School Responsibilities Framework

1. Purpose of this framework

A school using AkademicNest, and AkademicNest itself, both handle personal information about the same people: pupils, parents and staff. This framework sets out clearly who is responsible for what, so that nothing is overlooked.

It does not move AkademicNest's own obligations onto schools. AkademicNest's responsibilities are set out in section 5.

2. Roles

Controller means the party that decides why and how information is processed. Processor means the party that processes it on the controller's instructions.

Areas that require judgement

• Payment receipts. AkademicNest decides that receipts are checked automatically and sets the criteria. AkademicNest is therefore treated as controller for that check, which runs on AkademicNest's own servers.
• Security records of school users' activity. AkademicNest decides to keep these for its own purposes and is treated as controller.
• Website content. The school publishes it, while AkademicNest provides the template and hosting. The school is treated as controller for the content and any personal information in it.

3. What AkademicNest processes, and on what instruction

AkademicNest processes personal information on behalf of a school only to:

1. provide the platform and the school's account;
2. store, display and organise the records the school enters;
3. generate documents from them, such as report cards, ID cards and results;
4. deliver the notifications the school sets up;
5. operate the school's public website and send visitor submissions to it;
6. back up, secure and monitor the service;
7. investigate and fix faults, including at the school's request;
8. comply with a legal obligation.

The subscription agreement is the school's instruction. AkademicNest will not process a school's personal information for any other purpose. In particular, AkademicNest will not use it:

• to train or improve machine learning models;
• for advertising or marketing to a school's pupils, parents or staff;
• to sell, rent or license it;
• to share it with any other school;
• for AkademicNest's own analytics beyond the operational records described in the Privacy Policy.

If AkademicNest is legally required to process a school's data in any other way, we will tell the school first unless the law forbids it.

4. School responsibilities

A school using AkademicNest is responsible for the following matters, which only the school is in a position to handle.

4.1 Lawful basis and authority

Establishing its own legal basis for recording each category of information and having the authority to enter it. This includes deciding whether it needs parental permission for anything it records or publishes about a pupil.

4.2 Accuracy

All information is entered by the school, and AkademicNest does not verify it. Grades are calculated from the scores and grading bands the school sets. Incorrect inputs produce incorrect report cards, and the school is responsible for them.

4.3 Informing people

Most people whose information is in AkademicNest did not enter it themselves. Informing pupils, parents and staff that their information is held, why it is held, and what their rights are is the school's responsibility, because AkademicNest has no direct relationship with them.

4.4 Managing users and access

Creating accounts, assigning roles and, importantly, removing access promptly when someone leaves. A former teacher with an active account can still see pupil records, and AkademicNest cannot know that they have left.

4.5 Credentials

Keeping administrator credentials secure, not sharing accounts, and instructing users to do the same. Strong, unique passwords are essential, because a password protects access to a school's entire pupil roll.

4.6 Appropriate use

Using pupil information only for the school's proper purposes, not exporting it to insecure places, and taking care of printed report cards and ID cards, which are no longer protected by the platform once printed.

4.7 Requests from individuals

Handling requests from pupils, parents and staff about their own information, as the school is the controller. AkademicNest will help where a school needs it.

4.8 Retention

Deciding how long to keep records, in line with the school's legal obligations. AkademicNest does not delete a school's records on its own initiative and does not know each school's retention obligations.

4.9 Website content

Everything published on the school's public website, including having the right to publish any photograph of any pupil or member of staff. A photograph published on a public website can be seen by anyone.

4.10 Visitor submissions and job applications

Handling contact enquiries, pupil conduct reports and job applications appropriately, including anything a member of the public reports about a child. AkademicNest does not investigate these submissions and takes no position on them.

4.11 Compliance

Complying with education law, data protection law and any other law that applies to the school. AkademicNest provides a tool; using it does not by itself make a school compliant.

5. AkademicNest responsibilities

These responsibilities apply in all cases and do not depend on the school meeting its own.

5.1 Processing only on instruction

As set out in section 3.

5.2 Security

Implementing appropriate technical and organisational measures, as described in the Security & Data Handling Statement, and continuing to improve them.

5.3 Confidentiality

Ensuring that anyone with access to school data is bound by confidentiality.

5.4 Service providers

Telling schools which service providers are used (Privacy Policy, section 8) and remaining responsible for their performance. These currently include the hosting provider, the email provider and the font providers.

Material changes to this list will be notified in advance.

5.5 Assisting the school

Helping, as far as reasonably possible, with requests from individuals, impact assessments and regulator enquiries relating to data AkademicNest processes for the school.

5.6 Breach notification

Notifying the affected school without undue delay after becoming aware of a breach affecting its data, with enough detail for the school to meet its own obligations.

5.7 Deletion and return

When the subscription ends, deleting or returning the school's personal data as the school directs, subject to legal retention obligations and backups.

Please note. Bulk export is not yet available, so returning data currently means AkademicNest arranging a copy on request.

5.8 Records and audit

Keeping records of processing, and providing what a school reasonably needs to verify compliance.

6. Individual users

Staff, pupils and parents are responsible for:

• keeping their password confidential and not sharing their account;
• signing out on shared devices, and not using "remember me" on them;
• using the account only for the purpose their school provided it for;
• not attempting to access records they are not entitled to see;
• reporting anything that looks wrong rather than exploring it;
• for staff, treating pupil information as confidential, both on screen and on paper.

7. Responsibilities at a glance

8. Changes

We will notify School Administrators of material changes before they take effect.

9. Contact