Data protection pack for academies

Contents

1. The short version
2. Who we are
3. Who is responsible for what
4. What data moves, and why we're allowed to
5. How onboarding works, step by step
6. Where the data lives and who else touches it
7. How long we keep things
8. How we protect it
9. Children, rights requests, complaints and breaches
10. Academy Data Processing Agreement
11. Template: notice to parents before migration
12. Template: guardian consent & medical information
13. Parent FAQ
14. Checklists and sign-off

1. The short version

Your academy already holds personal data about every pupil and parent — names, dates of birth, phone numbers, emergency contacts, medical notes, photo permissions. Today that lives in spreadsheets, paper forms and WhatsApp. Moving it onto Thwok does not change who is responsible for it: you remain the data controller, and Thwok becomes your data processor, acting only on your instructions under a written agreement (Section 10). That is exactly the same legal relationship you would have with a payroll provider or a hosted email service.

UK GDPR does not require you to collect fresh consent from every parent to move their data to a new supplier. What it does require is that the move is lawful, transparent, secure and minimal. This pack shows how each of those is met.

2. Who we are

3. Who is responsible for what

Data protection law has three roles. A controller decides why and how personal data is used. A processor acts on a controller's documented instructions. Where two organisations decide together, they are joint controllers. The table below is the role map for every activity that touches academy data. It is deliberately explicit because ambiguity here is the first thing a regulator looks for.

4. What data moves, and why we're allowed to

Only what is needed to run the academy on Thwok moves. The import template has exactly these columns and rejects anything else. Each row below states the lawful basis you rely on as controller, which is also the basis on which Thwok processes as your processor.

What we ask you not to send

Free-text notes about a child or family, safeguarding case notes, previous incident reports, religion, ethnicity, benefits status, school names, or photographs. None of these are needed to onboard, and the import will reject unrecognised columns. If a medical note contains more than a coach needs to know on court, shorten it. You can always add detail later inside the platform, where it is encrypted and access-logged.

Why fresh consent is not the basis

Consent is the wrong basis for most of this data. A parent cannot meaningfully "refuse" to give their child's name to the academy that coaches them, and consent that can't be refused isn't valid consent. The coaching contract already justifies the core data; the migration is simply the academy choosing a new tool to perform that contract. What parents are entitled to is transparency — being told clearly, in advance, what is changing — which is what the Section 11 notice provides. Explicit consent is used only where the law requires it: medical information (special category data) and images of children.

Children's data and the Children's Code

Under UK law a child can consent to online services from age 13, but Thwok is designed so that this never has to be tested. Children under 13 do not have Thwok accounts at all: the pupil is a record held by a guardian, and it is the guardian who holds the account, accepts the terms and controls every setting. Pupils aged 13–17 may be given a limited account by their guardian, provisioned and controlled by the guardian, with no public profile, no messaging with strangers, and no location features. Because the service is nevertheless likely to be used by children, Thwok applies the ICO Children's Code: privacy settings default to the highest level, no nudge techniques, no profiling for advertising, no geolocation, and children never appear in search results, share cards, leaderboards or public event pages.

5. How onboarding works, step by step

The migration is designed so that the parent, not the academy or Thwok, is the one who activates their child's record. Until they do, the record is dormant, invisible and time-limited.

1. Agreement signed. You sign the Data Processing Agreement (Section 10). Nothing is uploaded before this.
2. Parents told. You send the Section 11 notice to all current families at least 7 days before upload, through whatever channel you normally use. Keep a copy and the date — that is your transparency evidence.
3. Staff brought over. Your coaches come across the same way and at the same time, on their own template: name, mobile, email, role and DBS expiry date. They are adults, so there is no guardian step — each coach gets their own invitation, sets up their own passwordless login, and sees only the sessions you assign them. Send us the DBS expiry date, never the certificate.
4. Register exported. You fill the import template (CSV or Google Sheet; we supply it). One row per pupil. The template validates dates, phone formats and rejects unknown columns before you upload.
5. Secure upload. You upload through a one-time, expiring link in your Thwok academy dashboard — never by email or WhatsApp. The file goes straight to an encrypted, access-restricted bucket in the London region. The raw file is deleted automatically within 24 hours of processing.
6. Pending records created. Each row becomes a pending pupil record linked to a hashed version of the guardian's phone number. Pending records are not searchable, not visible to coaches beyond name and group, and not linked to any Thwok account.
7. Invitations sent in your name. Each guardian receives one message — email and/or SMS, in the academy's name — saying that Flying Shuttles has moved to Thwok and inviting them to claim their child's place. The message states where their number came from, links to the Privacy Notice, and offers a one-tap "this isn't me / remove my details" route that works without an account. This is a service message about an existing relationship, not marketing.
8. Guardian claims the record. The guardian verifies their phone by one-time code, reviews the child's details, corrects anything wrong, confirms or updates medical notes and photo permission (Section 12), and accepts Thwok's Guardian Terms and Privacy Notice with an unticked checkbox. The consent record stores the document versions, timestamp and method. Only now does a Thwok account exist.
9. Reminders, bounded. Unclaimed invitations get at most two reminders (day 7 and day 21). Anyone who taps "remove my details" is suppressed immediately and permanently for that academy.
10. Unclaimed records deleted. Any record not claimed within 60 days is permanently deleted, and you receive a list of the pupil names (no other data) so you can follow up offline if you want to.
11. Confirmation to you. You receive an import report: rows received, records claimed, records removed at the parent's request, records deleted as unclaimed. That report is your Article 30 record for the migration.

