SchoolJewel

Data Processing Agreement: your school’s record

5 November 2026 · Version 1.2

This sheet is the school’s record of the SchoolJewel Data Processing Agreement (DPA). The full agreement forms part of the SchoolJewel Terms and takes effect automatically when the school first enters pupil or staff information. You can read it at https://schooljewel.com/data-processing-agreement/. Keep this sheet with your records under Article 28 of the UK GDPR. If your policies need a countersigned copy, email info@schooljewel.com.

1. The parties

Effective date: (the day the school first entered personal data into SchoolJewel).

2. What is processed

Features in use:

• Points and class management (always on)
• Prize Shop (including thank-you messages to staff)
• House competition (Cup and Crown)
• Personal Best

3. Where it is processed and who helps

Our hosting provider is based in the European Union, and all of our servers are located within the European Union. Backups of the database, which holds all personal information, are encrypted on our server before they leave it, and are then copied to encrypted storage with Amazon Web Services (AWS) S3 in the European Union. Backups are overwritten on a rolling basis and are kept for up to 90 days from the date each backup was created. Payment details of School Leaders are handled by Stripe, an independent controller that never receives pupil information. We will not transfer pupil information outside the UK or EEA without the safeguards required by law and at least 30 days’ notice.

4. What we have committed to (summary)

• We process School Personal Data only on the school’s instructions, and never for marketing, advertising, selling or training AI.
• Everyone with access is bound by confidentiality, and access is limited to what is needed for support and maintenance.
• We use the security measures set out in the DPA and in the Security and supplier information sheet.
• We tell the school before adding a sub-processor, and give at least 30 days’ notice.
• We help the school with rights requests, impact assessments and incidents, and tell the School Leader about a personal data breach without undue delay, aiming for within 48 hours.
• We delete School Personal Data within 30 days of the school’s request, or 90 days after a paid membership ends without renewal. Backups roll over within 90 days of creation.

5. The school’s confirmations

• We have chosen a lawful basis for using SchoolJewel:
• Our privacy notice for families and staff mentions SchoolJewel
• We have considered whether a DPIA is needed and recorded the outcome
• Staff know what must never be entered (see the Staff quick guide)
• We have decided how pupils are named and will remove leavers each year

6. Signatures (optional)