Privacy Policy

1. Who We Are

SchoolCentralX ("SchoolCentralX", "we", "us", "our") is a product of Volume Media Limited, a company registered in England and Wales with registered office at 20-22 Wenlock Road, London N1 7GU, England, United Kingdom.

If we are required to appoint a Data Protection Officer, their contact details will be published here.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

• the SchoolCentralX website;
• the SchoolCentralX web platform;
• the SchoolCentralX mobile applications (iOS and Android);
• communications sent through SchoolCentralX;
• support, billing, onboarding, and account administration connected with SchoolCentralX.

This Privacy Policy does not override any separate agreement between us and a school, trust, organisation, or customer, including any Data Processing Agreement (DPA), subscription agreement, or order form. Where there is a conflict regarding customer-controlled data, the relevant contract will take precedence to the extent permitted by law.

3. Our Role

Depending on the context, SchoolCentralX (Volume Media Limited) may act as either:

a. Data Processor

We act as a processor when we process personal data on behalf of a school, trust, or educational organisation using SchoolCentralX. In these situations, the school or organisation (the controller) typically decides what data is uploaded, the purposes of processing, who can access it, and how long it should be kept.

b. Data Controller

We act as a controller for our own business purposes, including:

• website and platform administration;
• customer onboarding and account management;
• billing and payments;
• security monitoring and fraud prevention;
• support delivery;
• product operations and improvement;
• legal and regulatory compliance.

Where a school or organisation is the controller of school-managed data (including student data), that school or organisation is responsible for determining the lawful basis for processing and for providing any required notices or obtaining consents from parents, guardians, staff, or students.

4. Information We Collect and Receive

The personal data we collect depends on how SchoolCentralX is used, which features are enabled, and the user's role.

4.1 Account and identity information

Name, email address, phone number, username or account identifier, password or authentication credentials (or related records), user role, school or organisation affiliation, and profile information.

4.2 School and customer information

School or organisation name, profile information, address and contact details, subscription and billing information, administrative settings, enabled modules, and authorised user lists.

4.3 Student-related data (where uploaded or managed by a school)

Student names, class/form/year group/house information, timetable and calendar data, attendance records, absence requests and notes, homework visibility and assignments, behaviour-related records, consent responses, appointment records, gallery associations, and other school-managed records relevant to the services.

In limited cases, schools may upload more sensitive information (e.g., medical notes relevant to attendance, safeguarding information, dietary or religious requirements). Such data remains under the school's instructions and lawful basis, except where we process it for our own legal, security, or support obligations.

4.4 Parent and guardian data

Names, email addresses, phone numbers, linked student relationships, messaging activity, consent responses, appointment participation, communication preferences, and account/login data.

4.5 Staff and teacher data

Names, work email addresses and phone numbers, job title/role, class and subject assignments, department information, profile content, timetable information, and administrative actions taken in the platform.

4.6 Communications, uploads, and user-generated content

Messages and replies, notices and announcements, calendar/event entries, uploaded files, photos and videos, consent forms and responses, support requests, and comments or other form submissions.

4.7 Technical, device, and usage data

IP address, browser type, device type, operating system, app version, session activity, timestamps, login history, audit logs, crash or error data, push notification tokens (where enabled), general platform usage information, and security/fraud-prevention signals.

4.8 Support, commercial, and payment data

Customer contact details, billing contacts, invoices and payment status, subscription details, support history, implementation notes, and customer communications.

5. How We Collect Information

• Directly from you — when you create/activate an account, log in, complete forms, send messages, upload content, request support, respond to notices/appointments/consent requests, or contact us.
• From schools and organisations — when they upload or provide data to configure and operate the service.
• Automatically — through use of the website, platform, or apps (technical and usage data).
• From service providers — limited information from providers assisting with authentication, hosting, storage, support, billing, analytics, security, or notifications.

6. How We Use Personal Data

We use personal data to:

• Provide, operate, maintain, and support SchoolCentralX;
• Authenticate users and manage role-based access;
• Deliver school-parent communication and engagement features (notices, messaging, calendars, timetables, attendance, homework, galleries, appointments, events, absence workflows, consent workflows, etc.);
• Personalise access based on role, school, and linked relationships;
• Support onboarding, implementation, and customer success;
• Process payments, subscriptions, and account administration;
• Respond to questions, issues, and support requests;
• Monitor platform health, performance, misuse, fraud, and security threats;
• Troubleshoot incidents and improve reliability;
• Comply with legal, regulatory, contractual, and safeguarding obligations;
• Maintain records, defend legal claims, and enforce agreements;
• Improve our services, reporting, and internal operations where permitted by law.

We do not sell personal data.

We do not use children's personal data for advertising, targeted advertising, behavioural profiling, or any unrelated commercial purposes.

7. Lawful Bases for Processing

Where we act as a controller, we rely on one or more of the following lawful bases (primarily under UK GDPR):

• Performance of a contract;
• Legitimate interests (e.g., security, service improvement, customer support, fraud prevention, product operations — where these interests are not overridden by individual rights);
• Legal obligation;
• Consent (where required by law or where we choose to rely on it).

Where we act as a processor, the school or educational organisation is responsible for the lawful basis of school-managed data.

8. How We Share Personal Data

We share personal data only where necessary and appropriate.

8.1 With the relevant school or organisation

Data is made available to the using school/trust and its authorised users according to configured permissions.

8.2 With authorised users

Data may be visible to school administrators, teachers, staff, parents, or guardians where access is relevant to their role and the service.

