Last updated: September 2026.
This page sets out the data processing terms that apply to every school account on The Head's Companion. It forms part of our terms and restates, in the shape of Article 28 of the GDPR, the commitments made in our privacy policy. It is written for the person at your school who reviews data processing arrangements before a service is approved.
For the information your school enters into the product, including staff names, training records, governance records and uploaded documents, your school is the data controller and Sophyra Limited, a company registered in Ireland (company number 817595), is the data processor. We process that information only on your school's instructions, given through your use of the product, and never for our own purposes. For your account and billing data, Sophyra Limited is the controller, as the privacy policy explains.
The processing consists of hosting, displaying and organising the compliance information your school enters, and producing the product's views, reports and assistant answers from it. It lasts for as long as your school's account is active, and ends with the deletion described below.
The categories of personal data are the names of school staff and their training records, names appearing in governance records, and any personal data contained in documents your school uploads. The data subjects are members of your school's staff and governance body.
The Head's Companion is not designed for pupil data: no feature records pupil records or safeguarding case material, no feature asks for them, and schools must not enter them. If a document your school uploads happens to contain personal data about a pupil, it is processed only as part of that document, under these terms, and is deleted with it.
The people authorised to process school data are bound by confidentiality obligations. We apply appropriate technical and organisational measures to the processing: each school's data is isolated by row-level security so a school can only ever see its own data, and the database, authentication and document storage are hosted in the European Union (Frankfurt, Germany).
We engage the sub-processors named in the privacy policy: Supabase (database, authentication and document storage, EU), Stripe (payments), Anthropic Ireland, Limited (the document assistant and Ask Companion; processing in the United States by Anthropic, PBC under Standard Contractual Clauses, no training on your data, retention of at most 30 days), Vercel Inc. (application hosting) and Resend Inc. (email delivery). Each acts under written terms that impose data protection obligations equivalent to these. We keep the list on the privacy policy current. Before we add or replace a sub-processor we give at least 30 days' notice on that page and by email to the Head, so your school has the opportunity to object; if we cannot meet a reasonable objection, your school may end its subscription before the change takes effect, and we return or delete its data as set out below.
Transfers outside the UK or EEA are made under Standard Contractual Clauses or an equivalent Article 46 safeguard.
We assist your school, so far as the product allows, in responding to data subject requests and in meeting its obligations on security, breach notification and data protection impact assessment. If we become aware of a personal data breach affecting your school's data, we will notify your school without undue delay.
When your school's account ends we return the school data to your school in a common machine-readable form or delete it, at your school's choice, within 30 days, and we delete our remaining copies, except where billing records must be retained to meet statutory tax and accounting requirements. You can ask us to delete sooner, subject to those legal retention obligations.
We make available the information reasonably necessary to demonstrate compliance with these terms and, on reasonable written notice and no more than once a year unless a supervisory authority requires otherwise, we allow for and contribute to an audit or inspection by your school or an auditor it appoints, within the confidentiality and security arrangements that protect other schools' data. If we consider that an instruction from your school infringes data protection law, we will say so before acting on it. Write to privacy@sophyra.ie.
These processing terms are governed by the law of Ireland, in line with our terms.