Data Sharing Agreement

Version 1.0 — Effective 1 March 2026 Governing Law: England & Wales | ICO Registration: ZA809755 | Regulation: UK GDPR · DPA 2018 · ICO Children’s Code

This document forms a Data Sharing Agreement between School Wellbeing Accelerator Ltd (trading as Edu Intelligence from Welbee) and your school, trust, or education establishment. It sets out what data is shared, for what purpose, how it is protected, and the rights and obligations of each party under UK data protection law.

1. Parties to This Agreement

Data Controller: The school, multi-academy trust, or education establishment that subscribes to Edu Intelligence from Welbee and provides data for processing under this Agreement.

Data Processor: School Wellbeing Accelerator Ltd, trading as Edu Intelligence from Welbee. Registered address: International House, 307 Cotton Exchange, Old Hall Street, Liverpool, L3 9LQ. Company No. 11600110. ICO Registration No. ZA809755.

By using the Edu Intelligence platform, your organisation confirms that an authorised representative has read and accepted this Agreement on behalf of the school, trust, or group.

2. Background & Purpose

Edu Intelligence from Welbee is a secure, AI-powered platform built for schools, multi-academy trusts, and education groups. It brings together your approved data sources — such as your Management Information System (MIS), attendance data, behaviour records, and stakeholder survey responses — and makes them available through a fully managed, UK-hosted data environment.

The purpose of this Data Sharing Agreement is to:

Set out clearly what data your organisation shares with us and why
Define the legal basis and roles under which that data is processed
Document our security, ethical AI, and data protection commitments to you
Ensure both parties meet their obligations under UK GDPR, the Data Protection Act 2018, and the ICO’s Children’s Code (Age Appropriate Design Code)

Edu Intelligence is designed exclusively for the UK education sector, and every aspect of how we handle your data reflects the unique sensitivity of the school environment and the children, staff, and families you serve.

3. Data Controller & Processor Roles

The legal roles of each party under UK GDPR are as follows:

Role	Party	What This Means
Data Controller	Your school, trust, or group	You determine the purposes and means of processing pupil, staff, and parent data. You are responsible for ensuring you have the appropriate lawful basis to share data with us.
Data Processor	School Wellbeing Accelerator Ltd (Edu Intelligence from Welbee)	We process personal data only on your documented instructions and for the purposes set out in this Agreement and your Licence Agreement.
Data Controller (limited scope)	School Wellbeing Accelerator Ltd	We act as Data Controller only for the personal data of your named staff users who hold accounts on our platform — such as their name, work email address, and login credentials.

We process all school, student, and parent data solely as Data Processor, acting on your instructions and in accordance with this Agreement. We will never use that data for any purpose of our own.

4. Data We Receive From You

The specific data fields shared depend on which Edu Intelligence services and integrations your organisation has enabled. Data is received via your connected MIS — typically through Wonde Ltd or a direct API connection. You retain full control over which data categories you choose to share.

4.1 Staff & Workforce Data

Data Category	Examples	Purpose
Staff identity & role	Name, job title, department, employment type, line manager	Enable platform access; power staff survey filtering and analytics
Staff demographics	Start date, age band, gender (optional)	Segment wellbeing and engagement insights by workforce group
Work contact details	Work email address	Send survey invitations; deliver platform notifications
Survey responses	Responses to staff wellbeing and engagement surveys	Generate aggregated wellbeing and engagement analytics

4.2 Pupil / Student Data

Data Category	Examples	Purpose
Pupil identity	Year group, registration group, house group, UPN (where necessary for matching)	Segment and filter analytics; match MIS data to survey responses
Characteristics & flags	SEND status, Pupil Premium, FSM, gender, ethnicity	Generate disaggregated insight by protected or contextual characteristic
Attendance data	Attendance percentage, absence categories, persistent absence flag	Cross-reference attendance with wellbeing and engagement indicators
Behaviour data	Behaviour incidents (anonymised/aggregated)	Surface trends; support early intervention analysis
Assessment data (EI Pro & Enterprise Plus only)	Assessment scores, attainment data	Cross-reference attainment with wellbeing and engagement patterns
Survey responses	Student responses to wellbeing surveys; Safe Space messages	Generate student wellbeing analytics; enable pastoral support

