Privacy Policy

1. Introduction

This Privacy Policy explains how AttendTrack ('we', 'our', 'us'), operated by Edvance Technologies Ltd (Company No. 11548882), collects, uses, stores, and protects personal data when schools and educational settings ('you', 'the school') use our AI-powered attendance analysis service available at attendtrack.co.uk.

We are committed to handling all personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and all other applicable UK data protection legislation.

Please read this policy carefully. By using AttendTrack, you confirm you have read and understood how we process personal data.

2. Who We Are

AttendTrack is operated by Edvance Technologies Ltd, a company registered in England (Company No. 11548882), with its registered office in Essex, United Kingdom. ICO Registration: ZC116413.

3. Our Role Under UK GDPR

AttendTrack acts as a Data Processor on behalf of schools. The school engaging our service is the Data Controller and determines the purposes for which personal data is processed. We process data strictly on the documented instructions of the school.

Our full Data Processing Agreement (DPA), which sets out each party's responsibilities, is available as a separate document and must be signed before the school begins using AttendTrack.

4. What Personal Data We Collect

4.1 Data About School Staff

• Full name and job title
• Work email address
• Login credentials (encrypted)
• Usage logs and activity within the service

4.2 Data About Pupils

• Pupil name
• Year group and class
• Attendance records (present, absent, late, reason codes)
• Absence reason information (where provided by the school)

We do not collect or store sensitive special category data about pupils (such as medical information, ethnicity, or SEND status) unless explicitly provided by the school as part of an attendance note or voicemail transcription, in which case the school remains responsible for that data as Data Controller.

4.4 Parent Engagement Data (SMS Communications)

AttendTrack's Parent Engagement feature allows schools to send automated SMS messages to parents/guardians regarding pupil attendance. The following data is processed as part of this feature:

• Parent/guardian mobile phone numbers (as provided by the school)
• Parent/guardian names
• SMS message content (personalised messages referencing pupil attendance rates)
• Message delivery status (sent, failed, pending)
• Staff approval/decline actions and timestamps
• Escalation step tracking (which stage of the engagement sequence each pupil is at)

The school retains full control over all messages — every SMS requires explicit staff approval before sending. No messages are sent automatically without human authorisation.

4.5 Technical Data

• IP addresses and device information
• Browser type and version
• Usage analytics and session data
• Error logs

5. How We Use Personal Data

We process personal data solely for the purposes of providing and improving the AttendTrack service, including:

• Enabling schools to record, monitor, and report on pupil attendance
• Receiving and transcribing parent/guardian voicemail messages reporting pupil absences
• Matching transcribed voicemail content against uploaded absence records on the dashboard
• Generating automated alerts and reports for school staff
• Providing AI-powered analysis of attendance patterns
• Sending automated SMS messages to parents/guardians as part of the attendance engagement sequence, with staff approval
• Maintaining the security and integrity of the service
• Providing customer support

We do not use personal data for marketing, advertising, or any purpose other than providing the service.

6. Legal Basis for Processing

As a Data Processor, we process data under the lawful basis established by the school as Data Controller. Schools typically rely on:

• Legal obligation — schools are legally required to maintain attendance registers under the Education (Pupil Registration) (England) Regulations 2006
• Public task — schools acting in their official capacity to fulfil their statutory functions

We process staff account data under the lawful basis of contractual necessity (to provide the service the school has purchased).

7. Data Storage and International Transfers

AttendTrack uses third-party infrastructure providers whose servers are located in the United States of America. Personal data may therefore be transferred to and stored in the US, which is outside the United Kingdom and the European Economic Area (EEA).

7.1 Abacus.AI

AttendTrack is built and hosted on infrastructure provided by Abacus.AI. Pupil attendance records, staff account data, and dashboard content are stored on Abacus.AI servers in the United States.

7.3 Safeguards

Where personal data is transferred to the United States, we rely on the following safeguards to ensure an adequate level of protection:

• Standard Contractual Clauses (SCCs) as approved by the UK Information Commissioner's Office (ICO)
• The UK International Data Transfer Agreement (IDTA) where applicable

8. Data Retention

We retain personal data only for as long as necessary to provide the service and meet our legal obligations:

Schools can request deletion of their data at any time by contacting us at the address below.

9. Data Sharing

We do not sell, trade, or rent personal data to any third party.

We may share data with the following categories of third parties solely to deliver the service:

• Abacus.AI — our platform infrastructure and AI processing provider (sub-processor, US-based)
• Payment processors — for invoicing and billing only (no pupil data is shared with payment processors)
• Legal and regulatory authorities — where required by law

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure, including:

• Encrypted data transmission using HTTPS/TLS
• Access controls and authentication requirements
• Regular review of security practices
• Staff (where applicable) trained in data protection obligations

In the event of a personal data breach, we will notify affected schools without undue delay and in any event within 72 hours of becoming aware, in accordance with our Incident Response Policy.

11. Your Rights

As a Data Controller, the school (and by extension its staff and the parents/guardians of pupils) may exercise the following rights under UK GDPR:

• Right of access — to obtain a copy of personal data held
• Right to rectification — to correct inaccurate data
• Right to erasure — to request deletion of data (subject to legal retention obligations)
• Right to restriction — to limit how data is processed
• Right to data portability — to receive data in a machine-readable format
• Right to object — to object to certain types of processing

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month.

12. Complaints

If you have concerns about how we handle personal data, please contact us in the first instance. If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify schools of any material changes by email. The date at the top of this document reflects when it was last updated.

14. Contact Us

For any questions about this Privacy Policy or our data practices, please contact: