Privacy Policy

Omnis Education Ltd ("Omnis", "we", "us") is the data controller for personal data collected through this website and the Omnis platform. We provide a learning and SEND intelligence platform to UK secondary schools.

Contact: privacy@omnis.education Registered in England and Wales.

We collect and process the following categories of personal data:

School staff (teachers, SENCO, SLT, administrators) - Name, email address, professional role - Activity within the platform (lesson plans, homework created, marks entered) - Login timestamps and audit events

Students - Name, year group, class, school email address - Homework submissions and grades - SEND status, ILP/EHCP/K Plan records (where applicable) - Revision session data and adaptive learning profile - Attendance data (where synced from MIS)

Parents and carers - Name, email address, relationship to student - Consent records, messaging thread content

Website visitors - IP address, browser type, pages visited (via server logs only — we do not use third-party analytics trackers without consent)

We rely on the following lawful bases under UK GDPR:

• Contract — to deliver the platform services agreed with your school under our Terms of Service
• Legitimate interests — platform security, fraud prevention, service improvement, and usage analytics that do not override individual rights
• Legal obligation — to comply with applicable UK law including the Data Protection Act 2018
• Consent — for optional features such as marketing communications and non-essential cookies (you may withdraw consent at any time)

For special category data (SEND information, educational needs), we rely on Article 9(2)(g) UK GDPR — substantial public interest — in conjunction with Schedule 1 of the DPA 2018 (education, training and employment purposes).

We use personal data to:

• Provide, operate, and improve the Omnis platform
• Authenticate users and maintain platform security
• Generate AI-powered lesson plans, homework, and SEND insights (processed via Anthropic Claude API — see section 6)
• Sync student and staff records from your school MIS via Wonde
• Send transactional emails (homework notifications, ILP review reminders, account activation)
• Maintain an audit trail of significant actions for GDPR and safeguarding compliance
• Detect early-warning patterns that may indicate a student needs support

We do not use student personal data for advertising or sell data to third parties.

We retain personal data for the following periods:

After the retention period, data is securely deleted or anonymised.

We share data with the following sub-processors, all subject to data processing agreements:

We do not transfer personal data to countries without an adequacy decision or appropriate safeguards unless stated above.

You have the following rights:

• Right of access — request a copy of the data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure — ask us to delete your data (subject to legal retention obligations)
• Right to restrict processing — ask us to pause processing in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Rights related to automated decision-making — we do not make solely automated decisions with legal or similarly significant effects

To exercise any right, email privacy@omnis.education. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Schools that use Omnis are independent data controllers for their students' personal data. Omnis acts as a data processor on behalf of the school under a Data Processing Agreement (DPA) included in our Terms of Service.

Schools are responsible for: - Obtaining appropriate consent or establishing lawful bases for processing student data - Ensuring students and parents are informed of how their data is used - Handling data subject requests from their own community - Ensuring staff use the platform in accordance with their own data protection policies

If you are a student, parent, or staff member with a data request relating to your school's use of Omnis, please contact your school's Data Protection Officer in the first instance.

We implement appropriate technical and organisational measures to protect personal data, including:

• All data encrypted in transit (TLS 1.2+) and at rest
• Role-based access control — users can only access data appropriate to their role
• All significant actions are audit-logged with timestamp and user identity
• JWT-based authentication with short-lived session tokens
• Regular security reviews and penetration testing (planned)

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO within 72 hours and affected schools without undue delay.

We use the following cookies:

We do not currently use analytics or advertising cookies. If we introduce non-essential cookies in future, we will request your consent first.

You can manage cookie preferences via the banner displayed on your first visit, or by clearing your browser cookies.

We may update this Privacy Policy from time to time. Material changes will be notified to school administrators by email at least 30 days before taking effect. The "last updated" date at the top of this page will always reflect the current version.

For any privacy-related query or to exercise your rights:

Email: privacy@omnis.education Post: Omnis Education Ltd, Data Protection, [Registered Address]

We aim to respond to all requests within 5 working days.