Privacy notice

Quorum is a governance platform for schools' governing boards, built by WhatLabs. This notice explains what Quorum processes, why, and what your rights are. It covers what is live today and what is still being built - we have tried to be specific about which is which, rather than describe the finished product as if it already exists.

Questions, requests or objections: hello@whatschool.ai.

Quorum is operated by WhatLabs Ltd, a company registered in England and Wales (company number 17312476), registered office 1 Oakham Lane, Kettering NN15 5LE. For the public-record and registration data described here, WhatLabs Ltd is the controller; for the board content your school or trust creates, your school or trust is the controller and WhatLabs Ltd is the processor.

WhatLabs Ltd's registration with the Information Commissioner's Office (the data protection fee) has been applied for; we will add the registration number here once it is issued.

The short version

Public-record data we compile

Quorum's board intelligence is computed from data that is already public. For academy trust and academy boards, we read director and officer records from Companies House - names, roles, appointment and resignation dates, and the tenure this implies. We combine this with GIAS school data, Ofsted inspection outcomes, and WhatSchool's own global school dataset, to show a board its own trust and estate in one place.

We rely on legitimate interests for this. Helping a governing board, its regulator and the public understand who governs a school, and how a board is composed, is a legitimate purpose; the data is already published for exactly this kind of scrutiny; and we run a balancing test before we rely on it, weighing our purpose against your interests and reasonable expectations as a director or trustee. Where that balance does not favour us, we do not process the data this way.

Article 14: data we get from Companies House, not from you

Because officer data comes from Companies House rather than from you directly, UK GDPR Article 14 applies. This notice is how we tell you that we hold it, what we hold, and why. You can object at any time, free of charge, by writing to hello@whatschool.ai. If you object, we will stop processing your data for this purpose unless we have compelling legitimate grounds that override your interests, or we need it to establish, exercise or defend a legal claim.

Data you give us when you register

Registration is not live yet - it is on our roadmap for August 2026. When it opens, registering will mean giving us your name, your role, and your school or MAT email address, which we validate with a confirmation link before your account is active, along with the identity of your school or trust. We hold this to provide the contract you are entering into, or the steps leading up to it - setting up your board's workspace and confirming you are entitled to access it.

Board content your school creates

Once your board is set up, the papers, noticeboard posts and meeting records you create in Quorum are private to your board. For this content, your school or trust is the data controller and WhatLabs is the data processor - we hold and process it on your instructions, not our own. The terms of that arrangement are summarised in our data processing summary; a full signable DPA is available on request.

If you want to exercise a right over something in your board's workspace - a paper, a post, a comment - the quickest route is usually your school or trust directly, since they control it. We will always help them respond.

A note on children's data

Quorum's users are trustees, governors, clerks and school staff, not pupils. The school and estate data we compile - Ofsted grades, pupil numbers, deprivation indicators - is institutional or aggregate, not personal data about identifiable children. If live MIS dashboards (attendance and rolls, from Wonde or Groupcall) go ahead as planned, that will start to involve pupil-level data - we will update this notice and carry out a fresh impact assessment before switching it on, not after.

Your rights

Depending on the data and the lawful basis it is held under, you can ask us to:

• Access a copy of what we hold about you
• Correct it, if it is inaccurate - though for public-record data, the more durable fix is usually correcting it at source (Companies House) so our next refresh picks it up
• Erase it, where there is no good reason for us to keep processing it
• Object to processing based on legitimate interests, as above
• Restrict processing while a query is resolved
• Port data you gave us directly, such as registration details, to another provider

Write to hello@whatschool.ai and tell us what you need. We will ask enough to confirm who you are, then respond within a month.

How long we keep it

Public-record data is kept current, not archived indefinitely - we refresh it on a regular cycle, and when a trust, officer or school drops off the underlying public register, it drops out of Quorum on our next refresh. Registration data is kept for as long as your account is active, plus a short period afterwards to wind down the account and meet any legal obligations. Board content is kept for the life of your school's subscription and handled on termination as set out in the data processing summary.

Keeping it secure

We restrict access to data on a need-to-know basis, encrypt data in transit, and keep each board's content isolated from every other board's. Sign-in uses single-use magic links rather than passwords, and every board's workspace is access-controlled by membership, so one board cannot see another's - see the data processing summary for detail.

Who else handles it

We use a small number of specialist providers to run Quorum, rather than building everything ourselves. Email delivery - confirmation links and notifications - runs through Resend. Quorum is hosted on infrastructure provided by Hetzner Online GmbH. Those are our only two sub-processors that handle personal data, and each only sees what it needs to do its job, under contract. The public registers we read - Companies House, GIAS and Ofsted - are data sources, not processors acting on our behalf.

Where your data is processed

Quorum's servers and backups are hosted in the European Union (Finland), on Hetzner infrastructure. Email delivery through Resend may involve processing outside the UK and EU. Where any provider processes data outside the UK, we put standard safeguards in place, such as the UK's International Data Transfer Addendum.

Impact assessment

Because compiling officer data from Companies House is a form of systematic profiling of named individuals, we maintain a data protection impact assessment for it, covering necessity, proportionality and the safeguards on this page. We review it as the product and our data sources change.

Complaints

We would rather you told us first, at hello@whatschool.ai, so we can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

Changes to this notice

We will update this page as Quorum moves from roadmap to reality - most notably when registration, billing, MIS integration and the AI assistant go live. We will update the date at the top when we do.