Data protection and UK GDPR

Who is responsible for what

For pupil, staff and family information held in ASEND360, your school or trust is the data controller and ASEND360 Limited is the data processor. We process that information only to provide the platform to you, on your documented instructions, under a written data processing agreement as required by Article 28 of the UK GDPR.

For enquiries sent through this website, ASEND360 Limited is the controller. That is covered by our privacy notice.

Where your data is stored

Pupil records, uploaded files and the server-side processing that works on them are all held in the UK, in our database provider’s London data centre. The files that make up the website and the app’s screens are delivered through a content network, but they contain no pupil records.

Sub-processors

We use a small number of specialist providers to run ASEND360:

• Supabase — database, file storage and server-side processing, in the UK (London).
• Netlify — delivers the website and app files. No pupil records are stored with Netlify. Netlify is certified under the UK Extension to the EU–US Data Privacy Framework.
• Resend — sends account and notification emails.
• Wonde — connects ASEND360 to your MIS, only where your school chooses to use it.
• Push notification services — if a user chooses to turn on notifications, they’re delivered through that user’s own browser or device provider (Google, Apple, Mozilla or Microsoft).

The full list, with locations and transfer safeguards, is in our DPIA Support Pack. We’ll tell you before adding or replacing a sub-processor.

How we protect the data

• Each school’s data is isolated at database level, so one school can never see another’s.
• Access is controlled by role, and the most sensitive records — safeguarding, and allegations against staff — have tighter, tiered access.
• Changes to records, and views of pupil profiles, are logged.
• Data is encrypted in transit and at rest.
• Web addresses use random identifiers, never names, and pupil details aren’t stored in the browser.
• There is no AI built into ASEND360 at present, and pupil information isn’t sent to any AI model.

More detail is on our security page.

Your DPIA

SEND, health and safeguarding records are special category data about children, so your school should complete a data protection impact assessment before using ASEND360. Our DPIA Support Pack sets out what data the platform processes, why, where, who can access it and the risks and safeguards, so your DPO can complete your assessment quickly. We update it as the platform develops.

Individuals’ rights

As controller, your school responds to requests from pupils, parents and staff, such as subject access, correction or erasure. ASEND360 helps you meet them: you can export a pupil’s full record, correct information directly, and ask us for any assistance you need within the legal deadlines.

Retention and leaving

Your school decides how long records are kept, in line with its own retention policy. If you leave, you can export your data first, and we then delete it in line with your instructions and our data processing agreement.

If something goes wrong

If we become aware of a personal data breach affecting your school’s data, we’ll tell you without undue delay, with the information you need to decide whether to report it to the ICO, which must be done within 72 hours where required.

Our registration

ASEND360 Limited is registered with the Information Commissioner’s Office (registration ZC273399) and in England and Wales (company no. 17492700). Registered office: 66 Paul Street, London, EC2A 4NA.