School documents · Pack 2026-08-29
Who is controller and who is processor
UK GDPR roles for pupil data, staff accounts, and the public website.
- Who it is for
- DPOs
- How to access it
- Public. Attach to the school DPIA.
This pack describes how Five Wells Education designs and operates the platform so schools can complete their own due diligence. It is not legal advice. The school remains the data controller for pupil and staff data it places in the product. A solicitor or DPO should review processing before go-live.
School data in the product
For names, emails, classes, credits, SEND records, parent links, and similar school-held information, the school (or MAT) is the data controller. Five Wells Education is a processor acting on the school’s instructions.
- The school decides which pupils are enrolled, which optional modules are on (SEND Tracker, Wonde, AI planner, photo memories), and when accounts are removed.
- Five Wells provides the software, hosting, and support. It does not decide the school’s lawful basis, retention beyond tenancy, or what is published on a classroom signage screen.
Website and sales enquiries
For people who contact Five Wells through the public enquiry form without being a school user, Five Wells is the controller of that enquiry. Do not put pupil names in an enquiry form.
Parents and pupils using the app
Parent and pupil accounts exist because the school created or invited them. The school remains controller. Five Wells processes those logins as processor.
Related: All school documents · Roster field inventory