, the details, how much it matters and who it's for), its status, the conversation with our team and, for a quote, which school admin accepted or declined it and when. Everyone at the school can read the school's suggestions; who sent each one is shown only to the school's admins and to that person. We use them to improve Digital Shields, and they stay with the school without the staff member's name if they leave. We ask staff not to include pupils' names or other personal details.
• Filtering records: imported by the school from its filtering provider. The user is kept only as a device or user code, or as a pseudonym made with a key unique to the school (names, logins and email addresses are replaced on import); web addresses keep the site and page only; search terms are cut to 80 characters with email addresses masked. An import that looks like it names a pupil next to a year group is refused.
• Historical incident records: some schools logged safeguarding incidents in the portal before it stopped recording them. Those records (category, severity, status, pupil initials and year group, and what staff wrote) are a closed log: a school admin can read, download and delete them, and they are deleted automatically after the school's chosen period.
• The school's acceptance of our terms: the name, portal role and job title of the school admin who accepted the licence terms and Data Processing Agreement for the school, the versions and when.
• PSHE curriculum records (Complete Shield): class names and year groups, the staff who teach each class, the PSHE lessons ticked as delivered (with the date, who recorded it and an optional note), the PSHE lead's book looks, and pupils withdrawn from sex education, recorded per class by initials only.
• PSHE teacher assessment (Complete Shield): each class's pupil list, which the school adds from its own records (pupils' names only), and the teacher's assessment for each pupil in each PSHE unit on the school's own scale (for example Beginning, Acquiring, Secure or Exceeding), with who recorded it and when. Pupils' names and assessments are visible only to the class's teachers, the school's PSHE leads and admins, and are deleted with the class or the school's account.

Pupils don't use the Schools Portal (except the careers area, below). As processor we do not collect pupils' contact details, dates of birth, photographs, behaviour records or special category data, except, for schools with the All subjects add-on that turn on pupil flags, a yes or no SEND indicator (see below). Pupils' names appear only in the class lists a school adds for PSHE teacher assessment and, for schools with the All subjects add-on, in the pupil records described below; elsewhere the only pupil references are the school's own pseudonyms in filtering records and initials in sex education withdrawal records. The portal asks staff not to enter pupils' names in free-text notes, and refuses lesson notes and book look text that look like a pupil's full name next to a year group.

All subjects add-on (Complete Shield schools that add it): the school's pupil list (pupils' names, an optional MIS internal id and current year group), the groups each pupil is in and their moves between them with dates, teachers' assessments in each subject over the years (unit, termly and data-drop grades, targets, and grades of 1 to 4 against each curriculum statement, with who recorded each and when), teachers' notes about learning, and report comments. Pupil premium, SEND and EAL flags are kept only if the school turns them on: yes or no, with no detail of need, shown only to senior leaders as anonymised group comparisons with any group under 6 pupils hidden, and deleted when switched off. We never keep UPNs, dates of birth, addresses, ethnicity or religion. Teachers see the pupils they teach this year, in the subjects they teach (with those pupils' earlier records from groups the teacher taught, and last year's summary); for subjects with statements, the pupil's whole statement passport for the key stage; form tutors and primary class teachers see the whole profile of the pupils currently in their group; PSHE class teachers keep their own past classes' PSHE lists and assessments; subject leads see their subject; senior leaders see everything. When the school marks a pupil as left, their records are deleted after the school's chosen period (365 days unless it changes it, from 30 to 1,095), and never sooner than 14 days later, so a mistake can be undone.

Careers add-on (Full Shield and Complete Shield schools that add it). If your school uses Careers, its pupils in Years 7 to 11 (and the sixth form, where there is one) sign in to a careers area of their own with a one-time card from the school, then a password stored only as a one-way hash, or their school Google or Microsoft account if the school turns that on (we keep only the provider's account id, never an email address). We keep what they choose to write there: answers to an interests questionnaire and the areas it suggests, careers they save, their CV, and their plan (goals, routes they are thinking about, Year 9 options and Year 11 next steps), with the school's careers records (its programme, encounters, workplace experiences, personal guidance and destinations). Staff see pupils' plans and top interest areas, never their answers, and CVs only when the school turns on teacher comments. We don't use any of it for our own purposes: no analytics about individual pupils, no third-party scripts, no AI and no marketing. A leaver can download their CV and plan for 30 days, then their careers work is deleted; destinations are kept only as counts once the pupil's record goes.

