For schools, trusts and nurseries
Procurement pack
The answers your supplier form asks for, in one place: the data processing agreement, a data protection impact assessment you can adopt, the full list of our suppliers, where the data lives, how long we keep it, and who can see a safeguarding record.
1. Supplier details
The Forest School App is produced by The Code Guy Ltd. The Code Guy Ltd is the contracting party, holds the Cyber Essentials certification and is the organisation registered with the ICO. That is the name for your supplier field and for the agreement.
| Supplier | The Code Guy Ltd |
|---|---|
| Product | The Forest School App |
| Company number | 09407392 (registered in England and Wales) |
| Registered office | The Old Byre, 15 Redgates Lane, Sewards End, Saffron Walden, CB10 2LW |
| VAT number | GB 204 2159 52 |
| ICO registration | ZB286164 |
| Cyber Essentials | Certificate 2db8b10a-6085-42aa-8561-cd67537f51f1, scope: whole organisation. Certified 29 July 2026, recertification due 29 July 2027. Profile version 3.3 (Danzell), certified by Predatech, via IASME. |
| Data protection contact | dpo@thecodeguy.co.uk |
| General contact | hello@forestschool.app |
| Governing law | England and Wales |
2. Controller and processor
Your school is the controller of the children's and families' records it keeps in the app: profiles, consents, registers, observations, incidents, medication, session records and safeguarding concerns. We are your processor for all of it, and we act on your documented instructions. Those instructions are the data processing agreement.
We are the controller of your staff's account details and your billing information, because we decide how those are used to run and charge for the service. The privacy policy covers that half.
3. Sub-processors
Every supplier that can touch data in the service, what they do, and where. We tell account holders before this list changes.
| Provider | What they do | Data involved | Where |
|---|---|---|---|
| Microsoft Azure | Hosting: the application, the database and the media store | All of it | UK South |
| Microsoft Application Insights | Error and performance monitoring for the application | Request URLs, error reports, server logs | Azure, EU/UK |
| Amazon Web Services (SES) | Sending service and notification emails | Recipient address, subject, message body | EU (Ireland) |
| Stripe | Subscription payments, and the checkout for your own booking payments | Billing contact, organisation name, amounts, payer email | UK / EU, with onward transfer safeguards |
| PostHog (EU Cloud) | Product analytics, cookieless | Page addresses with identifiers masked, counts, no names | EU |
| Google Analytics | Website analytics on the public marketing pages only | Public page views, after the visitor accepts the cookie banner | EU/US, Standard Contractual Clauses |
| Ahrefs Analytics | Website analytics on the public marketing pages only, cookieless | Public page addresses | EU |
| Norwegian Meteorological Institute (Met.no) | The weather forecast on a session | Woodland site coordinates, to four decimal places, and a date | Norway (UK adequacy) |
| postcodes.io | Turning a site postcode into coordinates | The site postcode | United Kingdom |
| OpenStreetMap | Map tiles behind the woodland site map | Map tile coordinates for the site | EU |
| unpkg (Cloudflare) | Serving the map library to the browser | The viewer's IP address and browser, no record data | Global content network |
| YouTube (no-cookie mode) and Vimeo | Playing a video someone has embedded in a shared activity idea | The viewer's IP address and browser, no record data | EU/US, Standard Contractual Clauses |
Children's records are held by Microsoft Azure and are sent to Amazon SES only in the notification emails you choose to send a parent. No other provider on this list receives a child's name, date of birth, medical details or safeguarding record.
4. Hosting, backup and restore
| Application | Azure App Service, UK South |
|---|---|
| Database | Managed document database on Microsoft Azure, UK South, reachable only over a private network address |
| Photos and documents | Azure Blob Storage, UK South, private container with anonymous access disabled. Three copies within the region |
| Both halves recoverable | The database restores to any moment in the last 35 days, and a deleted photograph or document is recoverable for 30 days. Nothing a school keeps here is one accident away from being gone |
| Encryption in transit | HTTPS only, TLS 1.2 minimum, HSTS for one year including subdomains |
| Encryption at rest | Azure platform encryption on the database and the media store |
| Database backup | Continuous point-in-time backup. Any moment in the last 35 days can be restored |
| Restore | Documented runbook: restore to a new cluster, bring the database across, restart, spot-check. Media files are restored from the media store separately |
| Availability | We aim for 99.5% availability. That is a target we work to, not a contractual commitment, and we do not offer service credits |
5. Security
- Every read and write carries the organisation's identity and is filtered by it in one place in the code, so one organisation's data cannot be returned to another.
- Permissions are per organisation and per person: what a volunteer can open is not what a lead practitioner can open. Removing someone ends their access within five minutes on the web and on their next request from the field app.
- Photos, documents and PDFs are never served from a public address. Every one goes through the application, which checks the reader's permission and the child's photo consent first.
- Passwords are at least ten characters and an account locks for fifteen minutes after ten failed attempts. Login, password reset and code entry are rate limited.
- Uploads are checked by their file contents, not their file name.
