Who does Sparx share data with: Sub-processors?

We carefully select, audit and approve support companies to help us provide a service to you

We conduct due diligence to ensure that they will keep your data safe and we have binding written UK GDPR-compliant data processing contracts with each of our support companies. It is Sparx's responsibility to ensure our sub-processors comply with data privacy legislation. To aid transparency, our Support Companies page lists the companies that help us, what types of data we share with them (student, teacher, parent), what service they provide and a copy of our data handling agreement plus each company’s security information.

You don't need to check all of our sub-processors

• As a controller, your obligations under GDPR are to check that you are happy that Sparx is taking all necessary technical and operational measures to keep your data safe and that we have a process for evaluating our sub-processors.
• In our Terms and Conditions > Section C: Data handling agreement > Sub-processors, it states: “We will remain liable to you for all the acts and omissions of our support companies in respect of their processing activities for us as if they were our own.”

As per the ICO guidance > When do I need to carry out a Transfer Risk Assessment?:

“If you are a controller, and your processor is making the restricted transfer, only the processor (Sparx) must complete the Transfer Risk Assessment (TRA). In that situation, you (the school/trust) must still carry out reasonable and proportionate checks about whether the processor’s restricted transfers are compliant with UK GDPR, including its obligation to carry out a TRA. This is part of your obligation to ensure your processor provides you with “sufficient guarantees” in Art 28 UK GDPR.” 

It is Sparx responsibility to carry out the due diligence on our support companies. To evidence this and aid transparency, we cite the data processing contracts and security information of our sub-processors on our support companies page should you wish to view them.

We don't share any of your data with third parties

As per our Terms and Conditions > Section C: Data handling agreement > Sub-processors: “Save for our support companies, we will never share school data with third parties without your prior written permission.” This means we will never share your data with another controller, or sell or monitise personal school data you have shared with us.

No student data goes outside the European Economic Area

Sparx direct data centres including back-ups are within the EEA. As per our Terms and Conditions > Section C: Data handling agreement > Sub-processors: “No personal data derived from school data relating to students is transferred outside the European Economic Area.” Teacher and parent names and emails are shared with support companies based in the USA. See our article on International data transfers.