This notice explains how College of Human and Business Efficiency Ltd ("we", "ANAX") processes personal data when a school or academy trust uses ANAX Schools: the AI tool governance assessment, and the signed-in register that a school or trust uses to keep its record of AI tools, decisions, actions and reviews. It is written from the way the system is actually built. The signed-in register is provided to an organisation when it is set up on the service; the parts of this notice that describe it apply from then.
1. Who we are
ANAX Schools is operated by College of Human and Business Efficiency Ltd, a company registered in England and Wales (company number 13201707), registered office 1-2 Rhodium Point, Hawkinge Business Park, Spindle Close, Hawkinge, Folkestone, Kent CT18 7TQ. Data protection contact: contact@viccaone.com. We are registered with the Information Commission (ICO) under registration reference ZC286412 (registered 27 October 2026; the current registration runs to 26 October 2027). We have not appointed a statutory Data Protection Officer: our assessment is that one is not required. The contact above is our nominated data-protection contact and handles every data-protection matter. Administrative access to our hosting, database, authentication and deployment accounts is limited to the operator.
2. What the service does, and who is the controller
Your school or trust receives an engagement code; a member of staff uses it to answer questions about one AI tool and how your school governs it; the answers are assessed against a published assessment pack and recorded as a Decision Passport that anyone holding its reference can verify at verify.anaxstandard.ai. On the register, your organisation's administrators and members keep the list of AI tools and intended uses, record the school's own decision on each result, track the actions that follow, and set review dates; a trust sees its schools together.
Our roles, as the service is designed: your school or trust is the controller, and we are its processor, for the governance records it keeps on the register and for any personal data in its assessment answers (sections 4 and 5), under the Data Processing Agreement. We are an independent controller only where we process personal data for our own purposes: administering our customers' accounts and contracts (including order, billing and contract records), corresponding with and supporting the people we deal with, keeping the service secure and protecting it against misuse and fraud, administering the service, meeting our legal and regulatory obligations, and keeping the public Passport register (sections 3 and 6). We send no marketing email. On this allocation the sign-in accounts and memberships that give people access sit with our own processing (section 3). If the allocation changes, we will update this notice and the Data Processing Agreement and tell our customers.
3. Running the service for your organisation (we are the controller)
| Data | Why we process it | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| The name and work email address of your organisation's contact for an engagement or an account. Held in our mailbox; the assessment system itself stores no email address. | To issue your code, set up your organisation, correspond with you, release your result and support you | Article 6(1)(b): the contract with your organisation, or steps taken at your request before one. Where your organisation is a public authority, our legitimate interest in administering the engagement (Article 6(1)(f)) |
| Your sign-in account. When you sign in to the register, our authentication provider (Supabase Auth) holds your email address, and our email delivery provider (Brevo) delivers your one-time sign-in link from ANAX Schools <no-reply@auth.anaxstandard.ai>; ANAX never sees or stores a password. Your memberships and every governance record store only the account identifier the provider issues for you — an opaque code, not your name or email address. If you were invited, signing in with the invited address opens your sign-in account. | So that you can sign in without a password, so that access is limited to the people your organisation invited, and so that we can show which account issued or accepted each invitation | Article 6(1)(b) where you are the person our customer asked us to give access to; otherwise Article 6(1)(f): our legitimate interest in securing access to our customers' records |
| Your membership. Which organisation your account belongs to, in which role (trust administrator, school administrator or school member), when it was created, and if your organisation removed your access, when. When you join by invitation, we also record which versions of the terms you accepted and when. | To give you exactly the access your organisation authorised, and to show your organisation who holds access and when; to evidence acceptance of the terms | Article 6(1)(b) / (f) as above |
| Invitations. When an administrator invites someone, we store the organisation, the role, a one-way hash of the link (never the link itself), when it expires, and when it was accepted or cancelled. An invitation is sent to the invitee's work email address: we keep that address with the invitation only while it can still be accepted, so that we can email it and only that address can accept it; afterwards a one-way hash of it stays with the invitation record. | To let an organisation add people safely, once, in the right role, and only the person invited | Article 6(1)(b) / (f) as above |
