1. Introduction
School Wrap is a product of School Window Ltd (“School Window”) (UK Company Number:13051773). This policy outlines how School Window processes and protects personal data incompliance with the UK General Data Protection Regulation (UK GDPR), the General Data Protection Regulation 2016/679 (EU GDPR), and the Australian Privacy Act 1988.
School Wrap provides organisations with an AI-powered newsletter creation and distribution platform (the "Platform"). The Platform processes limited personal data of authorised staff users only. Parent and student data is not collected or processed by School Wrap.
2. Roles and Responsibilities
School Window acts as a Data Processor on behalf of its customers, who act as Data Controllers. School Window processes personal data only under the documented instructions ofthe Controller.
3. Types of Personal Data Processed
The Platform collects and processes the following personal data relating to authorised staff and administrator accounts only:
● First and last name
● School email address
Parent, student, and end-recipient data is not collected, stored, or processed by School Wrap.
4. Hosting & Data Storage
All personal data is:
● Hosted on encrypted Google Cloud servers located in London, United Kingdom (region: europe-west2-c)
● Encrypted at rest using industry-standard encryption
● Transmitted over secure TLS 1.2+ connections
Google Cloud maintains internationally recognised security and compliance certifications, including ISO 27001 and SOC 1/2/3. Physical infrastructure and data centre security are managed by Google.
5. Security Measures
School Window implements a layered approach to security, including the following controls:
● Data encryption: AES-256 encryption for data at rest; TLS encryption in transit
● Access control: Role-based access, with least privilege enforcement
● Audit logs: All access to production systems is logged and monitored
● Authentication: Passwords and credentials are stored securely; MFA is enforced for admin-level access
● Backups: Encrypted backups are taken regularly and stored securely within the UK
● Device protection: All employee devices accessing data are password-protected and monitored
6. AI Processing & Subcontractors
School Window may share data with carefully selected subcontractors, including infrastructure and AI providers, who are bound by data protection terms no less strict than this policy. A list of current subcontractors is available upon request.
Content submitted to the Platform's AI features may be processed by OpenAI, L.L.C., pursuant to OpenAI's Data Processing Addendum, which School Window has executed and which is available upon request. Only text content submitted to AI features is processed in this way; images are not sent to or processed by any AI provider. This content is not shared with OpenAI for any purpose other than delivering the service, and is not used to train or improve OpenAI's models.
School Window takes reasonable steps to ensure all subcontractors meet appropriate data protection standards and are bound by contractual terms consistent with this policy. School Window is not liable for breaches caused solely by a subcontractor's failure to comply with their own obligations.
7. Data Breach Notification
In the event of a personal data breach, School Window will notify affected Customers without undue delay, and provide all relevant information to support their own regulatory notification obligations.
8. Data Retention & Deletion
Personal data is retained only for the duration of the Customer agreement or as otherwise instructed. Upon termination or request, data is securely deleted within 30 days.
9. Data Subject Rights
As a Processor, School Window supports its Customers in fulfilling data subject access requests (DSARs), erasure requests, and other rights under applicable legislation.
10. Cyber Security Insurance
School Window holds cyber security insurance covering data breaches, ransomware attacks, and other relevant risks. A copy of our insurance certificate is available upon request.
11. Contact
For questions or concerns regarding this policy, please contact: support@schoolwrap.ai
