Record of Processing Activities
Article 30 UK GDPR · Summary version. Full signed ROPA held by the DPO.
Controller: Aspire Academy (and the commissioning school where jointly controlled).
Data Protection Officer: Sam Riches — sam.riches@aspireconnect.org.uk · ICO reg. ZC021292.
Processor: Aspire Connect platform hosting provider (EU/UK region).
| Activity | Categories of data | Data subjects | Lawful basis | Recipients | Retention |
|---|---|---|---|---|---|
| Attendance registers & DfE returns | Name, DOB, session codes, notes | Pupils, parents | Public task; Legal obligation | School staff, LA, DfE | Current + 6 years |
| Safeguarding concerns & chronology | Concern detail, DSL notes, referrals, special-category data | Pupils, siblings, adults involved | Public task; Art. 9(2)(g) | DSL, deputy DSL, LA social care, police (as required) | Until age 25 (IRMS) |
| Behaviour rewards & sanctions | Points, incident description, staff issuer | Pupils, staff | Public task | School staff | Current + 3 years |
| Medication & first-aid log | Condition, dose, times, administrator | Pupils, staff | Vital interests; Art. 9(2)(h) | First-aiders, DSL, parents | Until age 25 |
| Staff HR / SCR | Name, address, DBS, right-to-work, references, NI, wages | Staff, contractors | Contract; Legal obligation | HR lead, payroll processor | 7 years after leaving |
| Supervision & training | Reflective notes, attendance at CPD | Staff | Contract | HR lead, line manager | 6 years |
| Parent/carer portal access | Contact, portal audit | Parents, carers | Public task | Named parent only | Duration of pupil enrolment |
| Audit log | Actor, action, target, JSON diff | All staff & portal users | Legal obligation; legitimate interests (security) | Admin, DPO on request | 7 years |
International transfers: none outside the UK/EEA. Sub-processor list available from the DPO on request.