Privacy Policy
Last updated: 23 October 2026
This Privacy Policy explains how School IQ Labs Ltd ("we", "us", "our"), the company behind StaffIQ, collects, uses, stores, and protects personal data when you use our platform. School IQ Labs Ltd is a company registered in England and Wales. For staff records that schools and trusts put into StaffIQ, we act as a data processor for them. For our own website, enquiries, marketing and customer accounts, we are the controller.
1. Who We Are
School IQ Labs Ltd is the developer and operator of StaffIQ, a cloud-based platform for school compliance (Single Central Record) and HR management. For the purposes of data protection law:
- We are a processor for the staff records that our Customers (schools, academy trusts and educational organisations) put into StaffIQ. The Customer is the controller.
- We are the controller for our own website, enquiries, marketing and customer accounts (see section 5).
2. Data We Collect
We collect and process the following categories of personal data:
2.1 Customer Account Data
- Name, email address, and job title of account administrators and users
- Organisation name, address, and billing information
- Authentication credentials (passwords are hashed and never stored in plain text)
2.2 Staff Record Data (processed on behalf of Customers)
- Personal details: name, date of birth, address, contact information
- Employment details: job title, role type, contract type, start and end dates, salary information
- Identity and compliance documents: DBS certificate numbers, right-to-work evidence, qualifications, references, safeguarding training records
- Demographic data: gender, nationality, ethnicity (where provided by the Customer for workforce reporting)
- Document uploads: scanned certificates, ID documents, and other files uploaded by Customer users
2.3 Usage and Technical Data
- IP addresses, browser type, device information
- Pages visited, features used, and session duration
- Error logs and performance data
- On our marketing website, only if you accept optional cookies: analytics and advertising measurement data (see section 12)
2.4 Website Enquiries
- Details you give us through our website: your name, work email, phone number, school or trust, job title and message when you contact us or request a demo; your name, email and school when you download a gated resource; and your email when you subscribe to our newsletter
- With these, the campaign details in the link that brought you to our website (for example, the name of the advert or email, known as UTM tags) and the page you came from
3. How We Use Your Data
We process personal data for the following purposes:
- Service delivery: To provide, maintain, and improve the StaffIQ platform
- Compliance management: To enable Customers to manage their Single Central Record and staff compliance checks
- Alerts and notifications: To send expiry reminders, compliance alerts, and system notifications
- Audit logging: To maintain a record of actions taken within the platform for accountability and regulatory purposes
- Support: To respond to Customer queries and provide technical support
- Analytics: To generate aggregated, anonymised insights about platform usage (never individual-level data shared externally)
- Legal obligations: To comply with applicable laws, regulations, and legal processes
4. Legal Basis for Processing
We process personal data on the following legal bases under UK GDPR:
- Contract performance: Processing necessary to deliver the StaffIQ service to our Customers
- Legitimate interests: Platform security, fraud prevention, and service improvement
- Legal obligation: Where required by law (e.g. financial record-keeping)
- Consent: Where applicable, such as for marketing communications (which you can opt out of at any time)
For staff record data, our Customers are the data controllers and are responsible for establishing the appropriate legal basis for their processing activities.
5. When We Are the Controller
- What and why: enquiry and demo details, resource downloads, newsletter sign-ups, customer account and billing contacts. We use them to reply to you, arrange demos, run customer accounts, bill and send the newsletter.
- Lawful basis: legitimate interests (replying to enquiries, running customer accounts, security); consent (newsletter, optional cookies); legal obligation (accounting and tax records).
- Marketing: we only send the newsletter if you signed up. You can object to marketing at any time. If you unsubscribe we keep your email on a suppression list so we don't email you again.
- How long we keep it: newsletter: until you unsubscribe. Customer account and billing records: for the contract and 6 years after it ends, for accounting and legal claims.
6. Data Sharing
We do not sell personal data. We share data only in the following circumstances:
- Sub-processors: We use carefully selected third-party services to operate our platform (see section 10).
- Inspector access: Customers may generate time-limited, read-only links to share compliance data with inspectors (e.g. Ofsted, KHDA). This is initiated and controlled by the Customer.