| Governance notifications. To send the people who govern your organisation's AI tools the service's emails — an invitation, a result ready for a decision, a review or an action that is due or overdue, a reported change that needs a review or a new assessment, and a weekly summary for a trust's administrators — we keep the email address you signed in with, as our sign-in provider confirmed it, separately from every governance record, while you belong to an organisation or have an invitation waiting, and we keep a record of which notification was sent, about which record, when, and to which account identifier. The emails name the organisation, the AI tool and the dates, link to the signed-in page, and contain no assessment answers, results, intended-use text or notes. School members receive no reminders. | To tell the right people, at the right time, what their organisation's governance needs | Article 6(1)(b) where you are the person our customer asked us to give access to; otherwise Article 6(1)(f): our legitimate interest in providing the service our customer ordered |
| The role (not the name) of the person who completed an assessment or recorded a decision | So that the Passport and the register record who, by role, attested or decided | Article 6(1)(b) / (f) as above |
| Your IP address and request details, briefly | To protect the service from abuse (your address is counted for 10 minutes for rate limiting, today in the memory of our servers) and to operate the service (our hosting providers' request logs) | Article 6(1)(f): our legitimate interest in the security of our network and information systems |
| Support, access and security correspondence | To answer you, to deal with access requests, security reports and incidents | Article 6(1)(b) / (f) as above |
| Order, billing and contract records: the order form, invoices, and the name and role of the person who accepts the terms for your organisation | To make and administer our contract and to keep the records the law requires us to keep | Article 6(1)(b): the contract with your organisation; and Article 6(1)(c): our legal obligations to keep accounting and tax records |
| The public Decision Passport register. A released Passport's institutional record — your school's name, the tool, the pack edition, the outcome, the conditions and the dates — and the role (not the name) that attested | To keep issued attestations verifiable by anyone given a Passport's reference, and to show a Passport withdrawn after release as withdrawn | Article 6(1)(f): our legitimate interest in the integrity of issued attestations |
Emails we send. The sign-in link, invitation and access messages, security notices and messages about your organisation's use of the service are service messages: they are sent because you use the service and contain no marketing. We do not send marketing email to the people who use the service. If that ever changes, a marketing email will say clearly that it comes from us, and every one will carry a simple, free way to stop receiving them that does not require signing in; we will keep a list of the people who have asked not to be contacted and respect it.
Where we rely on legitimate interests you have the right to object (section 9). We do not collect pupil data of any kind, we store no passwords, we take no payment card data, and the public pages set no cookies; the register sets two strictly necessary cookies described on the cookies page. We collect no special category data and we ask for none. All the personal data we hold comes from your organisation or from you; none is obtained from other sources.
4. Your organisation's governance records (we are the processor)
The register holds, for each organisation: its AI tools and intended uses; the decisions recorded on them (the decision, the role that recorded it, the date, an optional note); the actions that follow (what needs doing, the owning role, the due date, how it was closed, and every change of owner or date); and the review dates set. These are your organisation's institutional records. By design they name people by role only, and every place where text can be typed says: do not enter pupil names, pupil records, safeguarding case details, health or SEND information, or any other personal information. If personal data is nonetheless typed into a free-text field, we process it only on your organisation's instructions under the Data Processing Agreement, and we remove or correct it as instructed (section 8). The same applies to the answers your school submits in an assessment, which are your school's institutional records.
5. Decisions, and automated decision-making
The decision about an AI tool is your school's, recorded by a person your organisation authorised: approved, approved with conditions, review required, or not approved. The software never records a decision on its own. The assessment outcome is produced by a published assessment pack applied by software, and every run is held for human review before it is released to your school; it concerns your school's governance of a tool, it is not a decision about any individual, and it has no legal or similarly significant effect on any person. We do not profile individuals and we make no automated decision with legal or similarly significant effect about anyone.
6. Who receives data, and where it is processed
- Fly.io hosts the assessment service and the register (London) and our governance engine (Amsterdam, Netherlands). Fly.io's corporate systems are in the United States. Our sub-processor register shows the status of our agreement with Fly.io.
