Data Protection Policy

Last updated: August 2026 · Version v2.0

1. Introduction

4Sight Education Ltd (“the Company”), trading as VESPA Academy, is committed to protecting the rights and freedoms of individuals in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy sets out how the Company meets its obligations and ensures that all staff, contractors, and partners understand their responsibilities when handling personal data.

2. Data Controller and Processor Roles

Where a school or college subscribes to VESPA Academy, the educational institution is the data controller and 4Sight Education Ltd is the data processor.
For our own business contacts (enquiries, marketing, billing), 4Sight Education Ltd acts as the data controller.
A standard Data Processing Agreement preview is published at vespa.academy. A completed DPA naming the school is issued when the subscription is confirmed and is incorporated into our subscription terms.

3. Lawful Basis for Processing

Roles differ depending on the activity:

Activity	Our role	Lawful basis
Providing the VESPA coaching platform (student/staff data)	Processor	Determined by the school (controller) — commonly public task and/or contract; we act on documented instructions under the DPA
Student psychometric assessments and coaching features	Processor	As instructed by the school; appropriate safeguards for minors remain the school's responsibility as controller
Marketing to prospective schools	Controller	Legitimate interests (with opt-out)
Responding to enquiries	Controller	Legitimate interests / consent
Payment processing and billing	Controller	Contract
Legal and regulatory compliance	Controller / as required	Legal obligation

4. Data Protection Principles

In accordance with Article 5 of the UK GDPR, we ensure that personal data is:

Processed lawfully, fairly, and transparently — we are clear about what data we collect and why
Collected for specified, explicit, and legitimate purposes — student data is used only to provide the educational coaching service
Adequate, relevant, and limited to what is necessary — we collect only the minimum data required for the service
Accurate and kept up to date — schools can update student data at any time; automated syncs keep records current
Kept for no longer than necessary — see our Data Retention Policy
Processed securely — encrypted in transit and at rest, access controls, regular security reviews

5. Data Protection Lead

4Sight Education Ltd has appointed a Data Protection Lead (we are not relying on a statutory Article 37 DPO designation). Contact:

Data Protection Lead
4Sight Education Ltd, 79 Tib Street, Manchester, M4 1LS
Email: admin@vespa.academy

6. Individual Rights

Under the UK GDPR, individuals have the following rights. Requests should be directed to the data controller (the school/college) in the first instance, or to us at admin@vespa.academy:

Right of access (Article 15) — request a copy of personal data held
Right to rectification (Article 16) — request correction of inaccurate data
Right to erasure (Article 17) — request deletion of personal data
Right to restrict processing (Article 18) — request limitation of processing
Right to data portability (Article 20) — receive data in a structured, machine-readable format
Right to object (Article 21) — object to processing based on legitimate interests

We will respond to subject access requests within one calendar month of receipt.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

Encryption in transit (TLS 1.2+) and at rest
EU-hosted database infrastructure (Supabase eu-north-1)
Role-based access controls and authentication (including SSO via Microsoft 365 and Google Workspace)
Regular security assessments; Cyber Essentials certified (IASME-CE-060416, 2 July 2026–2 July 2027) — verify certificate
Automated backups with point-in-time recovery
Sub-processor agreements with all third-party service providers

8. International Data Transfers

Primary data storage is in the EU (Supabase eu-north-1). Processing outside the UK/EEA occurs via sub-processors listed at vespa.academy/sub-processors.html (including Vercel US iad1, SendGrid, OpenAI, Anthropic for CRM/internal use, Stripe where used, and marketing-site analytics/ad tags). Transfers are protected by:

Standard Contractual Clauses (SCCs) / UK International Data Transfer Addendum
The UK–EU adequacy decision where applicable
Sub-processor Data Processing Agreements

9. Data Breach Procedures

In the event of a personal data breach:

The breach will be assessed within 24 hours of discovery
Where required, the ICO will be notified within 72 hours in accordance with Article 33
Affected data controllers (schools/colleges) will be notified without undue delay
Affected individuals will be notified where the breach is likely to result in a high risk to their rights and freedoms (Article 34)
All breaches are documented in our internal breach register, including those that do not require notification

10. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) when introducing new features or processing activities that are likely to result in a high risk to individuals, in accordance with Article 35 of the UK GDPR. This includes assessment of AI features (see our AI Usage Policy).

11. Sub-Processors

We maintain a single canonical, versioned sub-processor list at vespa.academy/sub-processors.html (current version SPL-2026.08). That page is the source of truth; the DPA Schedule 2 snapshots the same list at issue. Where optional portal AI features are used, prompt data is sent to OpenAI's API for that request only — this is sub-processor processing, not sale or sharing of data with unrelated third parties. See our AI Usage Policy.

12. Staff Training and Awareness

All staff and contractors with access to personal data receive data protection training and are bound by confidentiality obligations. Access to personal data is limited to those who require it to perform their duties.

13. Review

This policy is reviewed annually or when there are significant changes to our processing activities, legal requirements, or organisational structure. The “last updated” date indicates the most recent revision.

14. Complaints

If you are unsatisfied with how we handle personal data, you may lodge a complaint with the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk