Data Protection Due Diligence Pack
DPA, sub-processors, security summary, and a pre-filled DPIA template for schools evaluating Payments by iAntz. Download, adapt, and sign off - without chasing the vendor.
These documents support compliance with UK GDPR and the Data Protection Act 2018.
Last updated: July 2026 · Free for schools and trusts
Why schools need this
Because iAntz processes children's data and financial information, a DPIA is effectively mandatory for the buying school under UK GDPR. This pack gives your DPO, business manager, or procurement team the documents that procurement gates almost always ask for - not only the DPIA itself, but also the DPA, sub-processors, and security evidence.
How to use the pack
- Download the DPIA template (pre-filled with iAntz processing details).
- Complete your school-specific sections (marked with blanks).
- Attach the other documents as appendices (or reference them by URL).
- Sign off internally with your DPO or data protection lead.
- Execute the Data Processing Agreement when you contract with iAntz.
Each document opens in your browser. Use Print → Save as PDF to download a copy for your records or upload to your school's document management system.
Documents
DPIA template (pre-filled)
ICO-style template with iAntz processing, risks, and mitigations pre-completed. Add your school details and sign off.
Open document →Data Processing Agreement
UK GDPR Article 28 processor terms. Standard form for execution with your school contract.
Open document →Sub-processor list
Stripe, AWS, Cloudflare, Twilio, HubSpot, Wonde, Sentry, and other processors with purpose and location.
Open document →Data inventory (ROPA annex)
Processing activities, data categories, lawful basis guidance, retention, and locations.
Open document →Security & certifications
Cyber Essentials Plus, ISO/IEC 27001/27701/27017/27018/42001 aligned practices, PCI-DSS via Stripe, CREST-accredited pen testing, encryption, hosting, and continuity targets.
Open document →Data subject rights process
How parents and staff exercise access, erasure, and portability - including in-app self-service.
Open document →Controller & processor overview
ICO registration (ZC093007), DPO contact, and who is controller vs processor for each data type.
Open document →Related pages
- Privacy Policy - public-facing privacy notice
- Security & organisational measures - full security overview
- Terms of Service - platform terms
Need more detail?
School DPOs can request additional due diligence or walkthroughs:
These documents are provided for due diligence and DPIA purposes. They do not constitute legal advice. Schools should have their DPO or legal adviser review before sign-off.