This pack contains the supplier-side information a school needs in order to carry out a Data Protection Impact Assessment (DPIA) for Elemental. It follows the structure of the UK Information Commissioner's Office sample DPIA template, which can be downloaded from https://ico.org.uk/media2/migrated/2553993/dpia-template.docx.

This pack supports but does not replace the School's own DPIA. The School remains the Data Controller for Student Data and is responsible for carrying out the assessment, for deciding whether the processing is necessary and proportionate, for assessing the risks to data subjects, and for any other obligations under UK GDPR. The sections that only the School can answer are left deliberately blank.

This pack should be read alongside the relevant Data Processing Agreement (DPA) and Privacy Policy, linked below:

• Data Processing Agreement – Google Workspace and Google Classroom: /legal/dpa/google
• Data Processing Agreement – Microsoft Entra and Microsoft Teams: /legal/dpa/microsoft
• Data Processing Agreement – Email / Passwords: /legal/dpa/email
• Privacy Policy: /privacy

Although we aim to keep this information pack aligned with these documents, where they differ the documentation linked above takes precedence.

If you have any questions, please contact us at privacy@elementalmusic.app and we would be happy to help. You can also find answers to common questions on the Elemental Trust Centre at /trust/faq.

SUBMITTING CONTROLLER DETAILS

Processor details, for your reference:

STEP 1: IDENTIFY THE NEED FOR A DPIA

Elemental is an online music education platform used by schools with students from Key Stage 1 to Key Stage 5. Teachers use it to set and mark homework, to track progress, and to deliver curriculum content. Using it involves processing the personal data of students and staff.

A DPIA is likely to be required for this processing, because it involves the personal data of children.

For the School to complete. Explain broadly what your project aims to achieve, why you are adopting Elemental now, and how it fits the wider aims of your school or trust.

STEP 2: DESCRIBE THE PROCESSING

2.1 Nature of the processing

Elemental collects Student Data from one of three sources, depending on how your students and staff sign in. Each has its own Data Processing Agreement.

Microsoft Entra and Microsoft Teams for Education. Elemental obtains user profiles from your Microsoft Entra tenant, and class rosters and assignments from Microsoft Teams for Education, using the following delegated scopes:

These scopes and their associated permissions are defined and described by Microsoft and are documented at https://learn.microsoft.com/en-us/graph/permissions-reference.

Google Workspace and Google Classroom. Elemental obtains user profiles from your Google Workspace tenant, and class rosters and assignments from Google Classroom, using the following scopes:

These scopes and their associated permissions are defined and described by Google and are documented at https://developers.google.com/identity/protocols/oauth2/scopes.

Email addresses and passwords. Where no Learning Management System is connected, school administrators or teachers create accounts directly in Elemental, either by entering details or by uploading a CSV or Excel file.

Data is stored in Elemental for as long as the School continues to use the service, and is deleted as described in section 2.2. Elemental does not share Student Data with anyone other than the sub-processors listed in section 2.4.

For the School to complete. State the original source of the data, whether that is your Learning Management System, your Management Information System, or details entered directly into Elemental by your staff.

2.2 Scope of the processing

The categories of personal data processed are:

• User profiles: student and teacher email addresses, first names and last names
• Where a Learning Management System is connected: class rosters (class names and identifiers, teacher and student identifiers) and assignments (identifiers and statuses)

None of the data Elemental collects or stores is special category data under Article 9 of the UK GDPR, and Elemental does not process criminal offence data. Elemental carries no advertising.

When your subscription ends, or whenever you ask us to, you can choose for us to do either or both of the following:

• Delete all your school's Student Data
• Return it to you in a common format (CSV or Excel)

Within 14 days of receiving your request, except for any data we are required by law to keep. Data in backups will be deleted within 90 days.

We will confirm once deletion is complete.

For the School to complete. State how many students and staff will use Elemental, the age range involved, and the geographical area covered.

2.3 Context of the processing

The data subjects are students and teaching staff at the School. Students are children, and a substantial proportion may be under 13, so the UK ICO's Age Appropriate Design Code is relevant. Elemental is used at the direction of the School as part of curriculum teaching, so students would reasonably expect their school to hold and use this data for education.

Elemental is a closed platform. There is no messaging, chat or commenting between students, no means of contacting anyone outside the School through Elemental, and no public profiles. A student's work and progress are visible to teachers at their own school.

