For schools, trusts and nurseries
Procurement pack
The answers your supplier form asks for, in one place: the data processing agreement, a data protection impact assessment you can adopt, the full list of our suppliers, where the data lives, how long we keep it, and who can see a safeguarding record.
1. Supplier details
The Forest School App is produced by The Code Guy Ltd. The Code Guy Ltd is the contracting party, holds the Cyber Essentials certification and is the organisation registered with the ICO. That is the name for your supplier field and for the agreement.
| Supplier | The Code Guy Ltd |
|---|---|
| Product | The Forest School App |
| Company number | 09407392 (registered in England and Wales) |
| Registered office | The Old Byre, 15 Redgates Lane, Sewards End, Saffron Walden, CB10 2LW |
| VAT number | GB 204 2159 52 |
| ICO registration | ZB286164 |
| Cyber Essentials | Certificate 2db8b10a-6085-42aa-8561-cd67537f51f1, scope: whole organisation. Certified 29 July 2026, recertification due 29 July 2027. Profile version 3.3 (Danzell), certified by Predatech, via IASME. |
| Data protection contact | dpo@thecodeguy.co.uk |
| General contact | hello@forestschool.app |
| Governing law | England and Wales |
2. Controller and processor
Your school is the controller of the children's and families' records it keeps in the app: profiles, consents, registers, observations, incidents, medication, session records and safeguarding concerns. We are your processor for all of it, and we act on your documented instructions. Those instructions are the data processing agreement.
We are the controller of your staff's account details and your billing information, because we decide how those are used to run and charge for the service. The privacy policy covers that half.
3. Sub-processors
Every supplier that processes personal data on your behalf, what they do, and where. We give account holders at least 30 days' notice before this list changes.
| Provider | What they do | Data involved | Where |
|---|---|---|---|
| Microsoft Azure | Hosting: the application, the database and the media store | All of it | UK South |
| Microsoft Azure AI Speech | Turning voice notes into text | The recording, which may name children. Nothing is kept once it has answered | UK South |
| Microsoft Application Insights | Error and performance monitoring for the application | Request URLs, error reports, server logs | Azure, EU/UK |
| Amazon Web Services (SES) | Sending service and notification emails | Recipient address, subject, message body | EU (Ireland) |
| Stripe | Subscription payments, and the checkout for your own booking payments | Billing contact, organisation name, amounts, payer email | UK / EU, with onward transfer safeguards |
| PostHog (EU Cloud) | Product analytics, cookieless | Page addresses with identifiers masked, counts, no names | EU |
Children's records are held by Microsoft Azure, which also turns voice notes into text if you switch that on, and are sent to Amazon SES only in the notification emails you choose to send a parent. The words come back as a draft that a member of staff checks before they are added to an observation. No other supplier here receives a child's name, date of birth, medical details or safeguarding record.
The app also connects to a few services that receive no personal data, such as a map and a weather forecast. The privacy policy names them. If your IT team needs the full list of addresses the app connects to, email dpo@thecodeguy.co.uk and we will send it.
4. Hosting, backup and restore
| Application | Azure App Service, UK South |
|---|---|
| Database | Managed document database on Microsoft Azure, UK South, reachable only over a private network address |
| Photos and documents | Azure Blob Storage, UK South, private. Three copies within the region |
| Encryption in transit | HTTPS only, TLS 1.2 minimum, HSTS for one year including subdomains |
| Encryption at rest | Azure platform encryption on the database and the media store |
| Database backup | Continuous point-in-time backup. Any moment in the last 35 days can be restored |
| Restore | Documented runbook. Photos and documents are restored separately from the database |
| Availability | We aim for 99.5% availability. That is a target we work to, not a contractual commitment, and we do not offer service credits |
5. Security
- Every read and write is filtered by the organisation's identity, so one organisation's data cannot be returned to another.
- Permissions are per organisation and per person: what a volunteer can open is not what a lead practitioner can open. Removing someone ends their access within five minutes on the web and on their next request from the field app.
- Photos, documents and PDFs are never served from a public address. Every one goes through the application, which checks the reader's permission first. A photo shown to a family is checked again against the current photo consent of every child named on it, and a photo of a child without consent is never shown to a family.
- An account locks after repeated failed sign-ins. Sign-in, password reset and code entry are rate limited.
- No route reaches a child's record without a sign-in, and that is checked automatically before and after every release.
The field app works with no signal, so it holds a copy of the children it needs for the day on the device. Signing out wipes that copy. On Android the app is excluded from Google's automatic backup, so the local store is never copied to a personal Google Drive. Device-level encryption is the device's own, so your mobile device policy is the control that matters there.