4.3 Parent / Carer Data

Data Category	Examples	Purpose
Contact details	Parent/carer email address (for survey invitation only)	Deliver parent stakeholder survey invitations
Survey responses	Responses to parent/carer stakeholder surveys	Generate parent satisfaction and experience analytics

Your control over data scope: You control which of the above categories are shared. If you choose to share limited categories, this may restrict the depth of insight we can provide. We will not request data beyond what is necessary for the services enabled on your account.

4.4 Platform & Technical Data

We also collect limited technical data relating to platform use — such as login activity, browser type, and IP address — to maintain security and improve our service. This data is aggregated and does not identify individuals.

5. How We Use Your Data

We process the data you share with us for the following purposes only:

Providing the Edu Intelligence service — aggregating, analysing, and presenting insights through your secure platform environment
Powering AI-generated analysis — enabling our AI agents to generate evidence-backed recommendations using aggregated and anonymised data only (see Section 6)
Running stakeholder surveys — delivering survey invitations and processing responses for staff, students, and parents
Supporting the Safe Space and Check-in service — where enabled, facilitating secure student wellbeing messaging and safeguarding flags for your designated staff
Enabling the Staff Wellbeing Toolkit — providing access to resources and training materials
Maintaining and improving our platform — using anonymised, aggregated technical data to ensure system security and reliability

We will not use your data for any of the following without your explicit written consent:

Training or fine-tuning AI models (including our own or those of third-party AI providers)
Providing benchmarks, reports, or services to other clients using data derived from your institution
Any commercial purpose not directly related to the services we provide to you
Profiling, automated decision-making, or any processing that would have legal or similarly significant effects on individual students or staff

6. Our AI & Data Processing Commitments

Edu Intelligence uses a proprietary agentic AI system to generate insights for your organisation. Given the sensitivity of the data environment in which we operate, we make the following commitments — by design, not policy:

No AI access to individual data. Our AI operates exclusively on aggregated and anonymised data. It never has access to identifiable student, staff, or parent records. Insights are derived from patterns across cohorts — not from individual profiles.

No AI model training on your data. Your data is never used to train, fine-tune, or otherwise improve AI models — ours or any third-party provider’s. Customer data is excluded from all model training pipelines and is not retained by AI providers after processing.

No automated decision-making. AI outputs are advisory — suggested actions and insights for human review. Final decisions about students, staff, or school policy rest with your team. We do not make automated decisions with legal or significant effects on individuals.

Separate data environments. Your institution’s data is stored in its own structurally separate, secure data warehouse — not just tagged within a shared database. This prevents cross-contamination and ensures your data is never accessible to other clients.

Bias controls & safety. AI prompts are anonymised before processing. Models are configured to minimise hallucination risk. Human feedback loops are used to identify and correct errors. Our system is tested for bias and fairness.

Explainable AI. Our AI shows the evidence and reasoning behind its insights and recommendations. We do not present “black box” outputs — you should always be able to understand why a particular action has been suggested.

These commitments are built into the architecture of Edu Intelligence — they are not simply policy statements. The structural separation of data, and the AI’s inability to access individual records, are technical properties of the system.

7. Data Security & Infrastructure

We are committed to maintaining the highest practicable level of security for the data entrusted to us.