Security measures. Elemental protects Student Data with:

• Encryption in transit and at rest
• Secure cloud hosting through reputable third parties
• Access controls to ensure only authorised employees and contractors can view data
• Regular security updates and monitoring

Confidentiality: All employees and contractors who access the School's Student Data are bound by confidentiality obligations and receive regular data protection training.

Elemental holds a current Cyber Essentials certification, which can be verified at https://registry.blockmarktech.com/certificates/ee9c4aaf-a056-42b5-8b70-ba20fe1c6112.

Automated processing and AI. The following applies only where a school uses Summational's AI marking feature.

Teachers can choose to collect each student's answers on paper worksheets, which can then be scanned and uploaded to Elemental to be marked automatically.

These scans are processed by a pre-trained model, not a Large Language Model (LLM). This model performs Optical Character Recognition (OCR), converting the scan into text and layout information so that student answers can be located on each page. The scans are processed by a trusted sub-processor within the UK.

The extracted marks are then presented to the teacher for review, with warnings on any potential marking issues. Teachers are able to override the automated marks and are encouraged to do so as appropriate.

Elemental does not use Large Language Models (LLMs) to process Student Data and Student Data is never used by Elemental or our sub-processors for model training. Our full AI transparency statement is at /trust/ai-transparency.

If we become aware of a Personal Data Breach affecting your Student Data, we will notify you without undue delay and in any event within 48 hours of becoming aware, and tell you:

• What happened
• What data was affected
• What we're doing about it
• What you might need to tell students/parents

2.4 Sub-processors and international transfers

Student Data stays in the UK and EU. There are no transfers outside the UK and EU. The current sub-processors are:

All sub-processors are bound by agreements to ensure compliance under the UK GDPR.

We will provide notice before adding new sub-processors. You will have a reasonable opportunity to object on reasonable data protection grounds before any new sub-processor is added.

2.5 Purposes of the processing

For the School to complete. Describe what your school wants to achieve, the intended effect on students, and the benefits you expect for students and staff, and more widely. This is a decision for the School as Data Controller, and Elemental cannot answer it on your behalf.

STEP 3: CONSULTATION PROCESS

Elemental is available to answer questions from the School's Data Protection Officer, at privacy@elementalmusic.app, and will provide additional information if the School needs to consult the UK ICO.

For the School to complete. Describe when and how you will seek the views of students, parents and staff, or justify why it is not appropriate to do so, and record who else within your organisation you need to involve.

STEP 4: ASSESS NECESSITY AND PROPORTIONALITY

Facts that may assist your assessment: Elemental collects only the data described in section 2.2; it uses that data solely to provide the service to the School's students and staff; it acts only on the School's documented instructions under a Data Processing Agreement; and it will delete or return the data on request.

For the School to complete. State your lawful basis for processing, whether the processing actually achieves your purpose, whether there is another reasonable way to achieve the same outcome, how you will prevent function creep, and how you will inform students and parents. This is a decision for the School as Data Controller.

STEP 5: IDENTIFY AND ASSESS RISKS

For the School to complete. Identify the sources of risk and the nature of the potential impact on students and staff, and rate each for likelihood of harm (remote, possible or probable), severity of harm (minimal, significant or severe) and overall risk (low, medium or high). Elemental deliberately does not pre-fill this section: a supplier cannot credibly assess the risk its own product presents to your students, and the assessment depends on your context.

STEP 6: IDENTIFY MEASURES TO REDUCE RISK

The measures Elemental already provides, which you may wish to record against the risks you identify, are: a Data Processing Agreement under Article 28; UK and EU data residency; encryption in transit and at rest; access controls, confidentiality obligations and staff training; Cyber Essentials certification; a 48-hour breach notification commitment; deletion within 14 days of request, and 90 days for backups; assistance with data subject rights within 5 business days; and a right for the School to audit Elemental's practices.

For the School to complete. For each risk you identified in Step 5, record the options to reduce or eliminate it, the effect on the risk (eliminated, reduced or accepted), the residual risk (low, medium or high) and whether the measure is approved.

STEP 7: SIGN OFF AND RECORD OUTCOMES

For the School to complete. This section is entirely for the School. Elemental cannot approve measures, accept residual risk, or provide DPO advice on the School's behalf.

ATTRIBUTION AND LICENCE

The structure of this pack is adapted from the UK Information Commissioner's Office sample DPIA template, which is licensed under the Open Government Licence v3.0. It contains public sector information licensed under that licence. The supplier-side content is © Seasoft Limited and is provided to support your evaluation of Elemental; all other rights reserved.

VERSION HISTORY