DPIA Support Pack
AgentChamp - DPIA Support Pack for Schools
Effective 25 August 2026
What this is, and what it is not
Under Article 35 UK GDPR your school, as controller, must carry out a Data Protection Impact Assessment before using a system that processes children's data at scale. That DPIA is yours: only you know your cohort, your existing systems and your local risks.
What you should not have to do is guess at the supplier half. This pack is that half - the data flows, the risks we have identified, and what we have actually done about each one. Lift from it freely.
The DfE's *Procuring educational technology* guidance tells schools to ask suppliers for exactly this material, and the ICO's June 2026 *Edtech examined* report found that over 40% of audited providers had carried out no DPIA of their own at all. Ours informs everything below.
AgentChamp Ltd - company number 17176256, ICO registration ZC230270, privacy@agentchamp.co.uk.
1. Nature, scope, context and purposes
What the processing is. Children aged 7–11 (Reception to Year 6 supported) read stories on screen, answer short comprehension quizzes, tap words to see definitions, and earn points and badges. Teachers see progress; parents see it too where the school issues a link code.
Why. To give children reading practice they will actually do, and to give teachers evidence of who is progressing and who is stuck.
Scale. One record per enrolled pupil. Reading activity accumulates per session. No data is collected about anyone who is not enrolled.
Roles. Your school is the controller. AgentChamp is the processor, acting only on your documented instructions under the DPA. Where a parent separately subscribes and links to your pupil, that parent's own account is under AgentChamp's controllership; the pupil record stays yours.
Relationship with children. Children never register themselves, never agree to anything, and cannot buy anything. Every account is created by an adult.
2. Data flows
Into AgentChamp. A school administrator enrols pupils - name, year group, class. Optionally gender, and optionally an additional-reading-support marker. Nothing else. There is no MIS integration and no bulk import of wider pupil records; the import accepts five fields and rejects the rest.
Within AgentChamp. Reading activity is written as the child reads. Everything is stored in a Cloud SQL database in Google's London region. Files (cover images, audio) are in Cloud Storage, also London.
Out of AgentChamp.
| Destination | What goes | Contains pupil data? |
|---|---|---|
| Google Cloud (London) | Everything - it is the hosting | Yes, as infrastructure |
| Microsoft Azure Speech (UK South) | Story text, for narration | No |
| ElevenLabs (US) | Story, quiz and dictionary text, at publish time | No |
| Resend (US) | Staff name and email, for service emails | No pupil data |
| The child's browser | The pages they read | Yes, to the child themselves |
Nothing else leaves. No analytics service, no advertising network, no error-reporting service. Since 25 August 2026 not even a font - those used to come from Google Fonts and a CDN on every page a child saw, and now come from us.
Stated precisely: a pupil's browser talks to our application origin and to storage.googleapis.com, which is our own Cloud Storage bucket serving covers and audio. Google sees that request as our hosting provider - the same relationship as every other row in this table. No company outside the table above sees a pupil's device or IP address at any point.
Audio is the flow worth understanding, because it looks like it should carry pupil data and does not. Narration and quiz audio are synthesised once, when a story is published, and the same file is served to every reader. A speech provider therefore never receives a request tied to a child - it receives a story, once, before any child has opened it.
3. Necessity and proportionality
| Data | Why it is necessary | Could we do without it? |
|---|---|---|
| Name | Teachers need to know whose reading they are looking at | No - an anonymous roster is useless to a teacher |
| Year group | Sets curriculum vocabulary and the reading-level floor | No |
| Class | Scopes teacher access to their own pupils, which is a security control | No |
| Username, login code, PIN | The child has to be able to sign in | No |
| Reading activity | It *is* the service - the record of practice and the basis of the recommendation | No |
| Gender | Roster convenience for the school | Yes - optional, and never requested from the child |
| Additional-reading-support marker | Lets placement offer easier books to a child who needs them | Yes - optional |
| Date of birth | - | We removed it. Collected once, never used, column dropped on minimisation grounds |
We do not collect contact details, addresses, photographs, location, UPNs, ethnicity, FSM or pupil-premium status, or EAL flags. Not "we do not use them" - we do not hold them.