- Legal requirements: Where required by law, regulation, or valid legal process
7. Data Retention
We retain personal data for as long as the Customer account is active and as required to fulfil our contractual obligations. Customers set retention periods for staff records in StaffIQ. Once a Customer turns retention on, a daily job applies them: leavers past the retention period are archived and, where the Customer chooses, archived records and leavers' documents are deleted. Upon account termination:
- The Customer's data can be exported for 30 days after account closure; then staff record data and documents are permanently deleted (well within 90 days of closure)
- Audit logs are retained for 12 months after account closure for regulatory compliance, then permanently deleted
- Backups containing personal data are purged within 30 days of deletion from the live system
8. Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Tenant isolation: each organisation's data is logically separated in the application
- Role-based access controls within the platform
- Audit logging of changes to records, report downloads, Inspector Mode activity and sign-ins
- Secure, hashed password storage
9. International Data Transfers
Our platform is hosted in the UK, on Amazon Web Services (AWS) in the London region (eu-west-2). Some of our sub-processors process data outside the UK (see section 10). Where they do, we rely on UK adequacy regulations or, where required, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
10. Sub-Processors
We use the following sub-processors to run StaffIQ:
| Sub-processor | Purpose | Where data is processed |
|---|---|---|
| Amazon Web Services (AWS) | Hosting: the application, the database and file storage | UK (London) |
| OpenAI | AI features: checking evidence documents against recorded data, summarising references and compliance reviews, and matching spreadsheet column headings during import | USA |
| Resend | Transactional email (invitations, alerts, reference requests, password resets and sign-in codes) | USA |
| Twilio | SMS sign-in codes for two-factor authentication | USA |
| Stripe | Subscription billing and payments (we do not store card details) | USA |
| Microsoft (Microsoft 365) | Our email, including support emails you send us | Malaysia |
| Sentry | Error monitoring | EU and USA |
| Google Analytics and LinkedIn | Marketing website analytics, only after you accept cookies. Not used in the StaffIQ application. | USA |
If a sub-processor changes, we email customers at least 30 days before it starts.
We will notify Customers of changes to this list as set out in our Data Processing Agreement.
11. Your Rights
If you are an end user whose data is held within StaffIQ, your data controller is the school or trust that employs you. Please direct data subject requests to your employer in the first instance. We will assist our Customers in responding to such requests.
Under UK GDPR, individuals have the right to:
- Access their personal data
- Rectify inaccurate data
- Request erasure ("right to be forgotten")
- Restrict processing
- Data portability
- Object to processing
Where we are the controller (see section 5), contact us at privacy@staffiq.co. You can also withdraw consent at any time, and you have an absolute right to object to direct marketing. You can contact us first, but you don't have to before complaining to the ICO.
12. Cookies
Essential cookies
These are needed for the site and the StaffIQ application to work, so they don't need your consent.
| Cookie | Purpose | How long |
|---|---|---|
authjs.session-token | Keeps you signed in to the StaffIQ application | Up to 8 hours |
authjs.csrf-token, authjs.callback-url | Protect sign-in against forged requests and return you to the right page after signing in | Until you close your browser |
sidebar_state | Remembers whether the application's sidebar is open | 7 days |
siq_cookie_consent | Remembers whether you accepted or rejected optional cookies on our website | 12 months |
staffiq_region | Remembers whether you chose the UK or UAE version of our website | 12 months |
On secure connections some of these names carry a __Secure- or __Host- prefix.
Optional analytics and advertising cookies
On our public marketing website only, and only if you click Accept, we use the following. They are never used inside the StaffIQ application, and nothing loads if you reject them.
| Service | Purpose | Cookies and how long |
|---|---|---|
| Google Analytics 4 | Understanding how visitors use our website, and counting enquiries, resource downloads and newsletter sign-ups | _ga and _ga_<ID>, up to 2 years |
| LinkedIn Insight Tag | Measuring the results of our LinkedIn advertising (for example, whether a visitor from an advert later requested a demo) and building advertising audiences | Set by LinkedIn, mostly on linkedin.com; see LinkedIn's cookie policy |
| Campaign details | Remembering which advert, email or link brought you to our website, so it can be recorded with an enquiry you make on a later page | siq_campaign in your browser's session storage (not a cookie), deleted when you close the tab |
You can change your choice at any time with the link at the bottom of every page of our website. If you withdraw consent, we stop the tags and delete the Google Analytics cookies on our domain. You can also block or delete cookies in your browser settings.
13. Children's Data
StaffIQ is designed for use by school staff and administrators. We do not knowingly collect personal data from children. If you believe a child's data has been submitted to the platform in error, please contact us immediately.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to Customers via email and an in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.
15. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact:
School IQ Labs Ltd
Suite RA01, 195-197 Wood Street
London, E17 3NU
United Kingdom
Email: privacy@staffiq.co
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.