Data protection — information for schools

No. We hold no pupil records of any kind. There are no accounts for children, and no part of our service asks for a pupil's name, date of birth, UPN, school or any identifying detail.

Our pupil-facing tools are built so information about a child never leaves the staff member's device. All About Me, Social Story Studio and the Spark 11+ modules are session-only — what a member of staff types exists on screen and in the document they print, and is gone when the page closes. Speak Spark stores boards, custom words and any photos in the browser's own storage on that device; we cannot see them.

Any profile or board your staff print is your document, and your setting remains the controller for it.

For each module a member of staff completes, we record:

• the name they chose to put on their certificate
• their account email address
• the module, its version, and the strand it belongs to
• their quiz score, number of attempts and time spent on the module
• a unique certificate reference and the CPD minutes credited

No special category data is collected. No free-text about pupils is collected. Optional module feedback (a rating and an optional comment) is separate and can be left anonymously.

For staff training records the school is the controller and Sensory Spark is the processor. We process those records only to deliver the training, issue certificates and support verification — never for our own purposes, never for marketing, and never for training AI models.

For our direct customer relationship with the individual account holder (email address, purchases) we are the controller, on the basis of contract and our legal obligation to keep transaction records.

• Training records: 6 years, so certificates remain verifiable for staff files and inspection
• Purchase and licence records: 6 years, as required by UK tax law
• Account data: while the account is open, then 12 months
• Feedback: 3 years · Technical logs: 24 months

On request at the end of a licence we will delete or return staff records, other than the minimal entry needed to verify a certificate already issued.

Our sub-processors, each covered by a data processing agreement:

Where processing happens outside the UK it is covered by the UK International Data Transfer Agreement or standard contractual clauses. We will tell you before adding a sub-processor that handles staff records.

• All data encrypted in transit (TLS) and at rest
• Row-level access rules enforced at the database, so an account can only ever reach its own records; a school administrator sees only their own staff
• Administrative access limited to the service owner, with authenticated access only
• Card details never touch our systems — payments are handled entirely by Stripe
• Internal review materials, including quiz answer keys, are access-restricted

In the event of a personal data breach affecting your staff records, we will notify your nominated contact without undue delay and within 72 hours of becoming aware, with the detail you need to meet your own obligations to the ICO.

A member of staff can ask us for a copy of their record, to correct it, or to have it deleted, by emailing support@sensoryspark.co.uk. We respond within one month, free of charge, and will let the school know where a record forms part of your training evidence. Complaints can be made to the Information Commissioner's Office at ico.org.uk.

• A countersigned copy of our data processing agreement (UK GDPR Article 28 terms — already binding, signature on request)
• Written answers to your own supplier due-diligence questionnaire
• Information to support your DPIA, including the categories, purposes, retention and safeguards above
• Verification of any certificate reference held in a staff file

Email support@sensoryspark.co.uk and we will respond within three working days.