Services Privacy Policy

This Notice should be read alongside our General Privacy Notice.

Our role in processing your data

SalamanderSoft Limited provides identity management, automation and reporting solutions for educational institutions. In most circumstances, the school, trust, college or educational organisation using our services is the Data Controller. They determine the purposes for which personal data is processed. SalamanderSoft acts as a Data Processor, processing personal data only on documented instructions from the Data Controller and in accordance with our contractual obligations.

Any questions relating to the use of personal data within your organisation should be directed to the appropriate Data Controller.

How do we collect information from you?

Information is supplied to SalamanderSoft by School Management Information Systems (MIS) and customer support interactions.

Examples of MIS’ include SIMS, Bromcom, Arbor, iSAMS, Veracross and other systems authorised by the Data Controller.

What type of information is collected from you?

The exact data required will depend on the data controller requirements.

Some of the data we may process:

• Personal information about pupils and adults currently active in the school: Forename, surname, gender, admission number, Registration Group, role etc.
• Personal information about pupils and adults who have now left the school: As above
• Personal information about pupils and adults who have not yet started at the school: As above
• Group, Class and Timetable information: Class names, subjects and codes, enrolment and teacher names etc.
• Photographs of Pupils and Staff: MIS photograph
• Attendance and Behaviour information

How long do we store your data?

All data gathered for the purpose of and pertaining to the support of our customers will be retained for as long as you are a customer with SalamanderSoft plus a further 2 years.

Any MIS data stored as part of the solutions delivery will be removed once the customer’s license expires.

How is your information used?

• Creation of User accounts as specified by the Data Controller (Microsoft 365, Google Workspace for Education, Active Directory, Apple School Manager etc.)

Who has access to your information?

Access to personal data is restricted to:

• Authorised employees of SalamanderSoft where necessary to deliver services or support
• Approved sub-processors acting on our behalf
• The Data Controller and their authorised users

We do not sell personal information or use customer data for marketing purposes.

Lawfulness of Processing

SalamanderSoft acts as a Data Processor and processes personal data on behalf of the Data Controller.

The Data Controller is responsible for identifying and documenting the appropriate lawful basis under Article 6 UK GDPR and, where applicable, Article 9 UK GDPR. Our processing is undertaken solely in accordance with contractual arrangements and documented customer instructions.

Special Categories of Data

Where the Data Controller has configured our services to display medical or health-related information, SalamanderSoft may process special category personal data. The lawful basis and special category condition for processing are determined by the Data Controller. SalamanderSoft processes such information solely on behalf of the Data Controller in accordance with contractual instructions.

Review of this Notice

We keep this Notice under review. It was last reviewed in July 2026.