This framework applies Newscast Media Group Ltd’s data-governance requirements to School Connection Intelligence. It covers the public website, the Schools Intelligence Observatory, client-supplied programme data, professional B2B communications, expert participation and any qualified introduction arising from a defined engagement. A prospective client may request the underlying engagement-specific evidence under appropriate confidentiality.
Download the public governance framework (PDF, 60 KB) ↓Every client file, audience and communication route is tied to an agreed use.
Access, matching, retention, deletion and responsibilities are defined for the engagement.
Relevance alone never authorises an identity-level handover to a supplier.
Material engagements can be supported by appropriate confidential assurance evidence.
Executive compliance position
The service is designed not to operate as a cold list sale, list rental arrangement, unrestricted contact database or system that converts every public signal into a sales lead. Its required process starts with a defined education change or client question, preserves the limits of the supporting evidence, connects the affected organisational context and uses human review to decide whether any supplier action is relevant.
Source, date, coverage and limitations remain attached.
The school, trust, role and operational consequence are considered together.
A person decides whether the evidence supports analysis, communication or no action.
Only necessary information enters an agreed client or handover route.
Roles and responsibility
Newscast Media Group Ltd is the controller for data it collects and processes for its own network, intelligence, editorial and business purposes. A client may be a separate controller for its own prospect file and subsequent sales activity. Where Newscast processes a client file only on documented instructions, the contract will identify the processor responsibilities. Roles are determined by the facts and contract, not by a generic label.
A recipient of a qualified handover usually acts as an independent controller for its subsequent contact. It must establish its own lawful basis, provide transparency, respect objections and apply security and retention controls.
Lawful basis and PECR segmentation
Consent or a direct request is used where an individual asks for information, a meeting or contact. Legitimate interests may support relevant professional intelligence and corporate B2B communication only after the purpose, necessity and balancing tests have been considered.
| Route | Position | Required control |
|---|---|---|
| Corporate subscriber | PECR’s prior-consent rule for electronic mail does not apply in the same way to limited companies, LLPs and other corporate bodies. UK GDPR still applies where a named contact is used. | Clear sender identity, role and topic relevance, a valid opt-out address, legitimate-interest assessment where used and suppression screening. |
| Individual subscriber | Sole traders and some partnerships receive the stronger PECR protection. Consent, or a valid limited exception, is required for electronic mail marketing. | Subscriber classification, evidence of the permission route and no reliance on legitimate interests to override a PECR consent requirement. |
| Direct enquiry | The individual or organisation has requested information or contact. | Use is limited to the request and any clearly explained follow-up. A separate marketing purpose requires its own assessment. |
Intelligence ingestion and source controls
- Every source category must have an identified provenance, permitted-use basis, acquisition date and coverage description.
- Official and public sources remain subject to UK GDPR where a person can be identified. Public availability is not treated as unlimited permission.
- School-level data is separated from pupil-level data. The supplier service is not designed for pupil records, special-category information or safeguarding case data.
- Deduplication and canonical records prevent several sources describing one development from being represented as several opportunities.
- Evidence quality, recency and limitations are retained. Proximity, context and correlation are not relabelled as proof.
- Materially new processing is screened for legitimate-interest, Article 14 and DPIA requirements before activation.
Client files and programme controls
A client may supply school names, URNs, postcodes, organisation records or a prospect file for a defined programme. Before that file is accepted, the engagement must define access, matching purpose, permitted outputs, security, retention, deletion and controller or processor roles. The operating rule prohibits absorbing the file into unrelated campaigns.
A priority classification means that current evidence warrants human attention under the agreed criteria. It is not proof of buying intent, budget, purchasing authority, tender timing or a guaranteed opportunity.
Qualified introductions and data minimisation
A client does not receive general access to the network or contact database. A named professional is not passed to a supplier simply because the system detects relevance or content engagement. Any identity-level supplier handover requires an affirmative request or valid consent specifically covering that follow-up. Legitimate interests may support internal research or separately assessed corporate B2B communication; it is not used to manufacture permission for a handover.
Where a qualified introduction is authorised, disclosure is limited to the information needed for the agreed follow-up. This may include organisation, professional name and role, business contact details, relevant location, the enquiry or engagement theme and necessary handover context.
Special-category data, unrelated behavioural profiles, private intelligence scores, unrestricted audience records and information outside the agreed purpose must not be included.
| Qualification test | Required outcome |
|---|---|
| Sector, role and topic relevance | The organisation, professional responsibility and subject must align. |
| Permission and lawful basis | An identity-level supplier handover requires an affirmative request or valid consent. Other processing must have its own documented lawful basis and cannot be used to bypass that rule. |
| Reasonable expectation | The contact must not be surprising, intrusive or unrelated to the professional context. |
| Opt-out and suppression | An objection or applicable opt-out prevents the handover or communication. |
| Purpose and minimisation | Only information necessary for the agreed purpose may be disclosed. |
AI, automation and editorial separation
Automation may nominate, organise or strengthen a possible intelligence item. It cannot silently publish a public claim, approve a commercial handover or replace the human assessment of relevance, evidence and fairness. School Connection’s editorial decisions remain separate from School Connection Intelligence’s supplier interpretation. Payment or programme participation cannot purchase coverage or a favourable conclusion.
Security, accountability and incident handling
The operating standard requires risk-based access management, data minimisation, environment and audience separation, encryption in transit, processor and supplier review, secure change management, logging, backup and recovery, incident triage, breach assessment and contractual confidentiality. A control may be represented to a client only where evidence supports it for the relevant service and scope.
Before relevant personal-data processing or disclosure is activated, the accountability record must contain the applicable processing record, lawful-basis assessment, source and provenance record, Article 14 decision, DPIA screening or assessment, data-sharing terms, suppression approach, retention decision and human approval history.
Rights, objections and suppression
Requests for access, source information, correction, erasure, restriction or objection are routed to the privacy contact and assessed within the applicable legal period. Where data has been disclosed, reasonable steps are taken to coordinate a relevant correction, restriction or objection with the recipient.
Direct-marketing objections are absolute. Once received, the personal data is no longer used for that purpose. A minimal suppression record may be retained so the objection remains effective across future activity.
Client due diligence and contractual controls
Before a client receives personal information or participates in a managed communication, the purpose, intended audience, permitted use, security expectations, retention, opt-out handling and restrictions on onward disclosure must be reviewed. Client terms must prohibit resale, unrelated reuse, undisclosed onward transfer and indefinite retention.
For a material engagement, the client may request appropriate evidence of these controls. Any confidential assurance material is supplied under suitable confidentiality and does not expand the public claims made on this website.