8.3 With service providers and subprocessors

We share data with trusted providers that support delivery of SchoolCentralX, including categories such as:

• Hosting and cloud infrastructure;
• Authentication and identity services;
• Storage and database services;
• Email and notification delivery;
• Customer support tooling;
• Billing and payment processing;
• Analytics, monitoring, logging, and security services;
• Development, maintenance, and operational support.

All such providers are bound by data protection agreements requiring them to process data only for authorised purposes and maintain appropriate security. A current list of key subprocessors is available on request or via a dedicated subprocessor page (contact privacy@schoolcentralx.com).

8.4 With professional advisers

Lawyers, auditors, accountants, or insurers where reasonably necessary.

8.5 For legal and regulatory reasons

Where required by law, court order, or to protect rights, safety, and security.

8.6 In connection with a business transaction

Merger, acquisition, or sale of assets, subject to confidentiality and legal safeguards.

We do not sell or rent personal data to third parties.

9. International Transfers

Personal data may be stored or processed in countries outside the country of origin. Where required by law, we use appropriate transfer mechanisms such as adequacy decisions, standard contractual clauses, the UK International Data Transfer Addendum, or other recognised safeguards.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including service provision, security, legal compliance, dispute resolution, and agreement enforcement.

Retention periods vary by data type and context. Examples include:

• Active account and profile data — for the duration of the customer relationship plus a limited post-termination period;
• Support, security, and audit logs — for a reasonable period to investigate issues and comply with obligations;
• Billing and financial records — for the period required by tax, accounting, or legal rules;
• School-managed data — according to the customer agreement, school instructions, and applicable law.

At the end of the retention period, we delete, anonymise, or securely dispose of the data unless longer retention is required or permitted by law.

Upon termination of a school's agreement, school-managed personal data will be deleted or returned within the timeframe stated in the agreement (typically 30–90 days), subject to limited backup/archival copies for security and legal compliance.

For children's personal data (see Section 12), we apply stricter data minimisation and retention schedules in line with COPPA and other applicable laws.

11. Security

SchoolCentralX implements technical and organisational measures designed to protect personal data against unauthorised access, misuse, loss, alteration, or disclosure. These include:

• Authentication and role-based access controls;
• School-level data separation;
• Secure transmission methods (e.g., TLS encryption);
• Logging and monitoring;
• Backup and recovery processes;
• Environment segregation;
• Internal access reviews and secure development practices.

No system is completely secure, but we maintain safeguards appropriate to the sensitivity of the data and the risks involved. We will notify affected customers of personal data breaches without undue delay where required by law.

12. Children's Data and School-Managed Accounts (COPPA Compliance)

SchoolCentralX is designed exclusively for use by schools, parents, guardians, and authorised school staff. It is not directed to children for independent or consumer use.

Where schools use SchoolCentralX to upload, manage, or share information relating to students (including children under 13), we process that data solely to deliver school-authorised educational, administrative, and school-home communication services. In these cases:

• The relevant school, trust, or educational organisation acts as the data controller and is responsible for determining the lawful basis, providing notices to parents/guardians, and obtaining any required consents or authorisations under applicable laws, including COPPA (US), FERPA, GDPR, and other child privacy or education laws.
• SchoolCentralX acts primarily as a data processor. We rely on schools to authorise processing for legitimate educational purposes, consistent with FTC guidance allowing schools to act as the parent's agent for school-related use (and for no other commercial purpose).
• We do not knowingly collect personal information directly from children under 13 outside of school-administered accounts.

SchoolCentralX does not use children's personal data for advertising, targeted advertising, behavioural profiling, sale, or any unrelated commercial purposes. We limit processing to what is necessary for the school's educational objectives and apply data minimisation principles.

We retain children's personal data only as long as reasonably necessary for the specific educational purpose for which it was collected, in accordance with COPPA's data retention and minimisation requirements (amended rule compliance by April 22, 2026).

If you are a parent or guardian with a request concerning school-managed student data, we recommend contacting the relevant school first (as they control that data). We will support valid privacy requests where possible and forward them to the school as appropriate. We do not sell children's personal data.

13. Your Rights and Choices

Depending on applicable law and the context of processing, you may have rights to:

• Access your personal data;
• Correct inaccurate or incomplete data;
• Request deletion of personal data;
• Restrict processing;
• Object to certain processing;
• Request data portability;
• Withdraw consent (where processing is based on consent);
• Complain to a supervisory authority.

To exercise these rights, contact us at privacy@schoolcentralx.com.

If your request relates to school-controlled data, we may direct you to the school or forward the request to them. We may ask for information to verify your identity. We aim to respond within one month (or any shorter statutory period).

Account deletion — You may request deletion of your account by emailing privacy@schoolcentralx.com or using any in-app/platform deletion tools we provide. Some data may need to be retained for legal, security, safeguarding, financial, or contractual reasons.

Notification preferences — You can manage communications and push notifications via account or device settings.

14. Cookies and Similar Technologies

We use cookies and similar technologies for security, login sessions, preferences, functionality, analytics, and service improvement. See our Cookie Policy for details. Where required by law, we obtain consent before using non-essential cookies.

15. Third-Party Services and Links

SchoolCentralX may link to third-party websites or services. We are not responsible for their privacy practices. Please review their policies.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, legal obligations, or practices. Material changes will include an updated "Last updated" date and, where appropriate, notification via the website, platform, app, or other channels.

17. Contact and Complaints

For questions, concerns, or requests:

UK users may complain to the Information Commissioner's Office (ICO) if they believe their data has been handled unlawfully.