Legal information
Last updated: September 2026.
This page sets out the data processing terms that apply to every school account on The Head's Companion. It forms part of our terms and restates, in the shape of Article 28 of the GDPR, the commitments made in our privacy policy. It is written for the person at your school who reviews data processing arrangements before a service is approved.
For the information your school enters into the product, including staff names, training records, governance records and uploaded documents, your school is the data controller and Sophyra Limited (Ireland, company number 817595, trading as Education Options, business name number 787480) is the data processor. We process that information only on your school's instructions, given through your use of the product, and never for our own purposes. For your account and billing data, Sophyra Limited is the controller, as the privacy policy explains.
The processing consists of hosting, displaying and organising the compliance information your school enters, and producing the product's views, reports and assistant answers from it. It lasts for as long as your school's account is active, and ends with the deletion described below.
The categories of personal data are the names of school staff and their training records, names appearing in governance records, and any personal data contained in documents your school uploads. The data subjects are members of your school's staff and governance body.
The Head's Companion holds no pupil data. The product is designed not to record pupil records or safeguarding case material, and no feature asks for them.
The people authorised to process school data are bound by confidentiality obligations. We apply appropriate technical and organisational measures to the processing: each school's data is isolated by row-level security so a school can only ever see its own data, and the database, authentication and document storage are hosted in the European Union (Frankfurt, Germany).
We engage the sub-processors named in the privacy policy: Supabase (database, authentication and document storage, EU), Stripe (payments), Anthropic, PBC (the document assistant and Ask Companion, United States under Standard Contractual Clauses, no training on your data, retention of at most 30 days), Vercel Inc. (application hosting) and Resend Inc. (email delivery). Each acts under written terms that impose data protection obligations equivalent to these. We keep the list on the privacy policy current; any change appears there before it takes effect.
Transfers outside the UK or EEA are made under Standard Contractual Clauses or an equivalent Article 46 safeguard.
We assist your school, so far as the product allows, in responding to data subject requests and in meeting its obligations on security, breach notification and data protection impact assessment. If we become aware of a personal data breach affecting your school's data, we will notify your school without undue delay.
If your school closes its account, we delete the school data within 30 days, except where billing records must be retained to meet statutory tax and accounting requirements. You can ask us to delete sooner, subject to those legal retention obligations. We make available the information reasonably necessary to demonstrate compliance with these terms: write to privacy@sophyra.ie.
These processing terms are governed by the law of Ireland, in line with our terms.