School and Trust Compliance Centre
Everything a headteacher, data protection lead, governor or trust board needs to adopt SchoolJewel with confidence: how pupil data is safeguarded, and ready-to-print documents with your school’s details filled in.
Log in as a school leader or teacher and the documents fill in your school’s details for you
You choose how pupils are named
The most important thing to know about SchoolJewel and pupil data.
We do not need pupils’ full names. The name is only there so your own teachers recognise each pupil. SchoolJewel works in exactly the same way whichever option you choose, and the choice is entirely your school’s.
How we safeguard pupil data
Safe by design: we collect less, so there is less to protect.
Names are your choice
You decide how pupils appear: first name, first name and initial, a class code, or a full name. Full names are never needed.
Almost nothing collected
No pupil emails, dates of birth, addresses, photos or sensitive information. We hold a name, class, House and recognition records.
No free text, no chat
Pupils cannot type, upload, message or comment. Thank-you notes to staff come from a fixed list of kind messages.
Everyone sees only their own
Pupils see their own points. Teachers see their own class. School leaders see their own school. Every request is checked on the server.
Staff passwords done properly
Teacher passwords are random, shown once and stored hashed. A new password signs out every open session.
Login cards for young children
Pupil cards are simple by design and unlock only that pupil’s own points. A teacher can issue a new password at any time.
Hosted in the EU
Pupil information is stored in the European Union, with encrypted backups in EU storage, and is not transferred outside the UK or EEA. All traffic uses HTTPS.
Delete when you like
Remove a pupil or a class instantly. A whole school is deleted within 30 days of a request. Backups are overwritten within 90 days of creation.
No advertising, selling or AI
We never advertise, sell data, use it for marketing, or use it to train AI. Points and Personal Best are never used to make decisions about pupils.
Our hosting provider is based in the European Union, and all of our servers are located within the European Union. Backups of the database, which holds all personal information, are encrypted on our server before they leave it, and are then copied to encrypted storage with Amazon Web Services (AWS) S3 in the European Union. Backups are overwritten on a rolling basis and are kept for up to 90 days from the date each backup was created. Your school is the data controller and we act as your processor under a Data Processing Agreement that is part of our Terms.
Your documents
Each opens in a new tab, ready to print or save as a PDF. Boxes can be typed into before you print. Nothing is saved or sent anywhere.
Agreements and records
For your data protection file.
Data Processing Agreement: your school’s record
A cover sheet for the DPA that records the parties, what is processed and where, with an optional signature block.
Record of processing entry (Article 30)
A ready-made entry for your record of processing activities.
Retention and deletion schedule
What SchoolJewel keeps, for how long, and what your school will do.
Services and sub-processors list
Every organisation and technology involved, and what each one receives.
Assessments and notices
To assess the risks and tell families.
Data Protection Impact Assessment (DPIA)
A pre-filled DPIA with a 12-point risk table and fill-in boxes for your decisions.
Privacy notice for parents and carers
A plain-English notice you can adapt and add to your school privacy notice.
Pupil-friendly summary
A one-page explanation for children, to read aloud or put on the wall.
Guidance for staff
Short, practical, for the staffroom.
Staff quick guide: naming pupils and staying safe
One page for every teacher: how to name pupils, what never to enter, and login-card care.
Rights requests guide
How to answer a request from a parent, carer or member of staff about SchoolJewel data.
Data incident contact sheet and log
What to do if something goes wrong, who to call, and a log for your records.
For governors, IT leads and trusts
Answers to the questions boards and IT teams ask.
Security and supplier information sheet
The answers to a typical supplier security questionnaire, written plainly.
Information for trusts and multi-academy trusts
How a trust becomes the controller, signs once, and rolls out school by school.
Trusts and multi-academy trusts
In an academy, the trust is normally the data controller. A trust can accept the Data Processing Agreement once, and each school registers its own account and chooses its own naming approach. There is no trust-wide dashboard yet, and pupil information is never shared between schools. See the trust information sheet above.
A suggested order for your school
- Decide how pupils will be named (above). Record it in the DPA record.
- Complete the DPIA and the record of processing entry, with your data protection lead.
- Add SchoolJewel to your privacy notice using the parent notice, and share the pupil summary in class.
- Give every teacher the staff quick guide, then set up classes and print login cards.
- File the DPA record, services list and retention schedule with your data protection records.
- Diarise a yearly review, and remove leavers each summer.
Our legal pages
Provided by Vladimir Keves, a sole trader trading as LD Pro. ICO registration ZB688986. Questions: info@schooljewel.com. Last reviewed November 2026.
The documents are templates to help schools meet their responsibilities. They are not legal advice, and each school remains responsible for its own decisions.