Data Processing
Our roles as processor and controller, lawful bases, and how long we keep your data.
Our Data Protection Roles
| Role | When | What this means |
|---|---|---|
| Processor | School uses Vinspired for Schools and instructs us to process pupil data | The school decides what data is collected and why. We follow their instructions. A Data Processing Agreement (DPA) governs this relationship. |
| Controller | Individuals use Vinspired directly (volunteers, charity admins, corporate users), student-initiated volunteering, portable credentials | Vinspired decides what data is collected and why. This Privacy Policy is the transparency notice. |
Lawful Bases for Processing
| Activity | Lawful Basis | Notes |
|---|---|---|
| School-instructed processing | School's public task (Art. 6(1)(e)) | The school determines the basis |
| Student-initiated volunteering | Consent (Art. 6(1)(a)) | Pupil or parent for under-13s |
| Portable digital credentials | Consent (Art. 6(1)(a)) | Retained until age 30 or consent withdrawn |
| Individual volunteer (18+) | Consent (Art. 6(1)(a)) | Given when creating an account |
| Non-profit admin accounts | Contract (Art. 6(1)(b)) | Necessary to perform the service |
| Corporate ESG/CSR programme | Contract (Art. 6(1)(b)) | Necessary to deliver contracted service |
| Corporate employee data | Legitimate interests (Art. 6(1)(f)) | LIA conducted |
| Website analytics | Legitimate interests (Art. 6(1)(f)) | Security and functionality |
Retention Periods
| Data Category | Retention | Deletion Trigger |
|---|---|---|
| School data (processor) | Duration of agreement + 12 months | End of agreement or school instruction |
| Student portable credentials | Until age 30 or consent withdrawn | Age threshold or withdrawal |
| Individual volunteer accounts | Duration + 12 months inactivity | Deletion or inactivity |
| Non-profit admin accounts | Duration + 90 days | End of agreement |
| Corporate partner accounts | Duration + 90 days | End of agreement |
| Website logs | 12 months | Rolling deletion |
| Data backups | 90 days rolling | Automatic overwrite |
Have a question about this?
Contact our Data Protection Lead at [email protected]