Privacy Policy

1. Who we are

Effective Clerking Ltd is a company registered in England and Wales with company number 17445060, registered office 17 Wheatfield Road, Bedford, MK45 3QF.

For the processing described in Part A of this policy we are the data controller.

Data protection contact: support@effectiveclerking.co.uk

Postal address: 17 Wheatfield Road, Bedford, MK45 3QF

ICO registration number: ZC242707. We are registered with the Information Commissioner's Office as a data controller.

Effective Clerking is offered only to customers established in the United Kingdom, and we are established in the UK. The UK GDPR and the Data Protection Act 2018 apply to our processing. We have not appointed a representative under Article 27 of Regulation (EU) 2016/679 because we do not offer the Service to individuals in the European Economic Area.

We have not appointed a statutory Data Protection Officer, as we are not required to.

Vijith Vijay is responsible for data protection.

2. The two roles we play — please read this first

This policy has two parts, because we handle personal data in two different capacities.

Part A — where we are the controller. This covers information about you as a customer or visitor: your account, your billing, your support requests, our security logs and our marketing. We decide how and why this is used, and Part A explains it.

Part B — where we are the processor. This covers Customer Content: the meeting notes, minutes, agendas, action records and attendee registers our customers put into the Service, and everything inside them about governors, trustees, staff and others. We do not decide how that information is used. The customer — or the school, academy trust or other organisation the customer acts for — decides that, and is the controller.

If you are a governor, trustee, member of staff or other individual whose details appear in a school’s minutes, and you want to know how your information is used or want to exercise your rights, the school or trust is the right place to ask, not us. Part B explains what we do with that information on their behalf, and how we will help.

PART A — Where we are the controller

3. What we collect and why

3.1 Account and identity data

What: name, work email address, job title or role, organisation name, password (stored only as a hash), multi-factor authentication factors, profile preferences, and the settings you configure.

Why: to create and run your account, authenticate you, provide the Service, and communicate with you about it.

Lawful basis: Article 6(1)(b) UK GDPR — performance of a contract with you. Where you are an individual acting for an organisation that holds the contract, Article 6(1)(f) — our legitimate interest in administering the customer relationship.

Retention: for the life of the account, then 12 months after closure, then deleted. See §8.

3.2 Billing and payment data

What: billing name and address, plan, subscription history, invoices, payment status, VAT number where you give one, and the last four digits and expiry of your card. We never see or store your full card number.

Why: to take payment, issue invoices, meet our tax and accounting obligations, and deal with chargebacks or disputes.

Lawful basis: Article 6(1)(b) — contract; and Article 6(1)(c) — legal obligation, for accounting and tax records.

Retention: 6 years from the end of the accounting period, to meet UK company and tax record requirements.

3.3 Support and correspondence

What: the content of emails, support tickets and any other correspondence with us, including anything you choose to include in them.

Why: to answer you, resolve problems, improve the Service and keep a record of what was said.

Lawful basis: Article 6(1)(b) — contract; and Article 6(1)(f) — legitimate interest in maintaining a record of support and in improving our service.

Retention: 3 years from the date of the last message in the thread.

Please do not paste meeting content or third parties’ personal data into support requests. If you need us to look at a specific record, tell us the reference number and we will look it up.

3.4 Service logs, telemetry and audit records

What: IP address, browser and device information, pages and features used, timestamps, error reports, authentication events, and audit-log entries recording who did what and when inside your account.

Why: to keep the Service secure and available, to detect and investigate abuse and unauthorised access, to diagnose faults, to understand which features are used so we can improve them, and — for audit-log entries — to give you and your clients a defensible record of document handling.

Lawful basis: Article 6(1)(f) — legitimate interests in the security, integrity and improvement of the Service. Our assessment of this balance is recorded in our Legitimate Interests Assessment, available on request.

Retention: security and authentication logs 12 months; general application logs 90 days; audit-log entries attached to a document or action, for the life of the account (they form part of the record the Service exists to produce).

3.5 Marketing

What: name, email address, organisation, and your engagement with our emails.

Why: to tell you about the Service, updates, and things we think are useful.

Lawful basis: consent under Article 6(1)(a) where you signed up without being a customer; or, for existing customers, Article 6(1)(f) legitimate interests, relying on the “soft opt-in” in regulation 22(3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

You can opt out at any time — every marketing email has an unsubscribe link, and you can email support@effectiveclerking.co.uk. Opting out of marketing does not stop essential service messages such as billing notices, security alerts and changes to these terms.

