Privacy notice for school accounts and this website

Draft for solicitor review. Placeholders in [square brackets] must be completed before launch.

Version: draft v1.3, 12 October 2026

This notice is about the people who use Benchmark.Pulse on behalf of a school or trust: headteachers, business managers, safeguarding leads and other staff with an account. It also covers people at schools we have not yet worked with, whose work email address we hold so we can tell their school about Benchmark.Pulse (see "Contacts at schools we have not yet worked with"). For how survey responses are handled, see the data processing agreement and the privacy notice templates your school gives to respondents.

Who we are

After Hours Education Ltd, trading as Benchmark.Pulse, company number 17051217, registered at Wellesley House, Duke Of Wellington Avenue, London SE18 6SS. ICO registration ZC198439. Contact: hello@benchmarkpulse.co.uk.

For school accounts, billing and this website we are the data controller. For survey responses, the school is the controller and we are its processor.

What we collect about account users

Your work email address. You sign in with a one-time code that we email to you. We also use your address to send safeguarding alerts and reminders if you are a safeguarding lead, to tell account owners when an alert has not been reviewed after 2 hours (never what it says), and to send service emails about your school's surveys, which you can unsubscribe from.
Your role on the school's account.
A record of significant actions, such as unlocking a report, issuing an invoice or reviewing a safeguarding alert, so the school has an audit trail.
Billing details you give us for invoices: the name, email and postal address to invoice, and any purchase order number. Card payments are handled by Stripe; we never see card numbers.

If you email us

If you email us, we keep your message and our reply, matched to your school where we can. A reply may be drafted with the help of an AI model (Claude, made by Anthropic), using only our published information and your school's account details. A person checks every draft before it is sent. [check: support_mode stays 'draft' with no auto-send classes; the code allows the owner to auto-send listed classes.] Messages we recognise as being about safeguarding, a complaint or your data protection rights go straight to a person and are not sent to the AI. The check looks for words and phrases, so it can miss some. Survey answers and comments are never sent to the AI from here. [check: how long support emails are kept.]

Cookies and your device

This site sets no cookies and uses no analytics or advertising. Your browser keeps two things on your own device: your sign-in session, so you stay signed in, and the invoice details you last entered, so you do not have to type them again. Neither is used for tracking. You can clear them at any time by signing out and clearing your browser's site data.

Contacts at schools we have not yet worked with

We email state schools in England to tell them about Benchmark.Pulse. This part explains what we hold about people at those schools before their school has an account with us, where it comes from, what we do with it and how to stop it.

What we hold

Facts about the school or trust: its name, type, phase, local authority, region, website, number of pupils and trust. These come from Get Information about Schools (GIAS), the Department for Education's public register, and include no one's personal details.
A work email address and the role it belongs to: school office, finance office, bursar, business manager, headteacher or principal. We also keep where we found the address and when.
For addresses from Apollo.io: Apollo's own reference number for the person and its view of whether the address works. We keep the reference number for 18 months even when we decided not to use the address, so that we do not pay to look the same person up twice.
A record of our emails to you: what we sent and when, and whether a message bounced, you replied, or you asked us to stop. We do not track whether you open our emails or click their links.

We do not keep your name, phone number or social media profiles. If you reply, we keep your message, including the name your email shows (see "If you email us"). We never collect personal email addresses for these emails: an address on a personal email service is refused automatically.

Where it comes from

Your school's own website. Our program reads at most five public pages of a school's own website (the home page and its contact, staff or about pages). It follows the site's robots.txt rules and identifies itself as Benchmark.Pulse. It keeps only shared addresses for the school office or finance office, and, where the page names a person as the business manager or bursar, that person's work address. It keeps only addresses on the school's own domain.
Apollo.io, a business contact data provider. For headteachers and principals of state schools in England, we obtain their work email address from Apollo. We do not obtain personal email addresses or phone numbers from Apollo, and we do not obtain names.
GIAS, for the facts about each school listed above.

We do not use lists of personal addresses, guess email addresses, or collect details from social media.

Why, and our lawful basis

We use these details to tell schools about a service that may help them hear from their staff, parents and pupils. Our lawful basis is legitimate interests: telling schools about a service relevant to their work. We have weighed this against your interests. We use only work addresses, for the role they belong to; we send a small number of plain emails; and you can stop them at any time with one click. Our legitimate interests assessment is available on request. [check: B4 legitimate interests assessment written and signed off]

Emails to work addresses at organisations do not need your prior consent under the Privacy and Electronic Communications Regulations, as long as we say who we are and give you a simple way to stop them. [check: solicitor to confirm this applies to every type of state school, including maintained schools]

What we send

At most three emails to a school in a term, about a week apart, on weekdays during working hours, and none in August.
Each email is plain text, says who we are, where we found your address and how to stop further emails, and links to this notice. An email without the link is refused by our system and never sent.
The emails are written from templates that we approve, and are then sent automatically.
They come from a separate sending address used only for these emails [check: sending domain], and replies come to hello@benchmarkpulse.co.uk.
If you reply, the sequence stops. If you tell us you are interested, we may send one follow-up.

We do not use AI to research or score anyone, and no decision with a legal or similar effect on you is made automatically. If you reply, your message is handled as in "If you email us", which may include an AI-drafted reply that a person checks.

Who we share it with

Supabase, which stores it.
Resend, which sends our emails and receives replies.
Anthropic, if your reply is used to draft our answer.

Their locations and safeguards are in our sub-processor list. Apollo.io receives the website addresses of the schools we want to contact, so it can find matching headteachers, but we do not send it anything about you. [check: Apollo.io's location and the safeguards for any transfer of data from it]

How long we keep it

We delete a contact we have not heard from 18 months after we found them, together with the record of the emails we sent to that address. If you replied, we delete your contact details 24 months after your last reply, with the emails we sent you and your messages to us, unless your school has since signed up with us. We keep a data protection request or complaint for 6 years after we received it, as the record of how we handled it. Both deletions run automatically every night. A contact still in a sequence of emails is deleted once the sequence ends. If you ask us to stop, or an email to you bounces or is reported as spam, we keep your email address on a do-not-contact list so that we never email it again, including if it reaches us again from another source. We keep that list for as long as we send emails. It is the only thing we keep after you ask us to stop, and we use it for nothing else.

Your rights

You can object to these emails at any time, and we will stop. Use the link in any email, or write to hello@benchmarkpulse.co.uk. You can also ask to see what we hold about you, or ask us to delete it. We will delete everything except the do-not-contact entry, which we need so that we do not contact you again. We reply within one month. If you are unhappy, you can complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/

Why, and our lawful basis

To provide the service you or your school asked for (contract).
To keep records for tax and accounting (legal obligation).
To keep the service secure and to investigate misuse (legitimate interests).

We do not sell your data, and we do not use it for advertising.

How long we keep it

Account details while your school has an account, and for [12 months] after it closes. Invoices and billing records for 6 years, as tax law requires. Audit records for [3 years].

Who we share it with

The suppliers listed in our sub-processor list, under contracts that protect it, and no one else unless the law requires.

Your rights

You can ask to see, correct or delete your data, to object to how we use it, or to restrict it. Contact hello@benchmarkpulse.co.uk. If you are unhappy, you can complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/

[Date of this notice]