DPIA Support Pack
Version v1.1 · September 2026 · For school / trust controllers
Important: Under UK GDPR the controller (your school/trust) owns the DPIA. This pack is supplier assistance — pre-filled factual answers about VESPA — not a substitute for your own assessment, governance approval, or ICO consultation where required.
1. Processing description (supplier facts)
| Processing | Delivery of VESPA Academy coaching platform: questionnaires, scores, activities, optional AI coaching tools, school reporting, and anonymous national benchmarking aggregates |
|---|---|
| Controller | [Your school / trust] |
| Processor | 4Sight Education Ltd, 79 Tib Street, Manchester, M4 1LS (Company No. 14032238) |
| Data subjects | Students/learners; school staff users |
| Personal data | See DPA Schedule 1 — names, DOB (where supplied), year/tutor group, gender (where supplied), emails, questionnaire responses, free text, optional AI chat history, timetable data where you supply it (including room names, if you send them) |
| Pupil location | If you send a timetable that includes room names, the platform holds where an identified student is expected to be at a given time, plus dated one-off changes. Room names are optional — the timetable works without them, so you can omit the field if you would rather not process this. Decide and record which position you are taking. |
| Special category | Not required by design. Gender may be supplied by the school. Incidental free-text may contain special category content (see DPA) |
| Profiling / ADM | Scores and AI text are decision-support tools; not solely automated decisions with legal/similarly significant effects (DPA Art. 22 clause) |
2. Necessity and proportionality (suggested controller narrative)
- Purpose: improve study mindsets / coaching support aligned to curriculum pastoral aims.
- Data minimisation: core fields needed for accounts, reports and filtering; optional AI only when a user invokes a feature.
- Retention: default while enrolled; target erasure within 30 days of confirmed leave instruction (controller-configurable) — see Retention Policy.
3. Risks & mitigations (supplier controls)
| Risk theme | Mitigation |
|---|---|
| Unauthorised access | Auth + SSO; role-based access; MFA on admin systems; Cyber Essentials (IASME-CE-060416) |
| International transfers | EU data store (Supabase eu-north-1); Vercel iad1 / OpenAI / SendGrid etc. under SCCs — SPL-2026.08 |
| AI misuse / over-reliance | Advisory-only outputs; human review expected; no training on school data under API terms; OpenAI logging/sharing controls — AI Policy |
| Over-retention | Erasure runbook + written confirmation; automation roadmap |
| Transparency to students | Student privacy notice |
| Pupil location exposure | Timetables are visible to the student and to staff already entitled to view that student; room data is not shared with any sub-processor and is not sent to any AI feature; room names can be omitted entirely at your choice |
4. Controller checklist (you complete)
- [ ] Confirm lawful basis (typically public task / contract) and privacy notice to students/parents
- [ ] Confirm whether gender / DOB will be synced from MIS and any special-category conditions
- [ ] Decide which optional AI features are enabled for your users
- [ ] Record acceptance of DPA v2.0 and sub-processor list SPL-2026.08
- [ ] Set retention / leaver process with your VESPA admin contact
- [ ] Consider consultation with your DPO / governance board
5. Related documents
Support: admin@vespa.academy
© 2026 VESPA Academy — 4Sight Education Ltd