UK GDPR Compliance Statement
UK GDPR Compliance
Reference to “Application” within this statement means any software application, platform or digital service made available by us, including Connect, Summit (the group platform) and Ascent
Alps UK GDPR Compliance Statement for Schools and Colleges
Alps was developed to support schools and colleges, and groups of schools to drive improvement through good use of data. Protecting the sensitive data schools and colleges choose to send to us is a top priority.
At Alps we updated our systems and terms and conditions in line with the UK GDPR to ensure that we could carry on supporting schools, colleges and Groups.
Our data protection compliance is continuous and is regularly reviewed. We will keep you informed of any updates to our data protection documents or systems, if the Government guidance on how to apply the UK GDPR, which is regularly reviewed, or case law requires us to change these further.
In the following paragraphs “you” means school or college or other educational body to who we provide analytical services and “Alps” or “we” means Alps.
Alps’ services under UK GDPR
The UK GDPR and the Data Protection Act 2018 make a distinction between “data controllers” and “data processors”. Alps will act as a “data processor” in carrying out our services that have been requested by You. You will be the “data controller” as you decide whether to send us data, what data to send us and instruct Alps as to what we will do with it. Our terms and conditions reflect this.
There may be limited circumstances in which Alps act as a data controller, including where we determine the purposes and means of processing personal data in connection with account creation and management, monitoring and analysis of use of the Services, service improvement and AI Improvement Purposes, and the training, testing, validation and improvement of AI Features used solely in connection with the Services.
Alps Terms and Conditions – the UK GDPR Data Processing Agreement
As a data controller you are required under the UK GDPR to have a written contract with us, as a data processor, which fulfils certain requirements set out in the UK GDPR.
Our Terms and Conditions reflect these requirements and also serve as a UK GDPR data processing agreement. The necessary elements that are covered include:
- Alps will only use your data in accordance with your documented instructions;
- Confidentiality;
- Data security;
- Assisting the controller with any exercise by individuals of their rights under UK GDPR; and
- Returning or deleting data at the end of the services.
These provisions are mainly included in the Data Processing Schedule.
Each school and college will need to agree to our terms and conditions in order for us to process their data, and for us to provide our products and services to them.
How do Alps’ services work under UK GDPR?
We are a ‘data processor’ for the purposes of the UK GDPR whilst conducting activity such as the preparation of reports or analysis on behalf of a school, college or Group where passing on information to other bodies (e.g. Local Authority or DfE) when requested by a school or college.
The school, college or Group using our services will be the ‘data controller’ because it decides whether and when to send any information to Alps and what we should do with it.
Please see our Privacy Policy which sets out how we deal with data collected to enable us to provide our services and expands on some of the statements set out here.
How is information provided to us by schools or colleges stored?
Secure storage of data is a fundamental requirement under Data Protection Laws, including the UK GDPR. We process data provided by You using both our own systems and trusted third-party infrastructure providers.
We implement robust technical and organisational security measures designed to protect personal data against unauthorised or unlawful processing, loss, destruction or damage. These measures are supported by our ISO27001 accreditation.
Alps stores all data within the UK and the European Economic Area (EEA) and ensures that data is encrypted in transit using industry standard encryption protocols.
Where a school or college is based outside of the UK but within the EEA, the transfer of pupil data to Alps may be an “international data transfer” for the purposes of the UK GDPR.
The UK government has recognised the EEA as providing an adequate level of protection for personal data, and the European Commission has similarly adopted an adequacy decision in respect of the UK. As a result, personal data can be transferred between the UK and EEA without the need for additional safeguards such as standard contractual clauses.
How long will we keep information provided to us by schools and colleges?
The UK GDPR requires information to be kept and used for no longer than is needed for the purpose for which it was received in the first place. We will deal with information sent to us by schools and colleges in this way:
Analysis from personal data as provided by you will be deleted automatically after 8 years. Our online service will keep a record of your analysis for 8 years and our analysis tables show four year trends;
Personal data will be deleted within 28 days of a confirmed request for deletion from the school or college;
Personal data will be deleted within 28 days if a school or college does not confirm a contract renewal within one year and six months of the start of the academic year, which shall be deemed to be 1 September each year;
Anonymised or de-identified data will be held for 6 academic years and automatically deleted afterwards.
Information shared with third parties
We will only share your data with third parties (such as your local authority or other body acting on your behalf) where we have your instruction to do so, or where such sharing is required in order to provide the Services, as set out in Our terms and conditions.
There are circumstances in which we share statistics with third parties such as the DfE or local authorities for data analysis purposes. In these circumstances all data is properly anonymised and therefore does not constitute personal data for the purposes of Data Protection Laws.
Similarly, our Directories of Curriculum Excellence are also prepared using anonymised statistics and do not contain personal data.
Local Authorities
If you are part of a LA/Group contract, we will require you to explicitly agree as part of the upload process to authorise Alps to facilitate the sharing of your data with the local authority or group. Our terms and conditions set out how each party (the school/college, Alps and the LA/Group) should use the data that is shared, in accordance with the UK GDPR.
You will need to ensure that the appropriate staff members within your organisation are set up as Alps Application Administrators who can authorise the sharing of data as part of your instruction on upload to us, if required.
Alps will also send an email to a specified contact of your choice which will confirm what data use and data sharing has been requested by you.
Alps Connect has an area available which list what data use and data sharing has been requested by you, which can be amended at any time, to give you control of this.
Directories of Curricular Excellence (“Directory”)
We provide Directories of Curricular Excellence for the Regional Department for Education (DfE) Directors and groups of schools and colleges across the DfE regions in England. Schools and colleges who are included in these Directories also receive a copy of the Directory for their region.
The purpose of the Directory is to enable the sharing of best practice. Data is only included in accordance with agreed criteria, and only for high performing providers and subject areas. The data included does not identify individual students.
Directories of Curricular Excellence are prepared using anonymised aggregated data, and do not contain personal data.
Although the data does not constitute personal data, we will still ask for your agreement to be included in a Directory. When you instruct us to process reports or analysis for you, you will have the option of unticking a box that permits your data to be included in a Directory.
Your data will only be included in a Directory if you have agreed for this use by not unticking the box and if a Directory for your region is commissioned by the relevant DfE and school/college bodies. Not all regions will have a commissioned Directory. You can opt out and chose not to be included nor receive a copy of the Directory simply by unticking the relevant box on the Data area of the relevant Alps Application.
We will keep you informed on the updates that we are making. If you have any queries in the meantime please contact us on 01484 887 600 or email us at [email protected] or visit our website at www.alps.education
July 2026