School documents · Pack 2026-08-29

Subject access and deletion playbook

What school staff should do when a parent or pupil asks what Five Wells holds, or asks for erasure.

Who it is for: DPOs, office staff, SENCOs
How to access it: Public process note. The school is the controller and decides the SAR response. Five Wells will not fulfil a parent SAR by email without the school’s instruction.

This pack describes how Five Wells Education designs and operates the platform so schools can complete their own due diligence. It is not legal advice. The school remains the data controller for pupil and staff data it places in the product. A solicitor or DPO should review processing before go-live.

Access (SAR)

Confirm the requester’s identity using the school’s usual process.
School administrator: use Data export for roster, credits, certificates, and related school-scoped CSVs.
For SEND Tracker, Journey photos, pulse, or nominations, use the in-product pupil/staff views and export or print what the module provides. Do not screenshot another child’s record.
If a file cannot be retrieved in-app, contact Five Wells via in-app Support with the school name and the pupil’s internal id — not a full class list.

Rectification

Correct names, class, and flags in Five Wells (or re-sync from Wonde) as you would in the MIS. Credits are append-only; mistaken awards should be undone with the in-product Undo or a compensating entry, not a silent rewrite of history.

Erasure

The school decides whether erasure applies (public task often means some records are kept). Where you do delete: remove the pupil account through staff admin tools, delete Journey photos/Photo Memories you no longer have a basis to keep, and export first if you still need a local copy under school policy.

Timescales

UK GDPR SAR deadlines sit with the school (usually one month). Five Wells support is for technical retrieval, not for legal advice on exemptions.

All school documents ·