2.2 As controller, for our own purposes

• Billing data: school name, billing email, Stripe customer ID and subscription dates. Card details are handled by Stripe and never reach our servers.
• Supplier correspondence: emails to support@digitalshields.co or dpo@digitalshields.co.
• Visits to our public website (such as /for-schools): Google Analytics only if you accept analytics in our cookie banner. It is never loaded in the Schools Portal.
• Marketing data: only where you opt in, for example by requesting our audit. You can unsubscribe at any time.

3. Lawful basis

3.1 As processor

The lawful basis rests with the school as controller. Schools typically rely on:

• Public task (Article 6(1)(e)): the safeguarding duties in sections 175 and 157 of the Education Act 2002, with Keeping children safe in education 2026 as the statutory guidance.
• Legitimate interests (Article 6(1)(f)): routine staff CPD and resource use.
• Public task (Article 6(1)(e)): planning, teaching and monitoring the curriculum, including the statutory relationships, sex and health education, and keeping a record of parents' requests to withdraw their child from sex education.
• Public task or legal obligation (Article 6(1)(e) or (c)): filtering and monitoring records, which KCSIE 2026 expects schools to keep in line with the DfE filtering and monitoring standards.

We act strictly on the school's instructions under our Data Processing Agreement, which school admins can also open, with their school's own details and acceptance record, from Compliance in the portal.

3.2 As controller

• Billing data and service emails to school admins (sign-in details, payment notices, notices of changes to our terms or sub-processors, and data breach notices): performance of a contract (Article 6(1)(b)).
• Supplier correspondence: legitimate interests in running our business and supporting customers (Article 6(1)(f)).
• Website analytics: consent (Article 6(1)(a)), given in the cookie banner and withdrawn there or on our cookie policy page.
• Marketing data: consent (Article 6(1)(a)).

4. Recipients and sub-processors

We use the sub-processors below to deliver the Schools Portal. Each is bound by written terms with equivalent data protection obligations. Signed-in staff can also open the current list from Compliance.

The encrypted daily backups of our database are held by GitHub for 30 days. We will give your school at least 30 days' written notice, by email to its school admins and under Compliance in the portal, of any addition to this list or change of location, during which you may object on reasonable data protection grounds. Nothing is sent to a new sub-processor before then.

MIS sync (All subjects add-on): when it is available and a school chooses to connect its management information system, the school's pupils' names and MIS ids, year groups, groups and staff (and pupil flags, only if the school has turned them on) come to us through Wonde Ltd, in the UK. We check the connection is for the right school before any data flows, any access token is encrypted, and the school can pause or disconnect it at any time. Until a school connects, nothing flows: pupils are added by pasting or uploading class lists from the school's own MIS.

5. International transfers

The Schools Portal and its database are hosted by Railway in the United States (Railway, US West), and the encrypted backups are held by GitHub in the United States. Where personal data goes to a sub-processor outside the UK, we rely on the safeguard listed for it above: for the United States, the ICO's UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified, with technical measures such as encryption in transit and at rest. We will tell your school 30 days before our hosting location changes.

6. Retention

As processor, we keep school data for the length of the licence. An automated job that runs every night then enforces these periods:

• When a licence ends, the school keeps full access for 30 days. It is then cancelled, and everything is deleted 30 days later. Every school admin is emailed 30 and 7 days before. The same applies when a school admin closes the account, or after 11 months' suspension.
• Pupils who leave (pupil records): deleted after the school's chosen period (365 days unless it changes it, from 30 to 1,095), never sooner than 14 days after. PSHE class lists go with the class.
• Filtering records: 12 months from the event, unless the school chooses 3 to 24 months.
• Historical incident records: 6 years from the incident, unless the school chooses 1 to 6 years.
• The resource access log: 24 months. Failed sign-ins: 90 days.
• The audit trail of changes made in the portal: 6 years. Entries about the security of the service are kept after that with names, email addresses and free text removed; when a school is deleted, its staff's entries are pseudonymised straight away.
• Encrypted backups: 30 days.

