Schoolio Privacy Policy

Last updated: 17 October 2026

1. Introduction

Welcome to Schoolio, a school management and device management platform available at https://schoolio.org.uk.

Schoolio provides online services designed to help educational organisations manage accounts, devices, classrooms, and administrative activities.

This Privacy Policy explains what information Schoolio collects, how it is used, how it is protected, and what rights users have regarding their personal information.

We are committed to protecting privacy and handling personal information responsibly in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using Schoolio, you acknowledge that you have had the opportunity to read this policy.

2. Information We Collect

The information collected depends on which Schoolio features are enabled, how an educational organisation configures the platform, and how users interact with the service.

2.1 Account and Authentication Data

When users register, sign in, or have accounts created for them, Schoolio may collect and process:

• Username and display name.
• Email address, where provided.
• Unique account and user identifiers.
• Secure password hashes used for authentication.
• Account role, such as pupil, teacher, or administrator.
• Account status and permissions.
• Authentication sessions and session-related identifiers.
• Login timestamps and failed login attempts.
• Account creation and modification timestamps.

Passwords should be stored as secure, one-way hashes rather than readable plain text.

Schoolio uses account information to authenticate users, maintain accounts, enforce permissions, and prevent unauthorised access.

2.2 School and Classroom Data

When school management and classroom features are used, Schoolio may process:

• School or organisation names and identifiers.
• Class names, identifiers, and membership information.
• Pupil and teacher account associations.
• Staff and administrator roles.
• Classroom membership and access permissions.
• Announcements, messages, or other content submitted through enabled classroom features.
• Administrative changes made to school or classroom records.

This information is used to provide classroom functionality and enable authorised staff to manage educational activities.

2.3 Device Management Data

When a device is enrolled in Schoolio through a supported client application, the platform may collect:

• Device name and unique device identifier.
• Device operating system and version.
• Client application version.
• Device enrolment status.
• The school, organisation, or account associated with the device.
• Device connection and last check-in timestamps.
• Online, offline, or connection status, where available.
• Device management and configuration status.
• Results of authorised management commands.
• Device-related error reports and diagnostic information.
• Records of management actions performed by authorised administrators.

Depending on the operating system, permissions, and implemented features, additional device information may be processed when necessary for device management.

Schoolio does not automatically have access to every file, photograph, personal message, password, microphone, camera, or browsing activity on a device merely because the device is enrolled.

Any additional collection or monitoring must depend on the functionality actually implemented, applicable permissions, and the relevant organisation's policies.

2.4 Administrator and Management Activity

To maintain accountability and security, Schoolio may process information relating to administrative actions, including:

• Administrator account identifiers.
• Changes to account roles and permissions.
• Device enrolment and removal events.
• Management commands and their results.
• Changes to school and classroom settings.
• Authentication and security events.
• Relevant timestamps and technical request information.

These records help investigate problems, maintain accountability, and detect unauthorised activity.

2.5 Website and API Technical Data

When the Schoolio website, client application, or API communicates with our services, technical information may be processed, including:

• IP address.
• Request timestamps.
• Requested API endpoints.
• HTTP response status codes.
• Authentication and authorisation results.
• Browser or client application information, where supplied.
• Operating system information, where supplied.
• Error messages and diagnostic logs.
• Rate-limiting, abuse-prevention, and security events.

API requests may also contain account identifiers, device identifiers, or other information needed to fulfil a particular request.

We use technical information to operate Schoolio, maintain reliability, troubleshoot errors, protect our infrastructure, and investigate potential security incidents.

2.6 Notifications and Communications

Where Schoolio provides notifications or communication features, we may process:

• Notification titles and content.
• Notification delivery status.
• Recipient account or device identifiers.
• Relevant delivery timestamps.
• Support enquiries and messages submitted by users.

The content and recipients of notifications depend on the features used and the actions of authorised users.

2.7 Information We Do Not Intentionally Collect

Schoolio is designed to collect information needed to provide its educational, administrative, and device management services.

Unless a feature specifically requires it, we do not intend to collect payment card details, government identification documents, precise location histories, or the contents of personal files and messages on managed devices.

This does not mean that such information could never be submitted by a user or processed by an explicitly enabled feature. Users should avoid submitting unnecessary sensitive information.

3. How We Use Information

Schoolio uses personal information for the following purposes:

• Creating, maintaining, and securing user accounts.
• Authenticating users and managing sessions.
• Applying role-based access controls.
• Providing classroom and school management features.
• Enrolling and managing supported devices.
• Sending authorised device management commands.
• Delivering notifications and service communications.
• Recording relevant administrative and security activity.
• Monitoring service health and diagnosing errors.
• Preventing fraud, abuse, and unauthorised access.
• Maintaining, troubleshooting, and improving the platform.
• Responding to support requests.
• Meeting applicable legal obligations.

We do not sell personal information.

We do not use pupil information for targeted advertising as part of the intended Schoolio service.

4. Legal Basis for Processing

Where Schoolio determines the purposes and means of processing personal information, we rely on an appropriate legal basis under applicable law. Depending on the circumstances, this may include:

• Contract: providing requested services and managing accounts.
• Legitimate interests: maintaining security, preventing misuse, and operating the platform where individuals' rights do not override those interests.
• Legal obligations: complying with applicable legal requirements.
• Consent: where consent is the appropriate legal basis and is required.

