Progress 55 Privacy Notice

Assistant SENDCo helps you create SEN Support Plans. We take data protection seriously, especially when handling information about children with special educational needs. This notice explains what data is collected and how it is handled.

Progress 55 Ltd provides a web-based tool called Assistant SENDCo that helps teachers in UK schools create SEN Support Plans.

Progress 55 Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZC178448.

This Privacy Notice has been written to inform visitors to our website and prospective or current customers of Progress 55 Ltd about how and why we process your personal data. We will only collect and use your personal data in ways that are compliant with the applicable data protection legislation.

For data we collect via our website and to prepare and administer our software, Progress 55 Ltd is a Data Controller as defined by the UK GDPR.

We also process personal data as a Data Processor when we provide services under a contract with clients (schools and multi-academy trusts), in accordance with their instructions. In these circumstances, the educational institution is the Data Controller under the UK GDPR. This means they are responsible for providing you with information about how your data is used and who to contact to exercise your rights. Please refer to your institution's Privacy Notice for further information.

Progress 55 Ltd has appointed Veritau as its Data Protection Officer (DPO). The role of the DPO is to monitor our compliance with the UK GDPR and the Data Protection Act 2018 and advise on data protection issues. If you would like to discuss this Privacy Notice or our use of your data, please contact our DPO using the details below.

Data Protection Officer (Veritau)
schoolsDPO@veritau.co.uk
01904 554025

To provide our service, we need to collect certain categories of information. This includes organisational information relating to your institution. We may also collect the following categories of personal data about you as a representative of the institution, which you provide when you register or use our services:

• Full name, job title, and contact details of the representatives authorised to contract with us and administer their school's account.
• Business address of the educational institution you represent.
• Name, email address, role, and optional message you provide if you submit an enquiry via our "register interest" form on the website.
• The content of any fault report or suggestion you submit from within the product, together with your account identity, the page you were on, and your browser identification. We ask you not to include pupil details in these, and an automatic filter removes personal details it recognises before the report is stored.
• Where your school signs our agreements electronically: the signatory's name, role, work email address, the school's legal name and address, the signature itself, the date of signing, and technical records of the signing session including IP address.

We do not currently run website analytics or a marketing-communications mailing list. If we introduce either in future, we will update this notice and (where required) obtain consent before doing so.

We do not collect information about pupils or families in our capacity as Data Controller. Pupil data is only processed under instructions from our customer schools, as their Data Processor.

When you use this tool, the following information may be entered:

• Pupil name and date of birth
• Year group and areas of need
• Pupil and family voice statements
• Assessment information and SMART outcomes
• Provisions and support strategies
• Access arrangements and signatures

We process your information for the purposes outlined below:

• Providing our Assistant SENDCo service, including free trials and pilots.
• Providing technical and administrative support in relation to our service.
• Facilitating access to documentation and shared resources.
• Collecting payment for our service and managing your subscription.
• Responding to enquiries submitted via our website's "register interest" form and providing quotations or follow-up information.

Under the UK GDPR, we must have a lawful basis when processing personal information. We rely on:

• Article 6(1)(f) Legitimate Interest for most of our controller-role processing (administering customer accounts, handling support enquiries, maintaining the website, necessary analytics). To rely on Legitimate Interests, we balance our organisation's interests against the rights and freedoms of individuals and only rely on it where the processing is a reasonable use of your data in ways you would expect.
• Article 6(1)(b) Contract for fulfilling the services you or your institution has contracted for.
• Article 6(1)(a) Consent for optional processing such as subscribing to our product-update email list. You can withdraw consent at any time.

Where we act as a Data Processor, the educational institution determines the lawful basis for processing.

We normally receive your personal information directly from you or your educational institution. We do not collect personal data from other third parties or from data brokers.

Alongside the above, we hold limited business contact information — names and work contact details — for the suppliers and professional advisers we work and correspond with in running Progress 55. We process this under our legitimate interests (Article 6(1)(f)) to manage those working relationships and our correspondence, and — as with the rest of our business — we rely on reputable third-party IT and software service providers (including hosting, security, and AI-assisted development tools), with appropriate safeguards in place, to do so.