7.1 Hosting & Infrastructure

UK-hosted data — all personal data is stored and processed within the United Kingdom
Encryption at rest and in transit — all data is encrypted using industry-standard protocols (AES-256 at rest; TLS in transit)
Dedicated data warehouses — your institution’s data is held in a structurally separate environment, not a shared database partitioned by school ID
Real-time data synchronisation — data flows automatically from your connected MIS, reducing manual handling risk

7.2 Access Controls

Access to personal data is strictly limited to staff with a documented business need
All staff with access to personal data are subject to confidentiality obligations and data protection training
Platform access for your team is controlled through secure authenticated user accounts
Access logs are maintained and reviewed periodically

7.3 Compliance & Oversight

We are registered with the Information Commissioner’s Office (ICO Reg. ZA809755)
We have appointed a Data Protection Officer: Mark Solomons
We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities
Our practices are reviewed and updated in line with ICO guidance, the UK Children’s Code, and DfE guidance on generative AI in education

8. Sub-processors & Third Parties

In order to deliver the Edu Intelligence service, we engage a small number of carefully selected sub-processors. We require all sub-processors to meet the same data security and protection standards we hold ourselves to, and we only permit them to process your data for specified, agreed purposes.

Category	Purpose	Data Boundary
MIS Integration Provider (e.g. Wonde Ltd)	Secure extraction and transmission of MIS data from your school system to our platform	UK / EEA
Cloud Infrastructure Provider	Hosting and managing the secure data warehouse and platform infrastructure	United Kingdom
AI Model Provider	Processing of aggregated, anonymised data by our AI agents. No individual data is passed to any AI provider. Data is not retained by the provider after processing.	UK / EEA
Email & Communication Provider	Delivery of survey invitations and platform notifications	UK / EEA

We will notify you of any material changes to our sub-processors that affect the processing of your personal data. You may request an up-to-date list of current sub-processors at any time by contacting support@welbee.co.uk.

We do not sell, rent, or share your data with third parties for any commercial purpose. We do not share your data with other schools, trusts, or organisations. We do not use your data for advertising.

9. Data Retention & Deletion

We retain personal data only for as long as is necessary to provide the services described in your Licence Agreement and as required by law.

Data Type	Retention Period
School / trust data (pupil, staff, survey data)	For the duration of your active subscription. Upon termination, personal data is retained for a maximum of 12 further months before secure deletion, unless anonymisation is applied.
Anonymised and aggregated data	May be retained indefinitely for statistical purposes. This data cannot be used to identify any individual.
Staff user account data	Retained while an account is active; deleted within a reasonable period following account closure, subject to legal retention obligations.
Financial and contract records	Retained for 6 years following the end of the commercial relationship, as required for tax and accounting purposes.

You may request early deletion of your institution’s data at any time. We will respond to deletion requests within a reasonable timeframe and confirm completion in writing.

10. Your Rights as Data Controller

As the Data Controller, your organisation retains the following rights and we are committed to supporting you in exercising them:

Right to instruct — we will only process data on your documented written instructions
Right to audit — you may request information to satisfy yourself that we are meeting our obligations under this Agreement and applicable data protection law
Right to restrict or withdraw consent — you may withdraw consent for specific data categories or integrations at any time (see Section 14)
Right to data portability — you may request a copy of your institution’s data in a commonly used electronic format
Right to deletion — you may request the deletion of your institution’s data (see Section 9)
Right to be informed of changes — we will notify you of any material changes to this Agreement, our sub-processors, or any security incidents affecting your data

11. Data Subject Rights

Individuals whose data we process (staff, students, parents) have rights under UK GDPR, including rights of access, rectification, erasure, restriction, and objection. As the Data Controller, your organisation is the primary point of contact for data subject requests.

We will assist you in meeting your obligations to data subjects. Specifically:

We will respond promptly to reasonable requests to help you respond to Subject Access Requests (SARs)
We will process corrections or deletions within the platform where these are driven by updates to your source MIS data
Where a data subject contacts us directly with a rights request, we will forward this to you as the Data Controller and assist as appropriate

Data subjects wishing to exercise their rights should contact your school or trust directly in the first instance. Where Edu Intelligence from Welbee holds records directly, contact can be made at support@welbee.co.uk. Further information on individual rights is available from the ICO at ico.org.uk.