As controller, we keep invoices and payment records (in Stripe and our accounts) for 6 years after the end of the financial year they belong to, as UK tax law requires; supplier correspondence for 3 years from last contact; and marketing data until you unsubscribe.

7. AI and automated processing

We use Anthropic's Claude to help draft threat-alert summaries from publicly available UK online safety information.

• No school or pupil personal data is sent to Anthropic for this.
• Under Anthropic's commercial terms it doesn't use what we send to train its models, and it deletes it within 30 days (or keeps it up to 2 years if its automated systems flag it for a breach of its usage policy).
• No decision affecting anyone is made solely by automated processing within the meaning of UK GDPR Article 22.
• The portal tells staff that alerts may be drafted with AI help.

Report comment drafting (All subjects add-on) is off unless a school admin turns it on. When a teacher asks for a draft, we send Anthropic only the pupil's first name (once a teacher has confirmed it), year group, subject and the teacher's assessments, and, for subjects with statements, the short labels of the strengths and next steps the teacher ticked from the pupil's statement passport; never a surname, notes, flags, group names or passport grades. The teacher edits the draft and signs it off before it is used, so no decision is made by AI.

8. Data subject rights

For data we process as processor, data subjects should send rights requests to their school as controller. If someone asks us directly, we pass the request to the school. We help schools respond within statutory timeframes, including through:

• A self-serve export of all your school's data as a file (school admins, from Compliance).
• One pupil's records, as a file or a printable page, for a subject access request (school admins, from Compliance).
• Self-serve correction and deletion of records, and account closure (school admins, from Account), with a 30-day window before permanent deletion.
• Direct support at dpo@digitalshields.co.

For data we hold as controller, contact us directly (section 12).

9. Security

Our technical and organisational measures are set out in Annex II of our Data Processing Agreement. In summary:

• TLS in transit, encryption at rest for the database, and daily backups encrypted before they leave our build server.
• Passwords hashed with bcrypt (cost 12); HttpOnly, SameSite and Secure cookies; CSRF protection on every change.
• Security headers, parameterised SQL, output escaping and rate limiting on sign-in.
• Two-step verification (TOTP) required for every school admin and everyone on our team; optional for other staff unless the school requires it for everyone.
• Role-based access: only school admins see the staff roster, billing and compliance records.
• No analytics or third-party scripts in the Schools Portal.
• Personal data breach notification to the school's admins without undue delay, and within 72 hours at the latest.
• Stripe-hosted checkout, so card data never touches our servers.

We are Cyber Essentials certified by the IASME Consortium, the NCSC-appointed certification body (certificate 455d8005-7a64-4e20-99e2-1ae94d37d797, certified 3 June 2026, valid until 3 June 2027), and enrolled in the National Cyber Security Centre's Active Cyber Defence programme through its Early Warning service. A copy of the certificate is available to school DPOs on request.

10. Cookies

The Schools Portal uses only strictly necessary cookies, to keep you signed in and protect forms; it never loads analytics. On our public pages (such as /for-schools), Google Analytics runs only if you choose “Accept” in our cookie banner, and you can change that choice at any time. See our Cookie Policy for the full list.

11. Changes to this notice

We will email school admins about any material change at least 30 days before it takes effect. The current version is always at www.digitalshields.co/schools/privacy. Changes to our licence terms or Data Processing Agreement also need a school admin's acceptance.

12. Contact

Data protection: dpo@digitalshields.co, handled by the company director responsible for data protection. We are not required to appoint a Data Protection Officer and have not.
General support: support@digitalshields.co
Controller for our own processing: Infinity X Investments Ltd, trading as Digital Shields, company number 16998775, registered in England and Wales. Registered office: Floor 2, Lakeside Tower, Lakeside Business Park, Walkmill Way, Cannock, Staffordshire, WS11 0XE. ICO registration ZC142619.

Complaints. If you're unhappy with how we have handled personal data, tell us first at dpo@digitalshields.co. We acknowledge a complaint within 5 working days and give you our answer within 30 days; if it needs longer, we tell you why and when to expect it (at most 3 months). If a complaint is about a school's own use of the portal, we pass it to the school, as controller. You can also complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · ico.org.uk/make-a-complaint · 0303 123 1113.