Retention: until you opt out, then we keep a minimal suppression record so we do not contact you again.

3.6 Website visitors

What: cookies and similar technologies, as described in our Cookie Policy.

Why and lawful basis: strictly necessary cookies (session, authentication, security) are used without consent under the exceptions in Schedule A1 to the Privacy and Electronic Communications (EC Directive) Regulations 2003. Anything beyond that is used only with your consent.

3.7 What we do not do

We do not sell personal data.

We do not use Customer Content, or personal data about you, to train artificial intelligence models. Our AI provider is contractually prohibited from training on the content we send it.

We do not use automated decision-making producing legal or similarly significant effects on you. The Service produces drafts for a human to review; it does not make decisions about people.

We do not carry out profiling for advertising.

4. Who we share it with

We share personal data with the service providers listed in our Sub-processor List, which is published and kept current. In summary:

A note about our AI providers. Anthropic is currently our only AI provider. We may engage an additional or alternative AI provider — for continuity, for a particular feature, or because a better option becomes available. Any AI provider must meet the minimum requirements in section 3.3 of our AI Transparency & Limitations Notice, including a contractual prohibition on training models on customer content, before it processes anything. We give customers at least 30 days’ notice of any such change, publish it in our Sub-processor List, and complete a transfer risk assessment where the processing takes place outside the UK.

A note about Stripe. Stripe’s own published position is that it acts both as our processor and as an independent controller in its own right. It determines its own purposes and means for fraud monitoring and anti-money-laundering screening. For that processing, Stripe — not us — is the controller, and Stripe’s own privacy policy applies.

We may also disclose personal data:

to our professional advisers (accountants, lawyers, insurers) under duties of confidence;

where required by law, a court, a regulator or a law enforcement request we are satisfied is valid — we will notify you unless legally prohibited;

to a buyer or successor if the business is sold or reorganised, subject to equivalent protection;

where necessary to establish, exercise or defend legal claims.

5. International transfers

Some of the providers above process personal data outside the United Kingdom.

Where we transfer personal data out of the UK, we do so under one of the safeguards permitted by Chapter V of the UK GDPR — principally the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, and in some cases the UK Extension to the EU-US Data Privacy Framework.

We have completed a transfer risk assessment for each recipient, which considers the laws and practices of the destination country and the practical enforceability of our safeguards. These are reviewed at least annually and whenever a relevant legal development occurs. You may request a summary at support@effectiveclerking.co.uk.

Your database is hosted in the United Kingdom, but AI drafting takes place in the United States, hosting infrastructure and backups are not confined to the UK, and email delivery takes place in the United States. We do not claim that all your data stays in the UK.

6. Security

We maintain technical and organisational measures appropriate to the risk, described in our Security Statement and, for customer data, in Annex II to our Data Processing Agreement. In outline:

encryption in transit (TLS) and at rest;

role-based access control, least privilege, and multi-factor authentication on administrative accounts;

tenant isolation enforced at the database layer;

an immutable audit log of document creation, editing, approval and sending;

logging and monitoring of access to production systems;

documented incident response and breach notification;

supplier due diligence before any new sub-processor is engaged.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to people’s rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and will notify affected individuals directly and without undue delay where the risk is high.

7. Your rights

Under the UK GDPR you have the right to: be informed; obtain access to your personal data; have inaccurate data rectified; have data erased in certain circumstances; restrict processing; data portability; object to processing based on legitimate interests, and to object to direct marketing at any time; and not to be subject to certain solely automated decisions.

To exercise a right, email support@effectiveclerking.co.uk. We may ask for information to confirm your identity — the time limit does not start until we have it.

How quickly we respond: Without undue delay and at the latest within one month. We may extend by a further two months where a request is complex or where you have made a number of requests; if we do, we will tell you within the first month and explain why. If we need to ask you to clarify a request, the clock pauses until you reply.

We will carry out reasonable and proportionate searches. We may refuse a request that is manifestly unfounded or excessive, or charge a reasonable fee, and we will explain why and tell you how to complain.

Please note: these rights apply to the personal data we hold about you as a controller — Part A. If your details appear inside a customer’s meeting records, see Part B below.

8. How long we keep things

Our full Retention & Deletion Schedule is available on request.

9. Complaints

If you are unhappy with how we have handled your personal data, tell us first at support@effectiveclerking.co.uk. We will:

acknowledge your complaint within 30 days of receiving it;

take appropriate steps to respond, including making appropriate enquiries, without undue delay;

keep you informed of progress; and

tell you the outcome without undue delay.

