Policies & Compliance
Last updated: August 2026 · Index version v2.0
4Sight Education Ltd (trading as VESPA Academy) publishes the following policies for schools, colleges, trusts, privacy leads and procurement teams. All documents are versioned and updated when our services or legal requirements change.
Data protection & privacy
Privacy Policy
How we collect, use, and protect personal data — roles, lawful basis, rights, cookies, third parties (v2.0)
→Student Privacy Policy
Student-friendly version of the privacy policy
→Data Protection Policy
UK GDPR compliance — controller/processor roles, DPIA, breach procedures (v2.0)
→Data Retention Policy
Default retention schedule (controller-configurable), deletion and written confirmation (v2.0)
→Data Processing Agreement
Standard UK GDPR Article 28 DPA preview (v2.0) — issued completed on subscription confirmation
→Sub-processor list & changelog
Canonical versioned list (SPL-2026.08) — source of truth for Schedule 2
→DPIA support pack
Pre-populated DPIA assistance for schools adopting VESPA
→Data flow summary
How student data moves through the Platform (DfE-style walkthrough)
Security, resilience & safeguarding
Information Security Policy
Cyber Essentials certified (IASME-CE-060416), MFA, EU data store + Vercel US iad1 compute, incident response (v2.0)
→AI Usage Policy
How AI is used (advisory only) — API sub-processors OpenAI & Anthropic; no training on school data; prompt data not sold or shared for unrelated purposes
→BCP / DR Plan
Business continuity and disaster recovery — RTO/RPO targets, scenario playbooks, succession and provider outage procedures
→Safeguarding Statement
KCSIE-aligned safeguarding and child data protection
→Accessibility Statement
WCAG 2.2 commitment and accessibility feedback contact
Cyber Essentials certified — IASME-CE-060416 (2 July 2026 – 2 July 2027). Verify certificate online
Service terms
Corporate & procurement policies
Modern Slavery Policy
Supply chain ethics and zero tolerance for modern slavery
→Quality Policy
Quality objectives, controlled processes, support handling, subcontractor standards and continuous improvement (ISO 9001 substitute)
→Environmental Policy
Cloud-first operating model and environmental commitments
→Equality, Diversity & Inclusion Policy
Equality Act compliance — employer and service delivery commitments
→Health & Safety Policy
Remote working, DSE and safe working environment
Archives & templates
For the attention of your DPO / privacy lead: this index is the procurement pack (links to current policies). A completed DPA naming your organisation is issued when your subscription or trial is confirmed and is incorporated into our Terms (preview: DPA). Countersignature is optional. For DPIA support or policy queries contact admin@vespa.academy. IT administrators may also see our IT Setup Guide.
© 2026 VESPA Academy — 4Sight Education Ltd. All rights reserved.