How We Protect Your Data
A plain-English summary for school DPOs and senior leaders. Everything you need to know before sharing pupil data with AttendTrack.
ICO Registered
ZC116413
Encrypted
TLS/HTTPS
UK GDPR
Compliant
Auto-Delete
Built In
Our Commitment
AttendTrack is built by educators, for educators. We understand that pupil data is among the most sensitive information a school handles. We treat it with the same care you do — storing only what's needed, deleting it when it's not, and never using it for anything other than helping you improve attendance.
Your Data, Your Control
The School = Data Controller
You decide what data to share, why, and for how long. You instruct us on what to do with it.
AttendTrack = Data Processor
We process data only on your documented instructions. We never use pupil data for marketing, advertising, AI training, or any purpose other than running your attendance service.
What We Store & For How Long
We only store what's needed to run the service. Here's exactly what we hold and for how long:
| Data Type | What's Stored | Retention | Auto-Delete |
|---|---|---|---|
| Attendance records | Daily marks (present/absent/late) | Current year + 1 year | ✓ Annually |
| Student details | Name, year group only | Duration of contract | ✓ 30 days after leaving |
| Parent phone numbers | Mobile number, name | Duration of contract | ✓ 30 days after leaving |
| Voicemail audio | Raw .wav recordings | Deleted within 1 hour | ✓ Automatic |
| Call transcriptions | AI-generated text | Current term + 1 | ✓ Termly |
| SMS logs | Message text, status | Current academic year | ✓ Annually |
| Raw CSV files | Uploaded attendance files | Never stored | ✓ Processed in memory |
| Staff accounts | Email, encrypted password | Duration of contract | ✓ 30 days after closure |
Security Measures
Encryption in Transit
All data transmitted via HTTPS/TLS. No unencrypted connections.
Access Controls
Role-based permissions. Only authorised school staff can access their own data.
Secure Authentication
Encrypted credential storage. Session-based access with automatic timeouts.
Breach Response
Documented incident response procedure. School notified within 72 hours per UK GDPR.
Data Minimisation
We only collect what's needed. No home addresses, medical records, or SEND data.
Automatic Deletion
Built-in data lifecycle management. Old data automatically cleaned up per retention schedule.
Where Data Lives
AttendTrack's infrastructure is currently hosted in the United States via our technology partners. All international data transfers are protected by:
- Standard Contractual Clauses (SCCs) — approved by the UK ICO
- UK International Data Transfer Agreement (IDTA) — where applicable
We are transparent about this. As we scale, UK-based hosting is on our roadmap. In the meantime, the same legal safeguards used by major EdTech providers (including Google Classroom and Microsoft 365) protect your data.
When You Leave
Export Your Data
Request a full CSV export of all your attendance records, student data, and engagement history at any time.
30-Day Grace Period
After cancellation, your data is retained for 30 days so you can request exports. After that, it's permanently deleted.
Written Confirmation
We provide written confirmation that all your data has been deleted. No copies retained.
Sub-processors
These are the third parties who process data on our behalf:
| Provider | Purpose | Location | Data Handled |
|---|---|---|---|
| Abacus.AI | Platform hosting, AI | United States | All platform data |
| Twilio | Voicemail, SMS | United States | Audio, phone numbers, SMS content |
We notify schools of any changes to our sub-processor list and allow time to object.
Registrations & Compliance
ICO Registration
ZC116413
Registered as Data Processor with the UK Information Commissioner's Office
Companies House
11548882
Edvance Technologies Ltd, registered in England
UK GDPR Compliant
Full compliance with UK General Data Protection Regulation and Data Protection Act 2018
DPA Available
Full Data Processing Agreement ready to sign before onboarding
Documentation
Data Protection Contact
Edvance Technologies Ltd
Trading as AttendTrack
Company No. 11548882 · ICO Registration: ZC116413
Data Protection Lead: Vince James, Director