SchoolJewel
Data Protection Impact Assessment (DPIA)
Under Article 35 of the UK GDPR a DPIA is needed where processing is likely to result in a high risk to individuals. SchoolJewel processes information about children, so completing a DPIA is good practice even where it is not strictly required. Boxes with a dotted outline are for your school to complete. Everything else is pre-filled from how SchoolJewel works, so please check it against your own use.
1. Screening
| Question | Answer |
|---|---|
| Does it involve children’s data? | Yes |
| Special category or criminal offence data? | No, provided the school follows the guidance not to enter any |
| Systematic monitoring, large-scale profiling, automated decisions with legal effect, or location tracking? | No. Points and Personal Best figures are simple calculations, not decisions about pupils |
| New or intrusive technology? | No. Standard web technology; no biometrics, AI or location data |
| Our conclusion on whether a DPIA is required |
2. Description of the processing
Nature. SchoolJewel is a web-based recognition platform. Teachers award points in three categories (Hero for effort and courage, Sage for curiosity and thinking, Guardian for kindness and teamwork). Pupils can see their own points, spend them on privileges the school chooses, send pre-approved thank-you messages to staff who have opted in, and see their own Personal Best. LD Pro hosts the platform and acts as the school’s processor.
Information processed.
- Pupils: a name for each pupil, entered by the school (see the naming choice); a generated username and password for the login card; class, school, year group and (if used) House; points awarded or removed (category, amount, date, time, and which teacher); Prize Shop orders and, if a pupil shares a prize, the classmate chosen; pre-approved thank-you messages sent to a named member of staff; calculated Personal Best figures and records of which celebrations a pupil has seen.
- Staff: name, username, password (hashed), professional name if opted in, thank-you messages received, and a School Leader email address.
Not processed: pupil email addresses, dates of birth, addresses, photographs, special educational needs, health, ethnicity, religion, free school meal or pupil premium status, behaviour records or safeguarding records. Pupils cannot type free text or upload anything.
How pupils are named:
Scope. Pupils: . Classes: . Year groups: . Staff users: .
Features in use:
Context. Pupils are primary-aged. Accounts are created only by teachers. Pupils cannot contact one another, upload content or buy anything. There are no adverts or tracking for advertising, and families do not have accounts. Anything specific to your pupils that affects risk:
Location and retention. Hosted by Websupport s. r. o. (EU). Our hosting provider is based in the European Union, and all of our servers are located within the European Union. No transfers outside the UK or EEA. Pupils are kept while they are in SchoolJewel; deleting a pupil or class removes the linked records. Backups of the database, which holds all personal information, are encrypted on our server before they leave it, and are then copied to encrypted storage with Amazon Web Services (AWS) S3 in the European Union. Backups are overwritten on a rolling basis and are kept for up to 90 days from the date each backup was created.
3. Roles, lawful basis and transparency
| Question | Answer |
|---|---|
| School’s role | Controller: |
| Processor’s role | Vladimir Keves, a sole trader trading as LD Pro, under the DPA that forms part of the Terms |
| Lawful basis (Article 6) | |
| Special category condition (Article 9) | Not applicable (none processed) |
| How families are told |
4. Consultation
| Who | Outcome |
|---|---|
| Data protection lead or DPO | |
| Designated safeguarding lead | |
| IT lead | |
| Staff, pupils and parent representatives | |
| The processor | Available at info@schooljewel.com to answer questions and provide security information |
5. Necessity and proportionality
| Principle | Assessment |
|---|---|
| Purpose limitation | Processed only on the school’s instructions. No marketing, advertising, selling or AI training |
| Data minimisation | Only a name, class and recognition records are needed. Full names are not required, and a first name and initial is recommended. No contact details, dates of birth or sensitive data are collected. Pupils never type free text |
| Accuracy | Teachers can rename pupils and correct points with a recorded removal |
| Storage limitation | Pupils can be deleted at any time. Our process for removing leavers: |
| Integrity and confidentiality | HTTPS, role-based access, ownership checks on every request, hashed teacher passwords. See the Security and supplier information sheet |
| Individual rights | Requests go to the school. The school can edit or delete records itself and the processor assists |
| Processors and sub-processors | See the Services and sub-processors list |
| International transfers | None. Servers are within the EU |
| Children’s Code | Designed with the ICO’s Age Appropriate Design Code in mind: minimal data, high privacy, no advertising profiling, no nudges to spend, no pupil communication |
| Automated decisions | None. Points and Personal Best are calculated but never used to decide anything about a pupil. The school must not use them for assessment, grading or sanctions |
6. Risk assessment
Likelihood: Remote / Possible / Probable. Severity: Minimal / Significant / Severe. Overall: Low / Medium / High. The suggested ratings assume a typical school using first names and initials. Please review them.
| # | Risk | Suggested rating | Measures | Residual risk (school) |
|---|---|---|---|---|
| 1 | Full names or extra information (for example SEN or medical notes) are entered | Possible / Significant / Medium | Use first name and initial. Staff guide on what never to enter. Pupils have no free text. Terms forbid sensitive data. Spot checks by the School Leader | |
| 2 | A login card is lost, shared or seen | Probable / Minimal / Low | Cards unlock only that pupil’s own points, prizes and messages. Keep cards secure; issue a new password at once | |
| 3 | Unauthorised access to an account | Possible / Minimal (pupil) or Significant (staff) / Low to Medium | Teacher passwords are random and shown once. Pupil accounts expose no sensitive data. Do not share staff logins. Remove leavers | |
| 4 | Points used to rank, compare or shame pupils | Possible / Significant / Medium | No ranking built in; Personal Best compares only with the pupil’s own past; House scores are per pupil. Staff guidance: do not display individual totals or link to sanctions | |
| 5 | Points used for assessment or behaviour sanctions | Remote / Significant / Low | Terms forbid it; no automated decisions. School policy statement: | |
| 6 | Pupils or families not informed | Possible / Significant / Medium | Update the privacy notice using the parent notice template | |
| 7 | Data kept after pupils leave | Possible / Minimal / Low | Remove leavers each year; deletion removes linked records; deletion on request within 30 days | |
| 8 | Personal data breach at the supplier or its host | Remote / Significant / Low | HTTPS, access controls, limited staff access, EU hosting. Supplier notifies the school without undue delay, aiming for 48 hours | |
| 9 | Thank-you messages seen by the wrong person | Remote / Minimal / Low | Only the named teacher and the School Leader can read them; fixed list of kind messages | |
| 10 | A pupil is treated unfairly because a prize needs food or money (a welfare risk) | Possible / Minimal / Low | The school chooses and funds prizes, checks allergies, favours non-material privileges and can pause anything | |
| 11 | Difficulty answering a rights request | Possible / Minimal / Low | Small, well-defined data set; export on request. See the Rights requests guide | |
| 12 |
7. Outcome and sign-off
| Item | Name and date |
|---|---|
| Measures approved by | |
| Residual risks approved by | |
| DPO or data protection lead advice | |
| Advice accepted or overruled (give reasons) | |
| If a high residual risk remains, the ICO must be consulted before processing starts | |
| Date of this DPIA and next review (we suggest yearly, or when the service changes) | Completed 6 November 2026. Next review |