4. Risks and mitigations
| # | Risk to children | Likelihood / severity | What we have done |
|---|---|---|---|
| 1 | A pupil's data is seen by the wrong adult - another school, another class | Low / High | Access control scoped to school and to class. Credential reveal is limited to staff assigned to that class, and every reveal is logged to a named person |
| 2 | A pupil's login is used by someone else | Medium / Medium | Login codes and PINs are per pupil, revealable only to class staff, rate-limited against guessing, and revocable. The account holds no contact details, so a compromised login exposes reading progress and nothing else |
| 3 | A parent links to a child who is not theirs | Low / High | Link codes are issued only by the school, are single-use, expire, and are rate-limited. Before linking, the code shows only the child's first name and school - enough to check, not enough to learn anything. The school sees every linked guardian and can end any link |
| 4 | A child is identified to a third party | Low / High | No third-party resource loads on a child's page. Audio is synthesised once from published text. No analytics exists in the product |
| 5 | Children's data is used to train AI | - / High | It is not, and cannot be: generation runs offline from adult-chosen parameters. This is a contractual obligation in the DPA, not just a policy statement |
| 6 | A child types something they should not | - / Medium | There is nowhere to type. No chat, no comments, no free-text field, no story creation by children. Avatar names come from a curated pool. This is enforced by a test, so it stays true |
| 7 | Children are nudged into excessive screen time | Medium / Medium | No advertising, no purchases by children, no notifications to children, no infinite feed. Streaks and points reward reading, and the content is bounded - a story ends |
| 8 | Data is kept longer than needed | Medium / Medium | Deletion is automated daily, not left to anyone remembering: 365 days after leaving roll or going inactive, then a 90-day reversible grace period, then irreversible erasure |
| 9 | An erasure request is not honoured | Low / High | Erasure is a real cascading delete, tested, with an append-only audit record proving it happened. You can verify it - ask us to erase a test pupil and export the record |
| 10 | Placement mislabels a child as a weak reader | Medium / Low | It only changes which books are suggested. Staff see it and can pin, raise or lower it. It has no assessment consequence |
| 11 | Breach at AgentChamp or a sub-processor | Low / High | Encryption in transit and at rest; outbound allow-list; secret scanning in the build pipeline; we notify you of every breach affecting your data within 48 hours, not only the ones we judge significant |
| 12 | We go out of business | Low / Medium | Data is exportable by you at any time from the platform, without asking us |
5. Answers to the standard supplier questions
- Where is data stored? United Kingdom. Google Cloud
europe-west2(London); Azure UK South for narration. - Is data transferred outside the UK? No pupil personal data. Three narrow flows carry either no personal data or a staff email address, each under SCCs + UK Addendum or the UK-US Data Bridge. Full table in the DPA.
- Who are your sub-processors? Five, listed with what each receives in the Sub-Processor Inventory. You get 30 days' notice before any addition and may terminate if you object on reasonable grounds.
- Do you have a DPO? No statutory appointment is required at our scale (Article 37 assessed). A named Data Protection Lead is accountable - privacy@agentchamp.co.uk.
- Are you ICO registered? Yes - ZC230270.
- Do you hold Cyber Essentials or ISO 27001? Not currently. We would rather tell you that than imply otherwise. Our technical measures are published in full in
security-measures.mdso you can assess them on their merits. - Do you carry out penetration testing? We run internal security audits with documented findings and remediation. We do not yet commission independent third-party penetration tests.
- How is data deleted at contract end? Deleted or returned at your choice. Two-stage: immediate deactivation, irreversible erasure after 90 days. You may ask in writing for the 90-day window to be waived for a specific request.
- Can we export our data? Yes, from the platform, at any time, without contacting us.
- How quickly are breaches reported? Within 48 hours of becoming aware, for every personal data breach affecting your data.
- Do you use children's data for AI training or product development? No, and the DPA forbids it.
- Is there any advertising or analytics? None anywhere in the product.
6. Consulting children and parents
The Children's Code expects providers to consider children's views. Ours are reflected in two specific design decisions, recorded here so you can see the reasoning rather than take a claim on trust:
- Children asked not to be locked out when they forget a login. Rather than resetting the credential - which loses the child their reading identity - we made codes re-showable to class staff, and then made every reveal audited to a named adult so the convenience does not become a hole.
- Reading aloud matters most to the children who find reading hardest. Rather than synthesising per child, which would be simpler and would have meant sending a third party something tied to a reader, we synthesise once per story and share the file. It costs more and it means no speech provider ever sees a child.
We welcome challenge on both from your DPO or your pupils.
7. Residual risk
After the mitigations above, we assess the residual risk to children as low, with these caveats stated plainly:
- We hold no independent security certification. That is a real gap in assurance, not a real gap in the controls, but you should weigh it.
- The additional-reading-support marker is special-category data. If your school does not need it, do not record it - the platform works without it.
- Stripe's fraud-detection component fingerprints the device on adult checkout pages. No child can reach one, but it exists and we would rather you heard it from us.
8. If you need more
Ask. privacy@agentchamp.co.uk. We will answer a DPO questionnaire, join a call with your data protection officer, or complete your trust's own supplier assessment form. If something in your assessment says we cannot do it, tell us - several of the controls above exist because a school asked.
AgentChamp keeps you signed in and remembers your reading settings using cookies and browser storage. What we store, in full.