# Data protection, answered for your DPO

Where plan text is processed, who can see it, who decides, and what has to be in place before a real plan is used.

## Who decides

Sendix reads and drafts; staff decide; only the council can amend an EHCP. The school, trust or council is the data controller for pupil data; Sendix is the processor and acts on its instructions.

## In place now

- Hosted and processed in the UK: the app, its database and backups run in Azure UK South; the AI model runs on Amazon Bedrock in AWS London, which keeps no inputs or outputs for the model Sendix uses.
- Plan text stays with school staff: only the school's SENCOs and SEND leads and its trust's SEND lead can see it. Sendix administrators cannot, through the application.
- Identifiers minimised, not anonymised: the pupil's name, UPNs, NHS numbers, postcodes and dates are removed before an AI model sees the text. Other names can remain.
- Deleted on the organisation's schedule: a daily job (running since 3 October 2026) deletes records when the retention period ends, and from backups within 35 days. It is not a zero-retention service.
- On the organisation's instructions, under a DPA: Sendix processes pupils' plans only on the school's, trust's or council's instructions, under a data processing agreement (DPA) the organisation signs in the Sendix app and Sendix countersigns. In Scotland, the DPA and the impact assessment cover Child's Plans.
- Only what staff upload: Sendix does not connect to a school's MIS or to SEEMiS; it holds only the plans staff choose to upload.
- ICO registration ZC264381; data processing agreement version 1.0 approved; data protection impact assessment v0.3, with Sendix's sections approved on 9 October 2026; the school's DPO completes the school's sections.

## What your DPO will ask

- **Where is plan text processed, and by whom?** In the UK: Azure UK South for the app, database and backups; extracts of minimised text (not whole plans) go to an AI model on Amazon Bedrock in AWS London, which keeps no inputs or outputs for that model and does not use them for training. The DPA lists the sub-processors (Microsoft Azure, AWS Bedrock and AWS SES, all processing in the UK). Suppliers may give support from outside the UK under their own terms. The website is hosted in West Europe and never handles pupil data.
- **Who at Sendix can see plan text?** No one, through the application. Only the school's SENCOs and SEND leads and its trust's SEND lead can. Multi-factor authentication is mandatory for those accounts.
- **On what terms do you process our pupils' plans?** Only on the organisation's instructions, under a DPA it signs in the Sendix app and Sendix countersigns. Real plans can be uploaded only by an organisation with a countersigned DPA. Staff upload plans as they are: Sendix removes the pupil's name, UPNs, NHS numbers, postcodes and dates before the text is stored. The walkthrough and, in England, the free check use fictional plans.
- **What do parents see?** Nothing goes to families from Sendix. It is a tool for school staff: its emails go to staff, and its drafts and exports go to the staff who use them. In England any change to an EHCP goes through the council, which consults the family; in Scotland Child's Plans and IEP targets are agreed with the child and family.
- **Why so few pilot places?** Sendix adds organisations carefully, a few at a time, so each gets close support. Staff check every finding during the pilot, and Sendix reports how many were right.
- **What happens to our data after the pilot?** At the end of the contract the organisation chooses return, deletion or both; Sendix does it within 30 days and confirms deletion in writing, unless the law requires otherwise. Deleted records leave the encrypted backups (in UK South) within 35 days.

## Talk it through with your DPO

- Book a 30-minute walkthrough with Marcus Kamuntu, founder, on a fictional plan (no pupil data, on the call or before it): https://cal.com/sendix/30min
- Questions: privacy@sendix.ai. Please do not send pupil information by email.
- Privacy notice: https://sendix.ai/privacy
- Terms of service: https://sendix.ai/terms