Where Schoolio processes personal information on behalf of a school or educational organisation, that organisation will generally determine the purposes and lawful basis for the processing.

5. Schools and Educational Organisations

Schoolio may be used to manage information about pupils, teachers, and other school personnel.

A school or educational organisation may determine which accounts are created, which devices are enrolled, which permissions apply, and how classroom or device management features are used.

Where the school determines the purposes and means of processing, it will generally act as the data controller, while Schoolio may act as its data processor.

Schools are responsible for ensuring that their use of Schoolio is lawful, that appropriate privacy information is provided, and that access to personal information is restricted to authorised individuals.

Schoolio will process information in accordance with applicable law and the relevant arrangements with the organisation.

6. Device Management and Administrator Access

Schoolio's device management features allow authorised administrators to manage supported devices within the limits of the implemented functionality.

Depending on the features enabled, administrators may be able to view device status, manage enrolment, review relevant management records, and issue supported commands.

Device management capabilities vary by operating system, client application, permissions, and configuration.

Administrators must only access information and perform actions they are authorised to carry out. Organisations should inform affected users about applicable device management policies, restrictions, and monitoring.

Schoolio should not be assumed to provide unrestricted access to all information stored on an enrolled device.

7. How We Share Information

We may disclose personal information where necessary to:

• The school or educational organisation managing the relevant account or device.
• Teachers and administrators with appropriate permissions.
• Hosting, infrastructure, database, and security providers.
• Technical service providers helping operate Schoolio.
• Professional advisers where necessary.
• Regulators, law enforcement, or other parties when disclosure is legally required or permitted.
• A successor organisation in connection with a lawful business transfer, subject to applicable safeguards.

We do not sell personal information or share it with advertisers for targeted advertising.

Service providers that process personal information on our behalf should be subject to appropriate contractual and security protections.

8. Data Storage and Security

Schoolio uses technical and organisational measures intended to protect personal information against unauthorised access, alteration, loss, destruction, and disclosure.

Depending on the systems in use, safeguards may include:

• Password hashing and secure authentication.
• Role-based permissions and access restrictions.
• Protected communications between clients and APIs.
• Security logging and monitoring.
• Restrictions on administrative access.
• Backups and recovery procedures.
• Software maintenance and vulnerability remediation.

No online service can guarantee absolute security. Users should protect their login credentials and report suspected account compromise or security incidents promptly.

9. Data Retention and Deletion

Schoolio retains personal information only for as long as reasonably necessary for its intended purposes, subject to applicable legal requirements and agreements with educational organisations.

Retention may depend on the type of information, whether an account is active, school requirements, security needs, and applicable law.

When accounts or devices are removed, associated information should be deleted or anonymised when no longer required, subject to legitimate retention needs and applicable obligations.

Backups and security records may remain for a limited period where necessary for recovery, security, or compliance.

Schoolio should apply documented retention periods and deletion procedures appropriate to the data it processes.

10. Children's Privacy

Schoolio may process children's personal information when used by schools and educational organisations.

We recognise the importance of protecting children's privacy and limiting the information collected about them to what is necessary for the relevant service.

Schools and other organisations using Schoolio are responsible for ensuring that the collection and use of children's information is properly authorised and that pupils, parents, and guardians receive appropriate privacy information where required.

Where consent is relied upon, applicable requirements concerning children and parental responsibility must be followed.

11. Your Rights

Depending on your circumstances and applicable law, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate information.
• Request deletion of personal information where applicable.
• Request restriction of processing.
• Object to certain processing activities.
• Request a copy of information in a portable format where applicable.
• Withdraw consent where processing is based on consent.
• Raise a complaint with a data protection authority.

If your information is managed by your school, you may need to contact the school in the first instance.

You can also contact Schoolio through its website to raise a privacy concern.

In the United Kingdom, you can contact the Information Commissioner's Office (ICO) at https://ico.org.uk/.

These rights are subject to the conditions and exemptions set out in applicable law.

12. International Transfers

Personal information may be processed outside the United Kingdom if the hosting or technical providers used by Schoolio operate internationally.

Where required by UK data protection law, appropriate safeguards will be implemented before personal information is transferred internationally.

13. Cookies and Website Technologies

The Schoolio website may use essential cookies or similar technologies to support authentication, session management, security, and core website functionality.

Any optional analytics or tracking technologies introduced must be assessed and disclosed appropriately. Consent will be obtained where legally required.

Users can manage cookies through their browser settings, although disabling essential cookies may affect website functionality.

14. Third-Party Services

Schoolio may depend on third-party services for hosting, infrastructure, email delivery, or other technical functionality.

Those providers may process information as necessary to supply their services. Appropriate safeguards and contractual arrangements should be maintained where required.

External websites have their own privacy policies, which apply to their services.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes to Schoolio, its features, data processing practices, or applicable legislation.

The latest version will be published at https://schoolio.org.uk/ with an updated revision date.

Where required by law, we will provide appropriate notice of significant changes.

16. Contact

For privacy questions, data protection requests, or concerns about Schoolio's handling of personal information, please contact us through:

Schoolio
Website: https://schoolio.org.uk

If your account or device is managed by a school, you may also contact the relevant school or educational organisation.

We will handle privacy enquiries in accordance with applicable legal requirements.