Last updated: 21 September 2026
Your school is the data controller for the personal data on this platform; JAM IT & Design Ltd is your processor. UK GDPR Article 28 requires us to name every sub-processor we in turn engage, and to keep you informed of any change – this page is that register, and the one place we'll update it. Each engagement is covered by our own data processing terms with that provider.
| Sub-processor | What they do | What they receive | Location & safeguard |
|---|---|---|---|
| Wonde | Syncs pupil and staff records from your school's MIS. | Pupil name, date of birth, year group; staff name and email. | UK. UK-hosted |
| Microsoft | Single sign-on, only where your school has enabled it. | Staff identity/email via OAuth – never a password. | EU/US. Microsoft's own Data Protection Addendum (SCCs). |
| Single sign-on, only where your school has enabled it. | Staff identity/email via OAuth – never a password. | EU/US. Google's own Data Processing Addendum (SCCs). | |
| Krystal.io | Application hosting and storage for photo files and school logos. | Photo files, watermark/school logo uploads, and the platform itself. | UK. UK-hosted |
| Brevo | Sends the platform's transactional email – sign-in one-time codes, consent requests, and notifications. | Recipient email address and name, and the content of the message itself (which includes sign-in codes). Never a photo or a password. | EU (France). Brevo's own Data Processing Addendum. |
| Zoho Books | Invoicing for the school's subscription. | School billing contact name, email, phone, and invoice line items – never individual parents. | EU. Zoho's Data Processing Addendum (SCCs). |
| Cloudflare | Bot protection (Turnstile) on our public contact and sign-up forms. | IP address and form-interaction signals – no photo or pupil data. | Global network. Cloudflare's Data Processing Addendum (SCCs). |
| Expo | Delivers push notifications to the mobile app, where enabled. | Device push token only. | US. Expo's Data Processing Addendum (SCCs). |
| Stripe | Takes payment for a print order, where your school has print ordering enabled. | Card and billing details – sent directly to Stripe by the parent's browser, never reaching our own servers. | UK/EU. Stripe's own Data Processing Addendum (SCCs). |
| Prodigi | Prints and posts a print order, where print ordering is used. | Recipient name, delivery address, and the photo file being printed. | UK primary print network; SCCs cover any order routed to an overseas print partner. |
Our public marketing website sets optional Google Analytics and Google Ads measurement cookies, with the visitor's consent. Neither is listed above, deliberately: this register covers sub-processors that receive your school's data, and both of those run only on these public marketing pages – never in the parent or staff portals, and never anywhere a pupil photograph is shown. The platform's own content security policy enforces that boundary rather than leaving it to good intentions. Google sees nothing belonging to your school.
To be plain about what the advertising one is: we advertise ourselves on search engines, and it tells us which of our own adverts led somebody to sign up. We show no advertising anywhere on this website, in the portals or in the app, we run no advertising personalisation or remarketing, and we build no audience lists. How both work, and how to refuse either, is in our Privacy Policy.
If we add or replace a sub-processor, we'll update this page and, for any change that materially affects how your school's data is handled, tell your school directly rather than relying on you to notice a page change.
See our Data Protection Impact Assessment summary and our safeguarding & security assurance statement for how we've assessed the risk of this processing, or contact dataprotection@theschoolgallery.co.uk for a copy of our data processing agreement.