Trust & Data Protection
Everything your DPO, headteacher, and IT team need — in one place.
For DPOs and headteachers
Spellcast is designed to be adopted by schools without friction. We've pre-completed the documentation your Data Protection Officer will ask for, so deals don't stall in a queue.
All documents on this page are ready to sign, adapt, or share. If you have questions or need a customised version of the DPA, email schools@spellcast.academy.
Documents
The legal agreement defining how Spellcast processes pupil data on your school's behalf. Required before adoption.
A completed DPIA for schools to review, countersign, and retain. Covers all processing activities, risk assessment, and mitigations.
How Spellcast protects children: display boards, no child-to-child contact, teacher access controls, and account recovery.
Every domain your network filter needs to allow, with step-by-step instructions for Smoothwall, Lightspeed, Cisco Umbrella, and others.
Key facts
| Data controller | For school accounts the school is the data controller and Made Good Software Ltd (ICO registration number ZC262206) is the processor. SpellCast is the controller for parent and family accounts, for staff account, billing and marketing contact details, and for leaver records a parent claims into a family account |
|---|---|
| Data location | United Kingdom only (IONOS VPS; encrypted backups in OVHcloud London, UK) |
| Child email addresses collected | None — children log in with a username only |
| Sub-processors with school data | IONOS (UK, server hosting), OVHcloud (London, encrypted backups) and Brevo (France, staff email). Teacher progress-summary emails sent through Brevo can include pupil first names. Google, ElevenLabs (US) and Anthropic (US) receive spelling-word text only, and Cloudflare R2 stores spelling-word audio, never linked to a pupil. Stripe is not used for school plans |
| Cross-school visibility | None |
| Display boards | Teachers can display a class board of weekly points. On paid school plans any teacher can also display year-group and whole-school boards, showing class totals and the first names and weekly points of the top 3 pupils per year group. Free-class pupils appear by nickname |
| Child-to-child communication | None — no messaging, chat, or open content |
| Automated decision-making | None with legal or significant effect |
| Data breach notification | Within 48 hours to the school; ICO within 72 hours if required |
| Data export | A school admin can download a full JSON export from Manage school, Data export. Teachers can download a class progress summary CSV from the class dashboard |
| Account deletion | Deleting a pupil permanently erases their account and history straight away. Encrypted backups roll off within 30 days and logs expire on their own schedules. After a school subscription ends we keep data for 12 months so the school can restart, then delete it, or sooner on written request |
Data sources: Wonde (optional)
Wonde is the school's own MIS connector. SpellCast reads pupil names, year group and form from it with the school's approval. To link teachers to their classes it also reads staff names and email addresses, and uses them for nothing else. For each pupil we store their Wonde id and their MIS id, so we can recognise the same pupil from one night to the next. SpellCast never writes anything back to Wonde and Wonde receives no pupil data from us. The only personal data SpellCast gives Wonde is the requesting admin's name and email as the approval contact.
SpellCast does not ask Wonde for dates of birth, UPNs, gender, pupil or parent contact details, photos, or SEN or free school meals information. If Wonde sends any other fields, SpellCast discards them on receipt and does not store them. For staff, SpellCast reads only the name, role and email address.
When your MIS stops listing a pupil, SpellCast archives them. They are erased 30 days after a nightly sync confirms they have gone, and never later than 90 days after removal. SpellCast may end the connection when your plan, trial or the Wonde add-on ends, and will tell you when it does. Ending the connection does not change your school's own agreement with Wonde. Access also ends if your MIS admin removes SpellCast in Wonde, or if you click Disconnect Wonde on the Wonde tab. The roster then returns to manual management and your pupils and their progress stay in place, but keeping their details accurate becomes your school's job. If you want them erased when you disconnect, tell us and we will do it.
Some copies last a little longer. Encrypted backups keep an erased pupil until they rotate out, which takes 30 days at OVHcloud. Digest email bodies are blanked after 90 days. Usage events and error reports linked to a pupil's account are kept for 90 days. If you want an erasure to happen sooner, tell us at schools@spellcast.academy.
Privacy Policy
Our full Privacy Policy — including child-friendly summary, school account section, and ICO complaint information — is at /privacy.
Ready to proceed? Email schools@spellcast.academy with your school name and we will aim to send a pre-signed DPA for countersignature within one working day.