School Partnership & Data Protection Statement
The Short Version
- A Morechard school partnership is purely promotional. The school helps parents discover Morechard; it does not gain any access to pupil data.
- Because no personal data is shared between the school and Morechard, a full Article 28 GDPR Data Processing Agreement does not strictly apply to this relationship — this statement explains why, and exactly what safeguards do apply.
- If a future arrangement ever changes this — for example, a school-facing dashboard or a class roll shared with us — a full Data Processing Agreement would then be required before that data sharing begins. A ready-to-execute template exists for that scenario; request it from [email protected].
1. What the partnership involves
In a Morechard school pilot, the school's role is limited to distribution and awareness — for example, sharing information about Morechard with parents via newsletter, notice board, or a class handout with a sign-up link or invite code. Parents who choose to use Morechard create their own account directly with Morechard; the school is not involved in that account, does not receive login credentials, and is not copied on any data collected.
2. What data flows to the school
None. Morechard does not provide the school with a dashboard, pupil-level reporting, aggregate usage statistics tied to the school, or any other visibility into which families have signed up or how they use the app. The school does not become a data controller or processor for any personal data processed by Morechard as a result of this partnership.
3. What data flows to Morechard from the school
Under a standard promotional partnership, Morechard does not request or require any pupil or parent personal data from the school — no class lists, no email addresses, no names. If a specific pilot design ever calls for the school to share any personal data with us (for example, to distribute personalised invite codes), that would be a materially different arrangement requiring its own Data Processing Agreement, agreed in writing before any data changes hands.
4. Why a full DPA isn't the right instrument here
Article 28 GDPR requires a Data Processing Agreement wherever one party (a controller) instructs another (a processor) to process personal data on their behalf. In a promotional-only partnership, that relationship doesn't exist: the school isn't instructing Morechard to process anything, and Morechard isn't processing anything for the school. Signing a DPA for a relationship where no data is exchanged would misdescribe the actual arrangement — we'd rather be precise about what is and isn't happening than provide a document that implies more oversight of data than actually applies.
5. Safeguards that do apply regardless
- Every family that signs up is bound by Morechard's own Privacy Policy and Terms of Use, which govern how their data is handled — independent of how they heard about the app.
- Child profiles remain nickname-only by design (see our Security Center), whether a family found Morechard through a school or any other channel.
- Morechard's DPIA and Safeguarding Statement apply to every user of the product, not conditionally on how they signed up.
6. If the relationship changes
Some pilots evolve to include a school-facing view, an integration, or a shared roll of participating pupils. If that happens, Morechard will not process any such data without a signed Article 28 Data Processing Agreement in place first, covering the specific categories of data, purpose, retention, and security measures for that arrangement. A standby template is ready — contact [email protected] to request it.