Privacy policy
Last updated: 22 July 2026
This notice is maintained by the school / alternative provision using Aspire Connect. It explains how personal data is processed in this platform. It is not legal advice; contact the school's Data Protection Officer for statutory requests.
1. Who we are
Aspire Connect is used by Aspire Academy and its partner schools to record attendance, behaviour, safeguarding, medical and staff information. The school acts as the Data Controller for pupil, parent/carer and staff personal data entered here.
ICO registration number: ZC021292 (verifiable at ico.org.uk).
2. Data we process
- Pupil identity: legal name, preferred name, date of birth, school year, contact details, commissioning body.
- Attendance: DfE statutory session codes, notes and lateness marks.
- Safeguarding: concerns, category, severity, actions, linked pupils and staff.
- Behaviour: rewards, sanctions, points balances.
- Medical: first-aid log entries, medication administration records.
- Staff HR: vetting checks, DBS/references, supervision notes, training, payroll fields (NI number, wages).
- Audit metadata: who viewed or changed a record and when.
3. Lawful basis (UK GDPR)
- Public task (Art. 6(1)(e)) for statutory attendance, safeguarding and Keeping Children Safe in Education duties.
- Legal obligation (Art. 6(1)(c)) for DfE returns, safeguarding referrals, and DBS/SCR records.
- Vital interests (Art. 6(1)(d)) for medication and first-aid records.
- Special-category data (Art. 9(2)(g) / DPA 2018 Sch. 1) for safeguarding and medical information.
- Contract (Art. 6(1)(b)) for staff HR data.
4. Retention schedule
Records are retained in line with the Information and Records Management Society (IRMS) toolkit for schools. Automated purge runs nightly; see the retention admin area for the current schedule and last run.
| Category | Retention | Trigger |
|---|---|---|
| Attendance registers & DfE codes | Current year + 6 years | End of academic year |
| Safeguarding concerns & chronology | Until pupil age 25 | Date of birth + 25 years |
| Low-level concerns log | Until pupil age 25 | Date of birth + 25 years |
| Behaviour rewards & sanctions | Current + 3 years | Date of entry |
| Medication & first-aid log | Until pupil age 25 | Date of birth + 25 years |
| Complaints log | 7 years from resolution | Complaint closed |
| Exclusions & suspensions | Until pupil age 25 | Date of birth + 25 years |
| Staff HR / SCR records | 7 years after leaving | Employment end date |
| Supervision & training records | 6 years | Date of record |
| Audit log & access log | 7 years | Date of event |
| Parent/carer portal accounts | Duration of pupil enrolment | Pupil off-roll |
| Signed Acceptable Use Policies (pupils/parents) | Current + 3 years | New AUP version |
| Data breach register | Permanent | n/a |
5. Who can see what
- Staff role: their assigned pupils and their own HR record.
- DSL / safeguarding lead: safeguarding, medical and first-aid records.
- Admin role: full access, including SAR hub and audit log.
- All access is authenticated, RLS-enforced, and logged.
6. Security
- TLS in transit and encryption at rest by our hosting provider.
- Multi-factor authentication (TOTP) available for all staff accounts.
- Passwords checked against the "Have I Been Pwned" leaked-password list.
- 30-minute idle logout and full audit trail on sensitive records.
7. Sharing
Data is shared only with the commissioning school, statutory partners (LA safeguarding team, DfE returns, police/social care where a lawful referral is required) and processors listed on request. We do not sell data or use it for marketing.
8. Your rights
You may request access, rectification, restriction, erasure or a data-portability copy. Contact the school's DPO. Admins can fulfil Subject Access Requests through the SAR hub. You may complain to the Information Commissioner's Office at ico.org.uk.
9. Contact — Data Protection Officer
Sam Riches, Data Protection Officer — Aspire Academy
Post: DPO, c/o Aspire Academy main office
Email: sam.riches@aspireconnect.org.uk
You may complain to the Information Commissioner's Office at ico.org.uk, quoting registration ZC021292.
Related documents: DPIA · Record of Processing Activities · Accessibility statement
This notice may be updated; the "last updated" date above reflects the current version.