Privacy Notice
Last updated: 10 October 2026 · Version 1.3
This notice explains how Belongio handles personal data. It has two parts:
- Part 1 covers how we handle data about people who contact us or visit our website. Here Belongio is the "data controller".
- Part 2 covers how the Belongio service handles school data when a school uses our platform. Here the school is the data controller and Belongio is the "processor", acting on the school's instructions.
Who we are
Belongio Ltd is a company registered in England and Wales (company number 17410716), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO), registration number ZC246324.
You can reach us about anything in this notice, including to exercise your data protection rights, at hello@belongio.co.uk.
Part 1: When you contact us or use our website
What we collect, and why
- When you contact us or work with us (for example by emailing us, or as a member of staff at a school we're talking to): your name, work email address, job role, the school or trust you're at, and the content of our correspondence. We use this to reply to you and to manage our relationship with your organisation. Our lawful basis is our legitimate interests in running and developing the business, where these don't override your rights.
- When you sign up on belongio.co.uk (to register interest in onboarding, ask for a demo, or receive our monthly update on our progress and on belonging and attendance): your name, job role, school or trust, work email address, which of those you ticked, and the date, page and any campaign link you came from. We use this to send you what you asked for and to contact you about a place in the onboarding queue or a demo. Our lawful basis is your consent, which you give by ticking the boxes and confirming your email address. You can withdraw it at any time using the unsubscribe link in any email or by emailing us, and we stop straight away.
- When you visit belongio.co.uk: our hosting provider keeps standard access logs (including IP addresses) to keep the site secure and working. We count visits with Umami, a privacy-friendly analytics service that sets no cookies and stores no personal data. We use no advertising or tracking cookies. See our Cookies notice for the detail.
Who we share it with
We use a small number of service providers who process this data only on our instructions: Spaceship/Spacemail (our email), Netlify (website hosting and the sign-up form), MailerLite (our mailing list, hosted in the EU) and Umami (cookieless website statistics). We do not sell your personal data and we do not use it for advertising.
Where your data is held
We aim to keep personal data in the UK or EU. Some providers are based in the United States (for example Netlify); where data reaches them it is protected by UK GDPR-compliant transfer terms (such as the International Data Transfer Agreement or standard contractual clauses).
How long we keep it
We keep contact and relationship data for as long as the relationship is active and for a reasonable period afterwards, then delete it. Mailing-list details are kept until you unsubscribe, or after three years without any contact from us, whichever is sooner; a record that you unsubscribed is kept so we do not email you again. We keep company and accounting records for the periods the law requires.
Your rights
You have the right to ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and to data portability. To exercise any of these, email hello@belongio.co.uk. You also have the right to complain to the ICO (ico.org.uk, helpline 0303 123 1113), though we'd appreciate the chance to help first.
Part 2: How the Belongio service handles school data
When a school uses Belongio, the school is the data controller, and it decides what pupil and staff data is used and why. Belongio is the processor, acting only on the school's documented instructions under a written Data Processing Agreement. Pupils, parents and staff should look to their school's own privacy information for the full picture of how the school uses their data; this part explains what the Belongio product itself does.
What the service processes
- About pupils: name, pupil identifier, year group and form group, gender; attendance marks and codes and lateness; behaviour points; support indicators such as Pupil Premium, SEN and English as an Additional Language; check-in responses (chosen from fixed options and, in the pilot, recorded by staff); and measures we calculate from these, such as attendance bands, streaks and the Belonging Index.
- About staff: name, school email address, and role; the secure identity used to sign in; and a record of actions taken in the system (such as check-ins and interventions).
Where it comes from
From the school's management information system (Arbor) through a secure data link (Wonde), and from staff signing in with their existing school Microsoft account.
Where it is stored and processed
Entirely in the UK. Both storage and processing take place in UK (London) data centres. We do not transfer school data outside the UK.
Who it is shared with
Only our sub-processors, who act solely on our instructions: Supabase (secure database and sign-in, UK) and Vercel (application hosting, UK). Data reaches Belongio from the school's management information system through Wonde, which the school engages directly as its own provider (Wonde is not a Belongio sub-processor). The full list of our sub-processors is set out in the Data Processing Agreement, and we notify the school before it changes. We never sell school data, never use it for advertising, and never use pupil data to train AI models. The product has no messaging between users.
How long it is kept
For as long as the school's contract runs. When it ends, we return and/or delete the school's data within 30 days, after which it clears from backups. While the service is running, we keep attendance and behaviour history only for the current and previous academic year.
How we keep it safe
Staff sign in with their school's own Microsoft accounts, protected by the school's multi-factor authentication; access is strictly role-based, so people see only what their role needs; each school's data is kept separate from every other school's; access to pupil-level data is logged; data is backed up regularly; and everything is hosted in the UK. We are working towards Cyber Essentials certification.
Rights for pupils, parents and staff
Because the school is the data controller, requests to see, correct or delete this data should be made to the school in the first instance. We support the school in responding to those requests.
Changes to this notice
We may update this notice from time to time. When we do, we'll change the "last updated" date at the top.
How to contact us
Email hello@belongio.co.uk. If you have a concern we can't resolve, you can contact the ICO at ico.org.uk or on 0303 123 1113.