Legal
Privacy Policy
Last updated: 29 September 2026 · Applies to: omnis.education
1. Who we are and our role
Omnis is a learning and SEND support platform for UK schools, available at omnis.education.
Omnis is operated by Omnis Education, which is being set up as a limited company registered in England and Wales. Company registration details will be added here once registration is complete.
For school data, the school is in charge. Each school that uses Omnis is the data controller for its pupils', parents' and staff's personal data. Omnis is a data processor: we only use that data to provide the service, on the school's instructions, under a Data Processing Agreement with the school.
For our own business data, we are in charge. Omnis is the data controller only for information about visitors to our website, enquiries sent to us, and our business contacts.
Contact: privacy@omnis.education
2. Data we process
School staff (teachers, SENCOs, senior leaders, administrators)
- Name, school email address and role
- What they do in the platform (lessons, homework set, marks entered)
- Sign-in times and an audit log of significant actions
Pupils
- Name, year group, class and school email address
- Homework, answers and grades
- SEND status and SEND plans (ILP, EHCP, APDR, Learning Passport), where the school records them
- Safeguarding, behaviour and pastoral records, where the school chooses to record them in Omnis
- Revision and learning-profile information
- Attendance and other information copied from the school's management information system (MIS) through Wonde
Parents and carers
- Name, email address and relationship to the pupil
- Consent choices and messages with the school
Website visitors and enquiries
- Basic server logs (IP address, browser type, pages visited) and anything you send us. We do not use third-party analytics or advertising trackers.
3. Lawful basis
For school data, the school decides the lawful basis, because it is the controller. Schools usually rely on public task (UK GDPR Article 6(1)(e)) for their education functions, and on substantial public interest (Article 9(2)(g) with Schedule 1 of the Data Protection Act 2018) for SEND and safeguarding information. Your school's own privacy notice explains this.
For our own business data, we rely on legitimate interests (running and securing our website and replying to enquiries) and, for any marketing emails, consent, which you can withdraw at any time.
4. How the data is used
Omnis uses school data only to provide the service to the school:
- Signing users in and keeping accounts secure
- Setting, completing and marking homework, and tracking progress
- Supporting SEND planning and review, with staff approving anything that matters
- Copying pupil, staff and class information from the school's MIS through Wonde
- Sending service emails (for example homework reminders, sign-in codes, review reminders)
- Keeping an audit log of significant actions
We never sell data, use pupil data for advertising, or use it to train AI models.
5. How we use AI
Some features use an AI service, Claude, provided by Anthropic PBC in the USA. It helps draft homework, SEND plans and feedback. A member of staff always reviews AI output before it takes effect; no decision with legal or similarly significant effect is made by AI alone.
Before any request leaves Omnis, pupil, parent and staff names are replaced with random codes, and email addresses and phone numbers are removed. The key that links codes to names stays inside Omnis and is never sent. Information about a pupil's learning and needs is still sent where the feature needs it, so this coded information is still treated as personal data.
Under Anthropic's commercial terms, Anthropic does not use this data to train its models and deletes it within 30 days. The transfer to the USA is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in Anthropic's data processing terms.
6. How long data is kept
School data is kept for as long as the school instructs. Each school sets its retention schedule in Omnis. The defaults follow the IRMS Academies Toolkit, which the Department for Education's Data Protection Toolkit for Schools relies on:
| Record | Default retention |
|---|---|
| SEND files (ILP, EHCP, APDR, SEND status) | Pupil's date of birth plus 31 years |
| Pupil record, including behaviour and exclusions | Pupil's date of birth plus 25 years |
| Safeguarding and child protection files | Pupil's date of birth plus 25 years, then review |
| Homework, messages, learning profile | Deleted when the school erases a leaver's data |
| Audit logs | 6 years |
When a pupil leaves, the school can download the pupil's SEND and safeguarding file to keep under its own procedures, and Omnis then deletes it. When a school stops using Omnis, we return its data in a usable format and then delete it, including from backups, within the period set out in the Data Processing Agreement.
Our own business data: website enquiries are kept for 2 years.
8. Your rights
Under UK GDPR you can ask to see your data, correct it, delete it, restrict or object to its use, or receive a copy in a portable format.
If your request is about school data (you are a pupil, parent or member of staff), contact your school's Data Protection Officer. The school handles the request and we help it.
If your request is about our own business data, email privacy@omnis.education. We will acknowledge your request within 5 working days and respond in full within one month.
You can also complain to the Information Commissioner's Office (ico.org.uk).
9. Security
We protect data with:
- Encryption in transit (TLS) and at rest
- Compulsory two-step sign-in for all staff accounts
- Role-based access, so each person sees only what their role needs
- Separation between schools, checked in every database request and tested regularly
- An audit log of significant actions
- Error monitoring and a written incident response plan
- Regular internal security reviews and automated security scanning
We have completed a Cyber Essentials self-assessment. We will update this page when independent certification and penetration testing have been completed.
If a personal data breach affects school data, we will tell the school without undue delay and within 24 hours of becoming aware of it, so the school can notify the ICO within 72 hours where required.
11. Changes to this policy
We will tell school administrators by email at least 30 days before any significant change. The date at the top of this page shows when it was last updated.
12. Contact
Email: privacy@omnis.education
Post: address to be added once the company is registered.