Assistant SENDCo is a plan-writing tool only. It does not monitor, detect, or route safeguarding concerns. Schools must continue to use their designated safeguarding systems for any child welfare matters.

The school (as data controller) is responsible for ensuring that staff enter only data that is necessary and appropriate for the SEN Support Plan. We provide PII warnings on free-text fields as a supportive guardrail, but enforcement of data minimisation remains the school's responsibility.

This tool uses the word "assess" because it follows the statutory graduated approach in the SEND Code of Practice 2015: Assess, Plan, Do, Review. Assessment in this context refers entirely to the professional judgement of school staff — typically the class teacher or SENDCo.

• Assistant SENDCo does not assess pupils
• The system does not score, categorise, or infer need levels from the information you enter
• Assessment text is stored exactly as entered, encrypted at rest
• No background processes summarise or classify your assessment inputs
• AI features receive only ticked statements and fixed choices (never a name or anything typed), and output drafting suggestions only

All data is stored securely in the cloud using Supabase (hosted in the UK — London). This allows you to access your plans from any device.

Supabase acts as our data processor for cloud storage. OpenAI acts as our data processor for AI-assisted features only, when you explicitly opt in. Resend handles transactional email delivery (password resets, invitations). All operate under data processing agreements. AI features are opt-in for each member of staff individually, and a school can turn them off for everyone.

Our full sub-processor list, and where each one holds data, is set out under "Who we share your information with" and "International transfers of data" below.

End-to-end encryption

Your plan data is encrypted on your device before being sent to our servers. Only you can decrypt it with your encryption password.

• Data is encrypted with AES-256-GCM before leaving your device
• Plan data is encrypted on your device. Only you (or the school key holder your school designates) can decrypt it.
• Two-factor authentication required for all accounts
• Each user can only access their own plans, and any plan their school's SENDCo has shared with them to read (Row Level Security)
• Hosted in a UK data centre (London, GDPR compliant)
• You can delete your data at any time

We do not share information with any other Data Controllers (external organisations).

We may share your personal data with service providers ("sub-processors") that provide IT, hosting, and administration services on our behalf. We ensure that data processing contracts are in place with all sub-processors, including contractual obligations equivalent to those in our own Data Processing Addendum.

Our current controller-role sub-processors are:

• Supabase Inc. (UK — AWS London, eu-west-2) — database and authentication.
• Vercel Inc. (EU routing) — website and application hosting.
• Resend Inc. (EU — Ireland, eu-west-1) — email delivery for service communications, such as password resets and invitations. Staff email addresses only; no pupil data.
• Cloudflare, Inc. (US) — bot-protection / CAPTCHA (Turnstile) on our website "register interest" form. Processes visitor IP address and browser telemetry only; no pupil data.
• Jotform Ltd (EU hosting) — electronic signature of our agreements. Processes signatory contact details, the signature, and signing-session records only; no pupil data.

We will update this notice if our sub-processor list changes.

We have implemented technical and organisational measures to safeguard information and keep it secure. These measures are documented in detail in our Security Overview, which is maintained by us and available to customer DPOs on request.

We regularly review our information security policies and measures and improve them where necessary. We also conduct regular testing and reviews of our measures to ensure they remain effective. We also ensure that the data processors we use have appropriate technical and organisational measures in place and have signed Data Processing Agreements with us.

Although we are based in the UK, some of the digital information we hold may be transferred to servers located outside the UK and EU. For our current sub-processors:

• Pupil data (under our Data Processor role) is stored in the UK (AWS London) by Supabase.
• Website application hosting by Vercel uses EU routing.
• Transactional email via Resend is sent from the Ireland (eu-west-1) region.
• Bot-protection (Turnstile) on our website form is provided by Cloudflare in the United States; it processes visitor IP and browser telemetry only, never pupil data.
• Electronic signature of our agreements is provided by Jotform Ltd, with the data held in the European Union. It processes signatory contact details, the signature and signing-session records, never pupil data. Data could reach the United States only if Jotform received a legal or law-enforcement demand it was obliged to answer; the EU–US Data Privacy Framework (UK Extension) would apply to any such transfer.
• When a customer school opts in to AI writing assistance, the statements a teacher ticks and the fixed choices they make — which can include the plan's areas of need — and, for the in-app helper, the request a teacher types with pupils' names removed on their device, are transferred to OpenAI LLC in the United States under Standard Contractual Clauses with the UK International Data Transfer Addendum (OpenAI is not certified under the EU–US Data Privacy Framework), supported by a Transfer Risk Assessment, and with the supplementary safeguard that no pupil name and nothing typed about a pupil is ever sent. We treat this data as personal data, not anonymous data.

Where transfers to the United States occur, we rely on the EU–US Data Privacy Framework (UK Extension) for those sub-processors that participate (Vercel, Resend, and Cloudflare), and on Standard Contractual Clauses with the UK International Data Transfer Addendum, supported by a Transfer Risk Assessment, for OpenAI, which does not participate in the Framework — together with our own technical measures (sending no names or typed text, and encryption).

We do not use AI to process personal data in our capacity as Data Controller.

Assistant SENDCo provides the optional use of AI to assist with the production of SEN Support Plans. We use AI to help with this optional function in our capacity as a Data Processor, in accordance with our customer school's instructions. We do not undertake any further processing on the data provided by our customers.

To provide our AI tool, we have appointed OpenAI LLC as a Sub-Processor. Details are set out in our Sub-Processor Register and Data Processing Addendum. Data sent to OpenAI is not used for training, under its API terms.

AI writing assistance

This tool offers optional AI features to help draft outcomes, targets and support ideas. When you use these features:

Data is sent to OpenAI. When you click an AI button, the statements you have ticked and the choices you have made are sent to OpenAI's servers to generate suggestions. When you ask for draft targets or early-years support ideas, the areas of need recorded on the plan are used too. Nothing you type in a plan is sent. If you use the in-app helper, the request you type to it is sent to OpenAI after the names held on your device have been removed. Please do not type names or other details that could identify a child.

How we protect pupil identity:

• Your pupil's name is never sent from a plan, and neither is their year group. In the in-app helper, your device removes your pupils' names before anything is sent.
• The whole plan is never sent

AI suggestions may contain inaccuracies or bias. You are responsible for reviewing all AI-generated content before saving it to a support plan.

AI features are entirely optional. You can complete your support plan without using them.

We keep a minimal audit log of actions (such as creating, saving, or exporting a plan) for security and accountability. We do not log plan content, AI prompts, AI responses, or any information that could identify a pupil. Audit logs are retained for up to two years (730 days) and then automatically deleted; because they contain no pupil-identifying information, this longer window is proportionate and supports later security investigation.

We do not currently run any website analytics tool. Our web server processes standard request logs (retained by our hosting provider per their default retention policy), but we do not independently collect or analyse user behaviour statistics.

If we introduce a website analytics tool in future, we intend to use a privacy-friendly, cookieless option (such as Plausible) that does not process personal data. We will update this notice before any such change takes effect.

A cookie is a small file of text that may be saved on the memory or storage of your electronic device (computer, phone, or tablet) when you visit a website. Cookies are used to improve how the website works and to remember information you have provided, so you do not have to re-enter it.

Our approach:

• Strictly necessary cookies only. We use cookies for signing in to the Assistant SENDCo application and maintaining your authenticated session (for example, remembering that you have logged in). Without these cookies the application cannot work as designed.
• No analytics, advertising, or tracking cookies. We do not currently run third-party analytics, advertising, retargeting, or cross-site tracking cookies.
• No consent banner required for essential cookies. Strictly-necessary cookies do not require consent under UK GDPR and PECR.

If our use of cookies changes in future (for example, if we introduce optional analytics or marketing features), we will update this notice and present a consent banner before any non-essential cookies are set.

We will retain your personal information for as long as we provide you with our service, plus the retention period required by law (typically 6 years for accounting records).

