Privacy notice

Quorum is a governance platform for schools' governing boards, built by WhatLabs. This notice explains what Quorum processes, why, and what your rights are. It covers what is live today and what is still being built - we have tried to be specific about which is which, rather than describe the finished product as if it already exists.

Questions, requests or objections: hello@whatschool.ai.

The short version

Public-record data we compile

Quorum's board intelligence is computed from data that is already public. For academy trust and academy boards, we read director and officer records from Companies House - names, roles, appointment and resignation dates, and the tenure this implies. We combine this with GIAS school data, Ofsted inspection outcomes, and WhatSchool's own global school dataset, to show a board its own trust and estate in one place.

We rely on legitimate interests for this. Helping a governing board, its regulator and the public understand who governs a school, and how a board is composed, is a legitimate purpose; the data is already published for exactly this kind of scrutiny; and we run a balancing test before we rely on it, weighing our purpose against your interests and reasonable expectations as a director or trustee. Where that balance does not favour us, we do not process the data this way.

Article 14: data we get from Companies House, not from you

Because officer data comes from Companies House rather than from you directly, UK GDPR Article 14 applies. This notice is how we tell you that we hold it, what we hold, and why. You can object at any time, free of charge, by writing to hello@whatschool.ai. If you object, we will stop processing your data for this purpose unless we have compelling legitimate grounds that override your interests, or we need it to establish, exercise or defend a legal claim.

Data you give us when you register

Registration is not live yet - it is on our roadmap for August 2026. When it opens, registering will mean giving us your name, your role, and your school or MAT email address, which we validate with a confirmation link before your account is active, along with the identity of your school or trust. We hold this to provide the contract you are entering into, or the steps leading up to it - setting up your board's workspace and confirming you are entitled to access it.

Board content your school creates

Once your board is set up, the papers, noticeboard posts and meeting records you create in Quorum are private to your board. For this content, your school or trust is the data controller and WhatLabs is the data processor - we hold and process it on your instructions, not our own. The terms of that arrangement are summarised in our data processing summary; a full signable DPA is available on request.

If you want to exercise a right over something in your board's workspace - a paper, a post, a comment - the quickest route is usually your school or trust directly, since they control it. We will always help them respond.

A note on children's data

Quorum's users are trustees, governors, clerks and school staff, not pupils. The school and estate data we compile - Ofsted grades, pupil numbers, deprivation indicators - is institutional or aggregate, not personal data about identifiable children. If live MIS dashboards (attendance and rolls, from Wonde or Groupcall) go ahead as planned, that will start to involve pupil-level data - we will update this notice and carry out a fresh impact assessment before switching it on, not after.

Your rights

Depending on the data and the lawful basis it is held under, you can ask us to:

• Access a copy of what we hold about you
• Correct it, if it is inaccurate - though for public-record data, the more durable fix is usually correcting it at source (Companies House) so our next refresh picks it up
• Erase it, where there is no good reason for us to keep processing it
• Object to processing based on legitimate interests, as above
• Restrict processing while a query is resolved
• Port data you gave us directly, such as registration details, to another provider

Write to hello@whatschool.ai and tell us what you need. We will ask enough to confirm who you are, then respond within a month.

How long we keep it

Public-record data is kept current, not archived indefinitely - we refresh it on a regular cycle, and when a trust, officer or school drops off the underlying public register, it drops out of Quorum on our next refresh. Registration data is kept for as long as your account is active, plus a short period afterwards to wind down the account and meet any legal obligations. Board content is kept for the life of your school's subscription and handled on termination as set out in the data processing summary.

Keeping it secure

We restrict access to data on a need-to-know basis, encrypt data in transit, and keep each board's content isolated from every other board's. Sign-in and per-board access control are still being built ahead of general availability - see the data processing summary for where that stands.

Who else handles it

We use a small number of specialist providers to run Quorum, rather than building everything ourselves. Email delivery - confirmation links, notifications - runs through Resend. We host Quorum with a cloud infrastructure provider. Any sub-processor only sees what it needs to do its job, under contract.

Where your data is processed

Quorum is built for schools and trusts in England, and we intend to keep the data as close to home as that implies. Some of our providers may process or back up data outside the UK; where that happens, we put standard safeguards in place, such as the UK's International Data Transfer Addendum.

Impact assessment

Because compiling officer data from Companies House is a form of systematic profiling of named individuals, we maintain a data protection impact assessment for it, covering necessity, proportionality and the safeguards on this page. We review it as the product and our data sources change.

Complaints

We would rather you told us first, at hello@whatschool.ai, so we can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

Changes to this notice

We will update this page as Quorum moves from roadmap to reality - most notably when registration, billing, MIS integration and the AI assistant go live. We will update the date at the top when we do.