Security & compliance for schools and MATs
Qwixl is built for UK education. This page explains roles, contracting, data protection, and security in plain terms — so your DPO, ICT, and procurement leads know what to expect before we send the full pack.
Who does what
For Qwixl:Academy, the school or multi-academy trust is the controller of pupil, staff, and parent personal data used for teaching and school administration. Qwixl Ltd is the processor for that Customer Data under a Data Processing Agreement (UK GDPR Article 28).
Wonde remains the school’s MIS integration provider under separate school–Wonde terms. Academy syncs only the permissions in our standard Required / Optional / Not requested schedule — we do not negotiate a bespoke category list per school.
Consumer products (Homework, Milo, Streams) follow the published Privacy Policy and Terms of Service. Academy schools use the Academy contract pack described below.
How contracting works
- Discovery — we confirm the signing entity (school vs trust), invoice entity, approximate numbers, preferred term, Pilot vs paid, LLM tier, AI image generation On/Off, DPO and safeguarding contacts, and whether Wonde is already in use.
- Standard pack — we send one Academy agreement pack (PDF). The Order Form carries parties and commercials; the MSA, Product Terms, DPA, SLA, and schedules are our standard terms.
- Your review — legal, DPO, and procurement review the pack. We answer diligence questions; we do not rewrite the product feature set per school.
- Sign and pay — completed Order Form; invoice per the Order Form.
- Go-live — tenant provisioned; Wonde connected with Required permissions; LLM tier and AI image entitlements match the Order Form.
Order Form options are LLM Standard or Premium and AI image generation On or Off only. Everything else in the Academy product set is included under the standard contract.
What we send (and when)
At proposal / legal review (the client pack):
- Order Form
- Master Services Agreement
- Product Terms (including Close Contacts, acceptable use, GenAI, SEN)
- Data Processing Agreement and Wonde annex
- Wonde Permissions Schedule (Required / Optional / Not requested)
- Master SLA and schedules (platform, support, Wonde sync, incidents)
- Roadmap Schedule for Planned controls (non-warranty until Implemented)
- Privacy notices for staff, parents, and pupils (you complete the parties / DPO block before publishing locally)
- DPIA School Support Pack — our standard explanation so your DPO can complete your DPIA
After signature: invoice, Wonde connection instructions, and Required permissions confirmation before full functionality is promised.
On request during diligence: sub-processor list (DPA Annex III), transfer notes once regions are confirmed, and — when available under NDA — pen-test executive summary. We do not publish internal decision logs or unfinished assessments as client warranties.
Security posture (honest)
Production Academy and Qwixl services run on established cloud providers (including Vercel for application delivery and Supabase for managed Postgres with row-level security). Access to APIs requires authenticated sessions and role checks. Data in transit uses TLS. Hosting providers supply encryption at rest for managed stores.
Implemented contractual technical and organisational measures are those listed as live in the Academy DPA Annex II (authentication and role checks; Close Contact controls as released; TLS; host encryption at rest; breach notification process).
Planned (explicitly non-warranty until evidenced and promoted) includes items such as automated retention enforcement with production evidence, self-serve data-subject tooling, dedicated SEN access audit logging, Cyber Essentials certification, independent penetration test with a sharable summary, and per-school Wonde credential isolation. We state these on the Roadmap Schedule so we do not over-claim in sales conversations.
Report security concerns to security@qwixl.com. Privacy questions: privacy@qwixl.com.
Data protection themes MATs usually ask about
- Lawful basis — you decide Article 6 (and Article 9 for SEN) for your processing; we process on your documented instructions.
- SEN and special category data — SEN sync is a Required Wonde permission for Academy. Close Contacts may see identifiable pupil/SEN context; other staff see anonymised or aggregated views per Product Terms. Signals support professional review; they are not diagnoses and do not replace statutory SEN or safeguarding duties.
- AI — we do not use identifiable pupil data to train foundation models for other customers. Anonymised or aggregated data may be used to improve the product. LLM tier and AI image generation follow the Order Form.
- Exit — normal end: export window then deletion window as in the DPA. Non-payment: arrears and grace period rules apply before we may delete.
- Incidents — we notify without undue delay and aim to support your 72-hour controller timeline where we are processor.
Can we pick modules or turn off SEN sync?
No. Academy is one standard product. Order Form options are LLM tier and AI image generation only. SEN is Required in the Wonde Permissions Schedule and is a condition of the Service. Optional Wonde categories may be declined, with related features reduced.
Will you sign our school or MAT DPA instead?
We prefer our Academy DPA because it maps to the live product, Wonde schedule, and sub-processors. Exceptions are counsel-led only.
What is the liability position?
The opening Academy position is a cap of twelve months’ fees, with uncapped heads only where the law requires. We do not open with unlimited liability.
Do you have Cyber Essentials or a pen-test report today?
Cyber Essentials and an independent pen-test summary are on our Planned controls roadmap. We will not claim them as live warranties until evidence exists. Ask us for current status; we will answer accurately.
What changes on a pilot?
The same document pack applies. If the Order Form marks Pilot = Yes, SLA service credits do not apply.
Ready for the full pack?
Tell us your school or trust, DPO contact, and target go-live. We will send the standard Academy contract and data-protection pack and walk your team through diligence questions.
Have a private onboarding link?
After discovery, Qwixl sends a private onboarding URL (not listed publicly). Use that link to download the standard pack and submit Order Form details. If you do not have a link yet, contact us or apply for Academy beta.