- Every route that answers without a sign-in is listed in a reviewed file, and the build fails if a new one appears. After every deployment an unauthenticated probe runs against the live site and checks that nothing carrying a child's data answers.
The field app works with no signal, which means it holds a copy of the children it needs for the day on the device. Signing out wipes that copy. On Android the app is excluded from Google's automatic backup, so the local store is never copied to a personal Google Drive. Device-level encryption is the device's own, so your mobile device policy is the control that matters there.
6. Safeguarding records
A safeguarding concern is not a note on the child's profile. It is a separate record in a separate place, and only a person the organisation has named as a Designated Safeguarding Lead can open it.
- The lead is named by you. DSL is not a job title in the app and it is not part of being an administrator. It is granted to a named person by the organisation's owner, and recorded when it is granted.
- An administrator does not see concerns. Owning the organisation's account, managing staff and paying the bill give no safeguarding access at all. Only the DSL grant does.
- Three separate checks. The page will not open, the endpoint will not answer, and the storage layer itself refuses the read unless the caller holds the DSL grant. Any one of them failing closed is enough.
- Every read is logged. Who opened which concern, what they did and when, in an insert-only record that nothing in the app can edit or delete.
- Concerns never leave. They are not in the data export, not in a session record PDF, not in a parent email, and not synced to a phone belonging to anyone but the DSL.
This is the model your Keeping Children Safe in Education arrangements describe (2026 edition, in force 1 September 2026): the designated lead holds the safeguarding record, staff raise a concern to them, and access is recorded. Section 8 of the DPIA sets it out for your own record.
7. What we can see
We run the service, so a small number of named people at The Code Guy Ltd have operational access to it. What that access reaches is limited in the code, not by policy alone.
- The operator view shows organisations, subscriptions, staff names and counts. It cannot return a child's record, an observation, an incident or a medical detail, because the code behind it has no method that returns one.
- Support sometimes needs to see what a member of staff sees. That is a time-boxed session, started with a written reason, and every page opened during it is recorded against the operator's name.
- Safeguarding concerns and the DSL grant are stripped from that session whoever the operator is signed in as. There is no support path to a safeguarding record.
- Access to the production database and the Azure subscription is reviewed quarterly, with the certificate and key rotations that go with it.
8. Payments
- Card details never reach our servers. Payment is taken on a page hosted by Stripe, so we are PCI DSS SAQ-A.
- Money families pay you for a place goes to your own Stripe account, connected to the app with Stripe's standard connection. We never hold your takings, and you keep the account if you leave.
- Your subscription to us is billed separately, by us, through Stripe.
- A booking payment carries the child's first name only, the payer's email, the amount and internal reference numbers.
9. Insurance
We hold business insurance including professional indemnity, public liability, employers' liability, and cyber and data cover. Ask hello@forestschool.app and we will send the certificates.
10. How long we keep it
Records are kept for as long as the organisation needs them, and then removed on the schedule below. You can delete a child's record at any time from the app without asking us.
| Record | Kept for |
|---|---|
| A child who has left the roster: profile, medical, contacts, consents, observations, photos, attendance, medication | One year after they leave, then scrubbed |
| Accident, incident and near-miss forms | Three years from the date of the form |
| Safeguarding concerns | Twenty five years. Excluded from routine erasure by design |
| Session records, registers, plans and risk-benefit assessments | While the organisation's account is open |
| Staff accounts and compliance records (DBS, first aid, qualifications) | While the person's link to the organisation is live, then on the same schedule |
| Your billing records | Six years, to meet tax and accounting duties |
| Database point-in-time backups | 35 days rolling. A deleted record is gone from backups once that window passes |
| Deleted photographs and documents | Recoverable for 30 days, then gone |
11. Leaving
- Export first. An owner can export the whole organisation, and any child's record on its own, as a file you keep.
- Close the account from your settings. You keep access until the end of the period you have paid for.
- We permanently delete the organisation's records within 30 days of closure, other than records the law requires either of us to keep for longer, such as safeguarding and accident records.
- Your Stripe account is yours and is unaffected. Disconnecting the app leaves it exactly as it was.
- Ask us at dpo@thecodeguy.co.uk for written confirmation that deletion has happened, and we will send it.
12. Data subject requests
A parent asking your school for their child's record is your request to answer, and the app answers it: an owner can export one child's whole record, and delete it, without contacting us. Where you need us, we will help, and we respond within one month. Send it to dpo@thecodeguy.co.uk.
13. Breaches
If we become aware of a personal data breach affecting your records we will tell you without undue delay, with what we know, what we have done, and what you may need to do, so that you can meet your own 72-hour duty to the ICO. Our own runbook is written down and is part of every release check.
14. Accessibility
Our accessibility statement covers how the app meets WCAG 2.2 and what we know is not there yet.
15. Documents
- Data processing agreement, UK GDPR Article 28, ready to sign.
- Data protection impact assessment, written for this product, ready to adopt as your own record.
- Privacy policy and Terms of service.
- Accessibility statement.
Anything else your form asks for, email dpo@thecodeguy.co.uk and we will answer it in writing.