How schools should use this pack

Publish the standard pack. Do not rely on email as the source of truth.

UK schools need a stable URL they can drop into a DPIA, governor paper, or MAT central record. If the only copy lives in someone’s inbox, the version will drift and staff will share outdated PDFs.

The documents in this pack are therefore published on the Five Wells website. Anyone with the link can read them. They contain no pupil data and no school-specific prices.

• Share https://www.fivewellseducation.com/legal (or your live site’s /legal page) with your DPO.
• Print or “Save as PDF” from the browser when governors want a paper copy. The on-screen version is always the current one.
• Do not treat an emailed attachment as canonical unless it is a countersigned contract for that school.

What is public

• Privacy notice, parent notice template, child-friendly pupil notice, data processing terms, DPIA support pack, sub-processors, security measures, retention, AI processing, pupil Well helper, staff AI use, images and pupil work, wellbeing pulse and nominations, SEND Tracker data note, subject-access playbook, exit and portability, safeguarding product note, cookies, breach process, and accessibility statement.
• Roster field inventory (CSV and Wonde) — already accepted in-product before first bulk import or MIS connect.

What is not public

• School-specific licence quotes and prices (generated per school from the operator console, then sent to the SBM or attached to a purchase order).
• A signed data processing agreement with your school’s legal name, if you execute a paper or e-sign copy.
• Your completed DPIA. That is the school’s document. Use this pack as an appendix; do not upload pupil examples to Five Wells support.
• Any export, screenshot, or log that contains pupil or staff personal data.

When to use email

Email is for introductions, purchase orders, and countersigned paperwork — not for hosting the living policy pack.

• Onboarding: send the /legal link plus, if needed, the school’s quote PDF.
• Contract: email or e-sign the DPA once with the school’s name. The public DPA is the standard terms; the signed copy is the school-specific record.
• Incidents: use the in-app Support control when signed in, or the contact route on the privacy page. Do not email spreadsheets of pupil data unless Five Wells has asked for a specific, minimised sample over an agreed channel.

Where staff find the pack after go-live

• Public website: /legal (no login).
• School administrator dashboard: School settings → Trust pack (same links, so SENCOs and SBMs do not hunt through email).
• Existing bookmarks to /privacy and /docs/roster-data-notice remain valid.