Everything your DPO, headteacher, and IT team need — in one place.
Spellcast is designed to be adopted by schools without friction. We've pre-completed the documentation your Data Protection Officer will ask for, so deals don't stall in a queue.
All documents on this page are ready to sign, adapt, or share. If you have questions or need a customised version of the DPA, email schools@spellcast.academy.
The legal agreement defining how Spellcast processes pupil data on your school's behalf. Required before adoption.
A completed DPIA for schools to review, countersign, and retain. Covers all processing activities, risk assessment, and mitigations.
How Spellcast protects children — leaderboard scoping, no child-to-child contact, teacher access controls, and account recovery.
Every domain your network filter needs to allow, with step-by-step instructions for Smoothwall, Lightspeed, Cisco Umbrella, and others.
| Data controller | Made Good Software — ICO registration number C1918648 |
| Data location | United Kingdom only (IONOS VPS) |
| Child email addresses collected | None — children log in with a username only |
| Sub-processors with child data | None — Google TTS receives word text only, no personal data |
| Cross-school visibility | None — leaderboards are class-scoped only |
| Child-to-child communication | None — no messaging, chat, or open content |
| Automated decision-making | None with legal or significant effect |
| Data breach notification | Within 48 hours to the school; ICO within 72 hours if required |
| Data export | Available at any time via teacher dashboard (JSON and CSV) |
| Account deletion | Immediate cascade deletion of all associated data |
Our full Privacy Policy — including child-friendly summary, school account section, and ICO complaint information — is at /privacy.
Ready to proceed? Email schools@spellcast.academy with your school name and we will aim to send a pre-signed DPA for countersignature within one working day.