Due diligence pack for schools and trusts

DPA, sub-processors, security summary, and a pre-filled DPIA template for schools evaluating iAntz. Download, adapt, and sign off — without chasing the vendor.

Built for UK GDPR and the Data Protection Act 2018.

Last updated: September 2026 · Free for schools and trusts

Why schools need this

Because iAntz processes children's data and financial information, a DPIA is effectively mandatory for the buying school under UK GDPR. This pack gives your DPO, business manager, or procurement team the documents that procurement gates almost always ask for — not only the DPIA itself, but also the DPA, sub-processors, and security evidence.

How to use the pack

  1. Download the DPIA template (pre-filled with iAntz processing details).
  2. Complete your school-specific sections (marked with blanks).
  3. Attach the other documents as appendices (or reference them by URL).
  4. Sign off internally with your DPO or data protection lead.
  5. Execute the Data Processing Agreement when you contract with iAntz.

Each document opens in your browser. Use Print → Save as PDF to download a copy for your records or upload to your school's document management system.

Documents

Everything procurement and your DPO typically ask for, in one place.

DPIA template (pre-filled)

ICO-style template with iAntz processing, risks, and mitigations pre-completed. Add your school details and sign off.

Open document

Data Processing Agreement

UK GDPR Article 28 processor terms. Standard form for execution with your school contract.

Open document

Sub-processor list

Stripe, AWS, Cloudflare, Twilio, HubSpot, Freshdesk, Wonde, Sentry, and other processors with purpose and location.

Open document

Data inventory (ROPA annex)

Processing activities, data categories, lawful basis guidance, retention, and locations.

Open document

Security & certifications

Cyber Essentials Plus, ISO/IEC 27001/27701/27017/27018/42001 aligned practices, PCI-DSS via Stripe, CREST-accredited pen testing, encryption, hosting, and continuity targets.

Open document

Data subject rights process

How parents and staff exercise access, erasure, and portability — including in-app self-service.

Open document

Controller & processor overview

ICO registration (ZC093007), DPO contact, and who is controller vs processor for each data type.

Open document

Talk it through with our team.

We're happy to walk your DPO or business manager through the pack, or answer questions about how iAntz processes school data.

Contact us View security measures

Free for schools and trusts. No procurement hoop-jumping required.