- Supabase hosts our database (and its daily backups) on Amazon Web Services in the region we selected for our project, Ireland (eu-west-1), including the register's records, memberships and invitation hashes, and provides the sign-in service (Supabase Auth) that holds the email addresses of the people who sign in. Supabase's data processing addendum forms part of its terms; it describes limited processing outside the selected region (for example for support and operations), under the transfer safeguards in that addendum.
- Brevo delivers the sign-in emails and the service's governance notification emails (invitations, reminders, decisions needed, weekly trust summaries), from ANAX Schools <no-reply@auth.anaxstandard.ai>. It receives the address an email is sent to and the email itself. Brevo's data processing agreement forms part of its terms of service, and Brevo states that it hosts and stores data in the European Union (France, Germany and Belgium). We use it only for service emails, not for marketing.
- No model provider. Since 3 November 2026 our governance engine is deterministic and calls no artificial-intelligence or large-language-model service, so no model provider receives any data from ANAX Schools. Assessments run before that date used an earlier version of the engine whose advisory step sent Anthropic (Anthropic Ireland, Limited; API operated in the United States) your school's name, the framework identifier and summary scores — never your answers, free text, contact details or pupil data. The register has never used a model provider.
- Vercel hosts our public website and the verification page, on its Pro plan, under Vercel's data processing addendum. It sees request details including your IP address; it holds no assessment or register data.
- Google (Google Workspace) provides our mailbox for contact@viccaone.com and our business administration. Google offers its Cloud Data Processing Addendum through the Workspace terms; we have not yet confirmed that its acceptance is recorded in our Workspace Admin console, and our sub-processor register shows that status until we have. The Passport verification page loads its typefaces from Google Fonts, so your browser sends your IP address to Google when that page loads.
Our full sub-processor register lists each provider with its location, safeguard and any open item. Within your own organisation, your administrators can see the register's records, who holds access and the role each person holds; a trust's administrators can see the same for every school in the trust. No other customer can see your organisation's records.
7. International transfers
Our database is in Ireland, our services run in the United Kingdom and our engine in the Netherlands; sign-in emails are handled by Brevo in the European Union. Ireland, the Netherlands and the other EEA countries concerned are covered by the UK's adequacy regulations. We do not claim that all data stays in one country or region: some providers process data in the United States (Vercel, Google, and provider support and operations access), and Supabase describes limited processing outside our selected region. Our sub-processor register records, for each provider, the safeguard that its published terms describe (standard contractual clauses with the UK Addendum, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified) and shows the status of our own agreement with each provider, including any agreement that is not yet in place.
8. How long we keep data
- Engagement, account and support correspondence (mailbox): routine correspondence is kept for no more than 12 months after the engagement closes (for a support or access matter, after that matter closes) and is deleted by hand at the quarterly review that falls on or before that date. Contractual records, and correspondence relating to a documented legal claim, are kept for as long as that is justified, up to six years, subject to legal requirements.
- Submitted answers: kept while the Passport they support is valid (12 months); drafts never submitted: kept for 90 days after the last save. Each then falls due for deletion and is deleted by hand at the next quarterly review (the first in January 2027), or sooner on request. Deletion is carried out by the operator under a written procedure; it is not automatic. We confirm each deletion in writing.
- Register records (tools, decisions, actions, reviews): for the life of your organisation's contract, as your organisation's record; nothing in them is overwritten. At the end of the contract they are returned on request and deleted by hand under the Data Processing Agreement.
- Sign-in accounts, memberships and invitations: while the person holds access; the address an invitation was sent to: until it is accepted, cancelled or expires (7 days); a removed membership is kept as a revoked record for the life of the contract so that your organisation can see who held access and when; the sign-in account at the provider is deleted by hand on removal or at the end of the contract. Invitations expire after 7 days.
- Decision Passports: kept for the validity period and afterwards as an archived record so historic attestations remain verifiable; a Passport withdrawn after release stays on the record and the verification page shows it as withdrawn. A Passport holds institutional information, not information about individuals.
