Data protection

Every school using Senc0. receives a Data Processing Agreement covering Article 28 UK GDPR. We act only on documented instructions and do not determine purposes of processing.

Production data sits in UK data centres. Backups are held in the same jurisdiction. We do not transfer pupil personal data outside the UK or EEA without the school’s written instruction and an approved transfer mechanism.

• Hosting & database: Lovable Cloud (UK region). Encrypted at rest and in transit.
• Transactional email: used only for magic-link sign-in and critical service notifications.
• Error reporting: stack traces with personal data redacted. 30-day retention.

The current definitive list is shared in your DPA. We notify schools of additions with 30 days’ notice.

Pupil fields are constrained to the statutory SEND record: UPN, name, DOB, year group, SEND status, concerns, APDR cycles, provision. Free-text fields on notes and reviews are the only unstructured data; SENCOs control what goes in.

On cancellation, your school keeps full read/write access for 30 days. Every record is exportable as CSV or PDF. After 30 days, live data is deleted within 30 days; backup copies purge within 90 days.

If we detect a personal-data breach affecting school records, we notify the school’s nominated contact without undue delay and in any event within 72 hours. We’ll share known facts, likely consequences, and mitigation steps in plain language.

Sign-in is by magic link or Google Workspace. MFA is available for SENCOs and admins. Audit logs record who viewed or changed each pupil record. Support staff at Senc0. access production data only with a named incident ticket and school consent.

Data protection questions, DPA requests, and subject-access support: hello@senc0.com.