6. Where the data lives and who else touches it

Thwok is built on Google Cloud (Firebase) in the London region (europe-west2). Academy data is stored, backed up and processed in the UK. The following sub-processors are engaged under written contracts that impose the same obligations Thwok owes you. You will be given 30 days' notice of any addition, with the right to object.

International transfers: where a sub-processor processes personal data outside the UK, Thwok relies on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment on file, as required following the ICO's 2026 transfer guidance and the Data (Use and Access) Act 2025 "data protection test". The current list is maintained at thwok.app/legal/sub-processors.

What never happens

• No data is sold, rented or shared with advertisers or data brokers.
• No analytics SDK receives a child's name, date of birth or medical data. Product analytics are event-level and pseudonymised.
• No child's data is used to train any machine-learning model, ours or anyone else's.
• No academy's data is visible to another academy, club or venue.

7. How long we keep things

8. How we protect it

Independent assurance: Thwok is an early-stage company and does not yet hold its own ISO 27001 or Cyber Essentials certification. Its infrastructure providers (Google Cloud, Stripe) are ISO 27001 and SOC 2 certified. Thwok intends to obtain Cyber Essentials within 12 months of the date of this pack and will notify academies when achieved.

9. Children, rights requests, complaints and breaches

Rights requests from parents (and older pupils)

Parents can exercise every UK GDPR right about their child's data — access, rectification, erasure, restriction, portability and objection. A pupil aged 13 or over may also exercise rights in their own name where they have the maturity to understand them; Thwok will involve the guardian unless doing so would be against the child's interests. You are responsible for responding as controller; Thwok is responsible for making that easy:

• Most requests need no request at all: guardians can view, correct, export and delete their child's data from their own account.
• A request that arrives at Thwok about academy data is forwarded to your nominated contact within 2 working days, and we do not respond on your behalf unless you ask us to.
• Where you need help — a full export, a search across attendance history, deletion with a legal-hold exception — we provide it within 5 working days so you can meet the statutory one-month deadline. Since 5 February 2026 you may pause that clock while waiting for identity confirmation or clarification from the requester, and you need only carry out a reasonable and proportionate search.

Complaints

Since 19 June 2026 every controller must have a way for people to complain about how their data is handled, acknowledge within 30 days and respond without undue delay. Thwok operates such a route for its own controller activities at privacy@thwok.app and, on request, provides academies with a simple complaints log template. Anyone unhappy with the outcome may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

If something goes wrong: breach procedure

1. Detect and contain. Access revoked, credentials rotated, affected systems isolated. Target: within 4 hours of detection.
2. Assess. What data, whose, how many, likely consequences. Children's or medical data automatically counts as "likely to result in a risk", so assume notification is needed.
3. Tell you. Written notification to your nominated contact within 24 hours of confirming a breach affecting your data, with what we know, what we've done and what we recommend — followed by updates as the picture develops. This is well inside the "without undue delay" the law requires of a processor.
4. Support your ICO decision. As controller you decide whether to notify the ICO (72 hours from becoming aware) and affected parents. We give you the facts and draft wording; we do not notify parents about academy data without your instruction.
5. Learn. Written post-incident review shared with you within 14 days.

Legitimate interests assessment — emergency contacts

Emergency contacts are third parties who have not signed anything. Holding their name and phone number is justified by the legitimate interest in a child's safety during a session: the purpose is real and specific; the data is the minimum needed (name, number, relationship); the contact would reasonably expect it, having been nominated by the parent for exactly this; the impact is minimal, as the number is used only in an emergency, never for messaging or marketing, and is deleted with the pupil record. The balance favours processing. The guardian is asked to confirm the person is aware they have been nominated.

Data Protection Impact Assessment — summary

A full DPIA is held by Thwok and available to academies on request. Its conclusions for the academy product are:

10. Academy Data Processing Agreement

This Agreement forms part of, and is incorporated into, the Thwok Academy Agreement between the parties. It sets out the terms required by Article 28(3) UK GDPR. Defined terms have the meanings given in UK GDPR. To be reviewed by the parties' legal advisers before signature.

11. Template: notice to parents before migration

Send this to every current family at least 7 days before the import, by whatever channel you normally use. Edit the amber parts; keep the substance. The final paragraph is the line to add to your own privacy notice.

12. Template: guardian consent & medical information

This is the screen a guardian completes when claiming a record (and the paper equivalent for anyone who prefers it). Each consent is separate, unticked, specific and withdrawable — which is what makes it valid. Thwok records the version, timestamp and method for each.

13. Parent FAQ

14. Checklists and sign-off

Acknowledgement

By signing below the Academy confirms it has received and reviewed this Data Protection Pack, version 1.0, and that its contents form the basis on which it instructs Thwok to migrate and process its pupil and guardian data.