This reflects the complaints duty introduced by the Data (Use and Access) Act 2025, in force from June 2026.

You also have the right to complain to the Information Commissioner’s Office at any time — ico.org.uk, or 0303 123 1113.

PART B — Where we are the processor

10. Customer Content

What it is. Everything our customers put into the Service or generate through it: raw meeting notes, drafted and approved minutes, agendas, action records, attendee name registers, contact details for governors and staff, uploaded files, and invoice data.

Whose data it contains. Typically: governors and trustees; headteachers, senior leaders and other staff; local authority officers and external advisers; occasionally, and incidentally, pupils and parents where a board discussed a matter concerning them.

What kinds of information. Names, roles, contact details, attendance, declarations of interest, and the content of board discussions. Board minutes can also contain special category data — for example staff health or sickness absence, or matters touching religion or ethnicity — and criminal offence data, for example where an allegation or exclusion is recorded. We process this on our customers’ instructions and treat it accordingly.

Who the controller is. The school, academy trust, local authority or other organisation whose meeting it was. Where a customer is an independent clerking practice acting for such an organisation, that customer is the organisation’s processor and we are its sub-processor.

11. What we do with it, and what we do not

We process Customer Content only on our customer’s documented instructions, which are given through their use of the Service and through our Data Processing Agreement. In practice that means:

storing it in the customer’s isolated area of our database, hosted in the West Europe (London) region;

transmitting the relevant text to our AI provider so a draft can be produced, and returning that draft to the customer for review;

generating documents and, when the customer explicitly approves and instructs it, sending them to the recipients the customer specifies;

keeping an audit log of what was created, changed, approved and sent, and by whom;

backing it up, securing it, and providing support when asked.

We do not:

use Customer Content for our own purposes;

use it to train artificial intelligence models — and our AI provider is contractually prohibited from training on it;

sell it, or disclose it to anyone other than the sub-processors listed in §4 and our Sub-processor List;

access it except where necessary to provide support the customer has requested, to investigate a security incident, or where legally compelled — and every such access is logged.

AI processing, specifically. Text is sent to our AI provider — currently Anthropic’s Claude API — for drafting. Under Anthropic’s Commercial Terms of Service, Anthropic may not train models on that content. Anthropic’s published position is that API inputs and outputs are deleted from its backend within 30 days of receipt or generation. Where content is flagged by Anthropic’s automated trust and safety systems as a possible usage policy violation, Anthropic may retain inputs and outputs for up to 2 years and classification scores for up to 7 years. Processing and storage take place in the United States.

12. If your details appear in a school’s records

If you are a governor, trustee, member of staff or other individual whose personal data appears inside a customer’s meeting records:

the school, trust or organisation is the controller and is the right place to make a request or ask a question. They will have their own privacy notice;

if you contact us instead, we will not be able to act on the request ourselves, but we will pass it to the relevant customer without undue delay and tell you we have done so;

we will assist our customer, so far as we reasonably can, in responding to you;

we will not disclose Customer Content to you directly, because it is not ours to disclose.

If you do not know which organisation holds your data, or you are having difficulty getting a response, email support@effectiveclerking.co.uk and we will help you identify the right contact.

13. Retention of Customer Content

Customer Content is retained for as long as the customer’s account is open, and in accordance with the customer’s own retention settings and instructions.

Export your content before you close your account, using the export features in the Service. On closure, access ends immediately, but you have 30 days to ask us to reopen the account, which restores full access including export. If you do not, we permanently delete Customer Content from live systems at the end of that 30 days, and any remaining copies are overwritten as our database backups cycle out — currently within 7 days.

A customer may instruct earlier deletion of specific records at any time, and we will act on it, subject to any legal obligation to retain.

Our customers are responsible for setting retention periods that suit their own legal duties. Our default settings and guidance reflect DfE record-keeping guidance for schools and the Information and Records Management Society Schools Toolkit — see our Retention & Deletion Schedule.

14. Sub-processors

We engage the sub-processors listed in our Sub-processor List, which is published at https://www.effectiveclerking.co.uk/security and kept current.

Customers may subscribe to notifications of changes. We give at least 30 days’ notice before adding or replacing a sub-processor that will process Customer Content, and a customer may object on reasonable data protection grounds under the procedure in our Data Processing Agreement.

15. Changes to this policy

We keep this policy under review and will update it when our processing changes. Material changes will be notified by email and by notice in the Service at least 14 days before they take effect. The version and effective date are shown at the top.

Version history