• Customer account records: retained for the life of the subscription plus 6 years for tax and accounting purposes.
• Website enquiry records: retained for up to 24 months after closure of the enquiry, then deleted.
• Support correspondence: retained for up to 24 months after closure.
• Signed agreements: one signing link is shared by all pilot schools, so completed agreements stay with our electronic-signature provider while the pilot is open. When the pilot closes on 31 January 2027 we stop accepting new signatures, take our own copy of every completed agreement, and then delete the signing template and its records from that provider; the provider applies a further 30-day period before that deletion takes effect. Our own copy is kept in company legal records for the life of the contract plus 6 years.
• Support plans (processed on a school's instructions): your plans are kept until you delete them. You can delete individual plans from the "My Plans" page, or delete your entire account to remove all data. We recommend schools review and delete plans in line with their own data retention policies. SEND records are typically retained until the pupil reaches age 25, per IRMS guidance.

Any personal information that we are not required by law to retain is kept only for as long as necessary to fulfil its purpose.

You can delete your data at any time:

• Delete individual plans from the "My Plans" page
• Delete your entire account from Settings → "Delete my account"

When you request account deletion, your account enters a 7-day grace period. During this time you can log back in and cancel the deletion. After 7 days your account and all associated data (plans, encryption keys, provisions, and profile) are permanently removed.

If you are a SENDCo with whole-school access, you cannot delete your account while you still own plans, or while no other whole-school SENDCo has shown they hold the school key. The app tells you this, and what to do, before your request is accepted. This keeps your school able to open its records.

Exported Word documents stored on your device are not affected by account deletion and remain your responsibility to manage.

When you export your plan as a Word document, the document is built entirely inside your browser. Your decrypted plan data never leaves your device during export — no data is sent to our server.

Once exported, the Word document is unencrypted and under your school's control. Your school is responsible for storing, sharing, and disposing of exported documents in line with its own data protection policies.

Under the UK GDPR, you have the following rights in relation to the processing of your personal data:

• to be informed about how we process your personal data (this notice fulfils this obligation);
• to request a copy of the personal data we hold about you;
• to request that your personal data is amended if inaccurate or incomplete;
• to request that your personal data is erased where there is no compelling reason for its continued processing;
• to request that the processing of your personal data is restricted;
• to object to your personal data being processed;
• to have any decisions significantly affecting you that are based solely on automated processing reviewed by a human (we do not currently make such decisions).

If you have any concerns about how we have handled your personal data, or would like further information, please contact us at george@progress55.co.uk or our DPO at schoolsDPO@veritau.co.uk.

If we cannot resolve your concerns, you may also complain to the Information Commissioner's Office, the UK's data protection regulator. Their contact details are:

• Phone: 0303 123 1113 (Monday to Friday, 9am–5pm, excluding bank holidays)
• Live chat and web form: https://ico.org.uk/make-a-complaint/

If you are unhappy with how your personal data has been handled, you have the right to complain to us directly. There is no charge for making a complaint.

• How to complain: use our Report a Concern page, or email george@progress55.co.uk. We accept complaints however they reach us.
• What happens next: we acknowledge data protection complaints within 30 days of receiving them, and usually much sooner. We then investigate and respond without undue delay.

Who handles your complaint depends on the data it concerns:

• Pupil information in support plans — the school is the data controller and we act on its instructions as processor. Complaints about pupil information are for the school to handle, normally through its Data Protection Officer. If a complaint about pupil information reaches us first, we pass it to the school without undue delay and tell you we have done so, then support the school's handling of it under our Data Processing Agreement.
• Staff account details, sign-ups to hear from us, and product feedback — we are the data controller for this information and we handle these complaints ourselves from start to finish.

You can also complain to the Information Commissioner's Office at any time, including if you are not satisfied with our response, at ico.org.uk or by calling 0303 123 1113. Complaining to us first does not affect that right.

If you have questions about how this tool handles data, contact george@progress55.co.uk or your school's Data Protection Officer.

We reserve the right to change this Privacy Notice at any time. We will normally notify you of changes that affect you. However, please check regularly to ensure you have the latest version.