6. Safeguarding records
A safeguarding concern is not a note on the child's profile. It is a separate record in a separate place, and only a person the organisation has named as a Designated Safeguarding Lead can open it.
- The lead is named by you. DSL is not a job title in the app and it is not part of being an administrator. It is granted to a named person by the organisation's owner, and recorded when it is granted.
- An administrator does not see concerns. Owning the organisation's account, managing staff and paying the bill give no safeguarding access at all. Only the DSL grant does.
- Three separate checks. The page will not open, the request will not answer, and the store itself refuses the read unless the caller holds the DSL grant.
- Every read is logged. Who opened which concern, what they did and when, in a record that cannot be edited or deleted.
- Concerns never leave. They are not in the data export, not in a session record PDF, not in a parent email, and not synced to a phone belonging to anyone but the DSL.
This is the model your Keeping Children Safe in Education arrangements describe (2026 edition, in force 1 September 2026): the designated lead holds the safeguarding record, staff raise a concern to them, and access is recorded. Section 8 of the DPIA sets it out for your own record.
7. What we can see
We run the service, so a small number of named people at The Code Guy Ltd have operational access to it. What that access reaches is limited in the code.
- The operator view shows organisations, subscriptions, staff names and counts. It cannot return a child's record, an observation, an incident or a medical detail.
- Support sometimes needs to see what a member of staff sees. That is a time-boxed session, started with a written reason, and every page opened during it is recorded against the operator's name.
- Safeguarding concerns and the DSL grant are stripped from that session whoever the operator is signed in as. There is no support path to a safeguarding record.
- Access to the production database and the Azure subscription is reviewed quarterly, with the certificate and key rotations that go with it.
8. Payments
- Card details never reach our servers. Payment is taken on a page hosted by Stripe, so we are PCI DSS SAQ-A.
- Money families pay you for a place goes to your own Stripe account, connected to the app with Stripe's standard connection. We never hold your takings, and you keep the account if you leave.
- Your subscription to us is billed separately, by us, through Stripe.
- A booking payment carries the child's first name only, the payer's email, the amount and internal reference numbers.
9. Insurance
We hold business insurance including professional indemnity, public liability, employers' liability, and cyber and data cover. Ask hello@forestschool.app and we will send the certificates.
10. How long we keep it
Records are kept for as long as the organisation needs them, and then removed on the schedule below. You can delete a child's record at any time from the app without asking us.
| Record | Kept for |
|---|---|
| A child who has left the roster: profile, medical, contacts, consents, observations, photos, attendance, medication | One year after they leave, then scrubbed |
| Accident, incident and near-miss forms | Three years from the date of the form |
| Safeguarding concerns | Twenty five years. Excluded from routine erasure by design |
| Session records, registers, plans and risk-benefit assessments | While the organisation's account is open |
| Staff accounts and compliance records (DBS, first aid, qualifications) | While the person's link to the organisation is live, then on the same schedule |
| Your billing records | Six years, to meet tax and accounting duties |
| Database point-in-time backups | 35 days rolling. A deleted record is gone from backups once that window passes |
| Deleted photographs and documents | Recoverable for 30 days, then gone |
11. Leaving
- Export first. An owner can export the whole organisation, and any child's record on its own, as a file you keep.
- Close the account from your settings. You keep access until the end of the period you have paid for.
- We permanently delete the organisation's records within 30 days of closure, other than records the law requires either of us to keep for longer, such as safeguarding and accident records.
- Your Stripe account is yours and is unaffected. Disconnecting the app leaves it exactly as it was.
- Ask us at dpo@thecodeguy.co.uk for written confirmation that deletion has happened, and we will send it.
12. Data subject requests
A parent asking your school for their child's record is your request to answer, and the app answers it: an owner can export one child's whole record, and delete it, without contacting us. Where you need us, we will help, and we respond within one month. Send it to dpo@thecodeguy.co.uk.
13. Breaches
If we become aware of a personal data breach affecting your records we will tell you without undue delay, with what we know, what we have done, and what you may need to do, so that you can meet your own 72-hour duty to the ICO. Our own runbook is written down and is part of every release check.
14. Accessibility
Our accessibility statement covers how the app meets WCAG 2.2 and what we know is not there yet.
15. Documents
- Data processing agreement, UK GDPR Article 28, ready to sign.
- Data protection impact assessment, written for this product, ready to adopt as your own record.
- Privacy policy and Terms of service.
- Accessibility statement.
Anything else your form asks for, email dpo@thecodeguy.co.uk and we will answer it in writing.