12. Intellectual Property

Your data is yours. All data provided to us — including survey responses, MIS data, and any insights or content generated from that data — remains the intellectual property of your institution and/or the individuals who created it. Specifically:

The thoughts, feedback, and ideas shared by your staff, students, and parents in surveys or other platform interactions belong to your institution (or the individuals concerned)
We will not use this content for any commercial purpose outside of the services directly provided to you
We will not use your data or any IP arising from it to train AI models, benefit other clients, or for any general research and development unconnected to your subscription
The Edu Intelligence platform, software, AI models, and associated materials remain the intellectual property of School Wellbeing Accelerator Ltd

This principle is consistent with the DfE’s guidance on generative AI in education and our commitment to Your Data, Your Control.

13. Breach Notification

In the event of an actual or suspected personal data breach affecting your institution’s data, we will:

Notify you without undue delay and, where feasible, within 72 hours of becoming aware of the breach
Provide details of the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it
Cooperate fully with you to investigate the breach, mitigate its effects, and fulfil any reporting obligations to the ICO or affected individuals

As the Data Controller, your organisation is responsible for any reporting obligations to the ICO and to affected individuals that arise from a breach. We will provide all reasonable assistance in discharging these obligations.

To report a concern or suspected breach, contact: support@welbee.co.uk

14. Withdrawing Consent & Termination

You may withdraw consent for data sharing at any time — at the level of a specific data category, a specific integration, or all data sharing entirely.

Please note: Withdrawing consent for data sharing does not automatically end your commercial subscription or cancel your Licence Agreement with us. You will need to notify us separately to cancel your subscription. Withdrawing consent for specific data categories may significantly reduce the insights and functionality available to you.

Upon termination of your Licence Agreement, data processing will cease and your data will be handled in accordance with the retention and deletion provisions in Section 9. All personal data held on our platform will be securely deleted within 12 months of your subscription ending, unless you request earlier deletion.

To withdraw consent or initiate termination, contact: support@welbee.co.uk

15. Changes to This Agreement

We will review and update this Agreement from time to time to reflect changes in our services, legal requirements, or data protection best practice.

Where we make minor changes (for example, contact detail updates or editorial clarifications), we will update this page with a new effective date. Where we make material changes that affect the basis or scope of data processing, we will:

Notify you by email to your registered contact address at least 30 days before the changes take effect
Provide a clear description of what has changed and why
Obtain your re-acceptance where required by applicable law

Continued use of the Edu Intelligence platform after the effective date of any changes constitutes acceptance of the updated Agreement. Previous versions of this Agreement are available on request by contacting support@welbee.co.uk.

16. Governing Law & Contact

This Agreement and any dispute or claim arising from it shall be governed by and construed in accordance with the law of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales.

This Agreement incorporates by reference our Privacy Policy and Terms and Conditions. In the event of any conflict between this Agreement and those documents, this Agreement shall prevail with respect to data sharing and processing matters.


Data Protection Officer	Mark Solomons
Email	support@welbee.co.uk
Telephone	01277 554 001
Registered Address	International House, 307 Cotton Exchange, Old Hall Street, Liverpool, L3 9LQ
ICO Registration	ZA809755
ICO (complaints)	ico.org.uk · 0303 123 1113

17. Acceptance

By using the Edu Intelligence platform, your organisation confirms that an authorised representative has read, understood, and accepted this Data Sharing Agreement on behalf of the school, trust, or education group. This Agreement takes effect on the date your Edu Intelligence subscription commences.

If you have any questions about this Agreement, please contact us at support@welbee.co.uk before using the service.

If your organisation requires a countersigned version of this Agreement for procurement or governance purposes, please contact us and we will arrange this for you.

Edu Intelligence from Welbee is a trading name of School Wellbeing Accelerator Ltd. Registered in England & Wales, Company No. 11600110. Data Sharing Agreement v1.0 — effective 1 March 2026.

Data Sharing Agreement

Contents

1. Parties to This Agreement

2. Background & Purpose

3. Data Controller & Processor Roles