Trust and data protection

All data for this service is stored in one region: United Kingdom. These services process it for Enrichmark, each only to provide its service:

• Vercel: hosts the application, in United Kingdom
• Supabase: hosts the database, in United Kingdom
• An email delivery provider sends the survey links, and in regions that send texts a text message provider does too

• Students' contact details (names, email addresses, phone numbers) are deleted thirty days after a trip's last set of questions closes, automatically.
• Students' answers are kept under a code, never a name, and deleted three years after a trip's last set of questions closes. The trip's report stays; the answers behind it do not.
• A school that leaves takes everything with it: its trips, students' answers, reports and the accounts that belong to it alone are deleted on the day it closes.

• Every table in the database has row-level security: each school's staff reach their own school's data and nothing else. An operator reaches how its trips were delivered, and outcomes pooled across schools that choose to share.
• Figures for any group of fewer than ten students are held back by the database itself, so no report can show them.
• Staff sign in with Google, Microsoft, a password or a code sent by email. The platform's owners must use an authenticator app as a second step, and anyone else can.
• Sign-in and the student survey are rate limited.
• Every dependency is pinned to an exact version and updated through pull requests that run the full test suite.
• No page a student opens loads anything from a third party: no tracking, no analytics, no outside fonts or scripts.

Some questions let a student write freely. What they write is shown only to the school's staff, never to an operator, and stays marked unread until a named member of staff marks it read. It shows without the student's code, so it cannot be put beside a name on the class list. Safeguarding is the school's own process; Enrichmark's part is to show the text to the right people and no one else.

What is collected?

From the class list, whichever of these the school includes: each student's first name and family name; the student's own email address or their own mobile number; a parent or guardian's email address or a parent or guardian's mobile number; whether the student is travelling or in the comparison group that stays behind; and sex, used only to show change by sex and held back for any small group. The names, addresses and numbers are used for survey links, reminders, consent requests to parents and, when a student asks, a copy of their own answers, and are deleted as above. From each student: answers to 21 questions on a four-point scale, plus ratings of how the trip was run and any words they choose to write, held under a code.

Is special category data collected?

No. Ethnicity, health, additional needs and disadvantage are not asked for.

How is consent handled for children?

Each region sets a default route: the school confirms consent itself, or each guardian is sent a link to agree or decline. The page for parents and students describes the route and how to say no.

Where is data stored, and does it leave the region?

In United Kingdom. Survey links, reminders and consent requests leave it as emails and texts through the delivery providers above. A student who asks for a copy of their answers is sent it by email, to their own address. Reports are never sent by email or text: the school's staff open them by signing in.

Who can see what?

The school's own staff see its reports and students' written comments. An operator sees how its trips were delivered, and outcomes pooled across schools that choose to share. No one sees a figure for fewer than ten students.

Can a student or parent withdraw?

Yes, at any time, through the school. Withdrawing removes the student's contact details at once.

The accessibility statement says how the service is built to be usable by everyone and where it falls short. The company's details are on the about page.