- IP addresses used for rate limiting: 10 minutes. Fly.io's searchable request logs: 7 days. Vercel's runtime request logs: one day (our Pro plan's retention).
- Sign-in emails: Brevo keeps the delivery logs of the sign-in emails sent for our account for one month, and does not keep a copy of the emails' content. The same applies to the governance notification emails.
- Notification contact addresses: while you belong to an organisation or have an invitation waiting, then deleted automatically. The record of which notification was sent (never its content): 90 days.
- Database backups: Supabase keeps daily backups of the database for 7 days on our Pro plan. Deleting or redacting a record removes it from the live database at once; earlier copies stay in those backups until they rotate out, and we do not restore from a backup except to recover the service.
If pupil data, safeguarding detail or other personal data is entered into a record by mistake, tell us with the subject PUPIL DATA: we restrict who can see it, escalate internally, ask your organisation what it wants done, and delete or correct the record as instructed. Text in a free-text field is removed by a governed procedure that only the operator can run: the text is replaced with a fixed marker, and we record which record and field were redacted, when and why, never the text itself. Where the text has reached a public Decision Passport, the Passport cannot be edited in place; it is withdrawn and the tool reassessed instead. Full detail: our data retention page.
9. Your rights
You have the rights to access your personal data and to have it rectified, and, where they apply, the rights to erasure, to restriction, to object (including to any processing based on our legitimate interests) and to data portability, under the UK GDPR as amended by the Data (Use and Access) Act 2025. We respond without undue delay and normally within one calendar month. The law allows that period to be extended where a request is complex or one of several, and lets us pause it while we ask you to clarify what you are asking for; we tell you if either applies. We carry out a reasonable and proportionate search. Write to contact@viccaone.com. For the governance records your organisation keeps on the register, and for your school's assessment answers, your organisation is the controller: we will pass your request to it and help it respond. If a free-text answer or note contains personal data that should not be there, tell us and we will remove it.
10. Security and access logging
The controls in force are on our security page. On the register, every page and every change is authorised on our server against your membership before any record is read or written; a request for another organisation's record is refused without disclosing whether it exists. Our hosting provider's request logs record requests (including IP addresses) for 7 days; our application does not log answers, codes, notes or email addresses. The register keeps, as part of your organisation's record, which role recorded each decision and when each action changed; it does not keep a separate log of who viewed what.
11. Complaints
You can complain to us at contact@viccaone.com. We will acknowledge your complaint within 30 days, investigate it, keep you informed and tell you the outcome. You can also complain to the Information Commission (ICO) at ico.org.uk or on 0303 123 1113.
12. Changes
We will publish any change to this notice on this page with a new version number and effective date.
Version history: 0.1 (11 October 2026) drafted; 0.2 (11 October 2026) reconciled to measured facts; 0.3 (12 October 2026) publication candidate with counsel items marked; 0.4 (12 October 2026) site version; 0.5 (26 October 2026) the signed-in register — accounts, memberships, invitations, governance records, the decision model, access logging, the pupil-data procedure and the controller/processor allocation marked for legal decision. 0.6 (1 November 2026) provider and product facts reconciled: ICO registration ZC286412 and no statutory DPO; our own-purpose processing listed by activity; Brevo for sign-in emails; Supabase region and backups (7 days, Pro); Vercel Pro and one-day logs; service emails and no marketing; rights timing; redaction of mistaken personal data; Passport withdrawal for public fields. 1.0 (3 November 2026) — in force: no model provider since the deterministic engine of 3 November 2026 (Anthropic for earlier runs only); lawful bases stated for the public Passport register and for order, billing and contract records; the Google addendum's status stated plainly; Brevo's log period to be stated before the first sign-in email; the controller/processor allocation stated as our position. 1.1 (4 November 2026) — Brevo's delivery-log period stated: one month, with no copy of the emails' content kept. 1.2 (4 November 2026) — governance notification emails through Brevo, the sign-in address kept for them, and invitations sent to a named address (which opens the invitee's sign-in account).