Keeping it safe
Designed so there's nothing personal to lose
Pupil Outlook works from group totals, not pupil records. Here's how that works.
Group totals onlyPupil lists are turned into totals on your own computer and then discarded.
Names are refusedFiles with names, UPNs, dates of birth or addresses aren't read at all.
Small groups hiddenAny group under 5 pupils is left out, so no one can be picked out.
Paperwork before real dataA data protection impact assessment and data-sharing agreement come before any school uses real pupil data.
Where the information goes
There are three places information can be. None of them holds pupil names or records.
| Where | What is kept | Who can see it |
|---|---|---|
| The demo on this website | Whatever you type, saved in your own browser only (local storage). Nothing is sent to us. Clear your browser's data for this site to remove it. | Only you, on that device |
| The pilot tool | Group totals for a year group and its groups (for example the attendance of eFSM pupils), planning settings, forecasts and the decisions your team records. Groups under 5 pupils are hidden. | The people your school invites, each signing in with their own account |
| The pilot and interest form | Your name, work email, role, school and message, stored in a database in Upstash's London (UK) region, and emailed to the Pupil Outlook team. | The people who run Pupil Outlook, after signing in |
What happens to a pupil list
If your data lead uploads a report from your MIS instead of typing totals, this is what happens to it.
- 1
The file is checked
Files with columns for names, UPNs, dates of birth or addresses are refused before anything is read.
- 2
It becomes totals on your computer
The rows are counted into group totals, such as attendance for eFSM pupils or pupils with ALN, inside your browser.
- 3
Small groups are hidden
Any group of fewer than 5 pupils is left out. So is its partner group (for example non-eFSM pupils when eFSM pupils are under 5), so the small group can't be worked out by subtraction.
- 4
Only totals are kept
The pupil rows are discarded. Only the group totals are saved.
For your data protection officer
During the pilot, schools use test figures or anonymised group totals only. Before any school uses real pupil data, we complete the paperwork with you.
- A data protection impact assessment (DPIA). Our Word template is already filled in with how Pupil Outlook works: a one-page summary, a diagram of how information flows, the seven DPIA steps, a risk register with suggested ratings, sign-off and a checklist for before real figures are used. Your school completes the shaded boxes.
- A data processing agreement. In the hosted school version we expect your school to be the data controller and ReviseBites to act as processor; the agreement will set this out.
- A privacy notice for the tool, separate from the website privacy notice.
Download the DPIA template (Word, .docx)Ask a data questionFor IT teams
The template is a starting point, not legal advice. Your school's data protection officer decides whether it is complete.
How the website is protected
- Encrypted connections (HTTPS) on every page
- A strict security policy that stops the site loading code from elsewhere
- No advertising, tracking or analytics cookies
- The admin area needs a sign-in, with limits on repeated attempts
Questions about data?
Email hello@pupiloutlook.com, or read the questions leaders usually ask.