Everything your DPO and safeguarding lead ask for
PawSteps is used by children, so protecting them and their data is not a feature — it is the foundation. This page sets out our safeguarding and data-protection commitments in plain English, before you have to ask.
Ten things we promise every school and council
Clear, checkable commitments. Where a certification is still being worked towards, we say so honestly rather than imply it is already in place.
Pre-signed Data Processing Agreement Available now
A ready-to-sign DPA built on ICO-standard clauses, aligned to UK GDPR and the Data Protection Act 2018. Your DPO reviews it, you counter-sign — no lengthy legal back-and-forth required.
DPIA template, mostly pre-completed Available now
A Data Protection Impact Assessment with the processing, retention and risk sections already filled in. Your DPO adds local context only, so a full assessment takes minutes, not weeks.
A named safeguarding lead In place
A single, named Designated Safeguarding Lead is accountable for PawSteps safeguarding. Our policy is mapped to Keeping Children Safe in Education (KCSIE) and shared with you on request.
Human moderation under 15 minutes Live
Anything a child can share or see in a community space is reviewed by a trained human — not an algorithm alone — with a target first-response time of under 15 minutes, seven days a week.
UK data residency Live
Pupil and school data is stored and processed in UK data centres across all environments. No child data leaves the UK as part of normal operation.
Cyber Essentials Plus In progress
We already follow Cyber Essentials controls and are working towards independent Cyber Essentials Plus certification. We will publish the certificate here the moment it is awarded — we won't claim it before then.
Your data exports in open formats Live
Portfolios, progress data and session notes export as CSV and PDF at any time, free, forever. No proprietary lock-in and no charge for leaving.
Human review of every community feature Live
Any messaging, sharing or pen-pal style feature is off by default, opt-in per school, and every item passes through human moderation with school-level controls.
Data minimisation by design Live
We collect the least data needed to run the service. No behavioural advertising, no selling of data, ever — pupil data is used only to deliver learning to that pupil.
WCAG 2.2 AA accessibility Working toward
We build to WCAG 2.2 AA and are completing an independent audit. Known gaps and our remediation plan are shared openly with SEND and accessibility leads on request.
Available on request
Email us and we will send the current, versioned pack the same working day.
Where we stand — honestly
Green means it is in place today. Amber means we are actively working towards it and have not yet been awarded it.
Buy via framework call-off when listings complete, or via direct invoice / BACS today. MAT and local-authority master agreements available.
Your data walks out the door with you 🚪
Every record — portfolios, progress data, session notes and evidence — exports in open formats (CSV, PDF) at any time, free of charge, for as long as you have an account. Leaving should be easy; staying should be earned.
We do not hold your data hostage and we do not charge exit fees. If we ever wind the service down, you get advance notice and a full export window before anything is deleted.
Clear routes when something goes wrong
Any suspected personal-data breach is triaged immediately, and we commit to notifying affected schools without undue delay and within statutory timeframes. Safeguarding concerns are escalated to the named safeguarding lead and, where required, to the relevant authorities.
One named contact handles both data-protection and safeguarding enquiries, so you are never bounced between inboxes.
Data-protection or safeguarding question?
Send it straight to the person accountable for both. We answer DPO, DSL, bursar and procurement enquiries within two working days — usually much faster.