Last updated: 4 September 2026
Your school is the data controller for the personal data on this platform; JAM IT & Design Ltd is your processor. UK GDPR Article 28 requires us to name every sub-processor we in turn engage, and to keep you informed of any change — this page is that register, and the one place we'll update it. Each engagement is covered by our own data processing terms with that provider.
| Sub-processor | What they do | What they receive | Location & safeguard |
|---|---|---|---|
| Wonde | Syncs pupil and staff records from your school's MIS. | Pupil name, date of birth, year group; staff name and email. | UK. UK-hosted |
| Microsoft | Single sign-on, only where your school has enabled it. | Staff identity/email via OAuth — never a password. | EU/US. Microsoft's own Data Protection Addendum (SCCs). |
| Single sign-on, only where your school has enabled it. | Staff identity/email via OAuth — never a password. | EU/US. Google's own Data Processing Addendum (SCCs). | |
| Krystal.io | Application hosting and storage for photo files and school logos. | Photo files, watermark/school logo uploads, and the platform itself. | UK. UK-hosted |
| Zoho Books | Invoicing for the school's subscription. | School billing contact name, email, phone, and invoice line items — never individual parents. | EU. Zoho's Data Processing Addendum (SCCs). |
| Cloudflare | Bot protection (Turnstile) on our public contact and sign-up forms. | IP address and form-interaction signals — no photo or pupil data. | Global network. Cloudflare's Data Processing Addendum (SCCs). |
| Expo | Delivers push notifications to the mobile app, where enabled. | Device push token only. | US. Expo's Data Processing Addendum (SCCs). |
| Stripe | Takes payment for a print order, where your school has print ordering enabled. | Card and billing details — sent directly to Stripe by the parent's browser, never reaching our own servers. | UK/EU. Stripe's own Data Processing Addendum (SCCs). |
| Prodigi | Prints and posts a print order, where print ordering is used. | Recipient name, delivery address, and the photo file being printed. | UK primary print network; SCCs cover any order routed to an overseas print partner. |
If we add or replace a sub-processor, we'll update this page and, for any change that materially affects how your school's data is handled, tell your school directly rather than relying on you to notice a page change.
See our Data Protection Impact Assessment summary for how we've assessed the risk of this processing, or contact support@jamitd.co.uk for a copy of our data processing agreement.