Here are some common questions asked about how we use a school’s data in Compass+.
What is the lawful basis for processing?
Three types of data are used in Compass+. This is the lawful basis for processing each type of data:
Student data
CEC and our school are joint controllers. For Compass+ the lawful basis relied on is Public Interest (Art 6 (1) (e). CEC carries out tasks in the public interest which is fully funded by the DfE and the underlying task, function or power has a basis in law. The processing is necessary for the performance of the task carried out in the public interest and in the exercise of official authority vested in the controller. Special Category data – lawful basis.
Public interest (Art 6 (1) (e) and reasons for substantial public interest (Art 9 (g) plus Schedule 1 Part 2 basis equality of opportunity or treatment (condition 8).
User data and partner data
The lawful basis is legitimate interest.
How does Compass+ collect and process my school's student data?
Student data in Compass+ is extracted from a school’s Management Information System (MIS) using the automated extraction software provided by Assembly/Groupcall.
A school selects and approves the data fields, called “scopes”, that they want to be transferred from their MIS to Compass+. Assembly/Groupcall then extracts and caches the selected data. This data is then made available to Compass+.
An integration tool called the “Connector” fetches only the data required by Compass+ from the Assembly/Groupcall API. The Connector transforms the MIS data received into the necessary format and loads it into Compass+.
Compass+ only receives the specific data scopes that a school has approved for use in Compass+.
Compass+ users in a school access student level data within the Compass+ tool as part of their provision of careers support. In addition to accessing student data to better understand the needs of individual students, they can add careers-specific data to a student’s profile, recording for example activities that the student has participated in, or their intended career destinations.
How much student data is collected from my school’s MIS?
Individual student data is held in the pupil profile within Compass+. The purpose of the pupil profile is to support Compass+ users to plan, track, optimize, organize, and tailor careers provision to the individual needs of students.
Data drawn from a school’s Management Information System (MIS) identifies the student to the Compass+ user, such as name, and data which identifies the student to systems, such as the MIS identifier.
It also includes data which supports the organisation of careers provision, for example registration groups and attendances. A large part of the data relates to student characteristics which are relevant to the provision of careers support, such as special educational needs and disabilities (SEND) and free school meals status, which helps a Careers Leader target and tailor provision to meet the specific needs of individual students.
Of the data drawn from a school’s MIS, the following are special category data: Student Ethnicity, Pupil Premium, Free School Meals, SEND.
The data processed from a school MIS comprises:
- Attendances
- Groups
- User defined groups
- Registration groups
- School details
- Student basic information
- Student start and end dates
- Student date of birth
- Student ethnicity
- Student first language
- Student free school meal status
- Student free school meal and eligibility history
- Student gender
- Student MIS identifier
- Student admission number
- Student pupil premium status
- Student pupil premium history
- Student SEN provision
- Student SEN provision history
- Student UPN
- Student Teaching groups.
The following data is then added by Compass+ users:
Compass+ users can add extra information to the pupil profile within Compass+. This information relates to the careers support provided to the individual student, including:
- Careers activities offered to and taken part in by the student
- The student’s careers interests and intended destination (what they hope to do after leaving school)
- The student’s actual destination (what they did for 3 years after leaving the school). This “actual destination” data should be recorded as recommended by Gatsby Benchmark 3, in order to help the Careers Leader understand the impact of the careers support provided to the student.
What other data does Compass+ collect and process?
In addition to student data, Compass+ also collects and processes user data from other colleagues given access to Compass+ by the Careers Leader and partner data inputted by users in the careers partner database.
Who are Assembly/Groupcall?
To connect a school’s Management Information System (MIS) to Compass+, schools must approve the installation of an app provided by Assembly/Groupcall who provide the Connector that transforms their MIS data into the necessary format and loads it into Compass+.
Compass+ only receives the specific data scopes a school has approved for use in Compass+.
How long do you keep Compass+ data?
Three types of data are used in Compass+, they are student data, user data and partner data. Let’s look at each of these:
Student data will be deleted from Compass+ 3 years after the student leaves the school. This is in line with the recommendation of Gatsby Benchmark 3 for Careers Leaders to track the destinations of students for 3 years after they leave school:
“The school collects and maintains accurate data for each student around their education, training and employment destinations for at least three years after they leave. This information is shared with current students to support ongoing review and evaluation of the careers and enterprise programme.”
User data is retained for as long as users have a Compass+ account. Compass+ accounts are created and kept up to date by the Compass+ Administrator(s) in a school. It is the responsibility of the school to ensure that Compass+ accounts are removed when a user no longer needs access, for example when they leave the school.
Business contact data for careers partners is added to the careers partners database by Compass+ users within the school. It is the responsibility of the school to keep this data up to date.
How do I know my Compass+ data will be safe?
The following safeguards are in place to protect a school’s data within Compass+.
- Only the minimum data required to provide the service to a school will be stored
- No data is stored or transported outside of the UK or outside of EEA countries which are granted to have Adequate Levels of Protection as defined by the European Commission.
- No personal data originating from a school will be transported in an unencrypted format
- Personal data originating from a school will be transported and stored using modern and best practice encryption technologies. This includes Secure Socket Layers (SSL/TLS) for encrypted data transfer over the internet, encryption of all data at rest, field-level encryption for personally identifiable data and password protected identities for all end users
- No data will be shared with any third parties except where explicitly requested by a school or required by law.
- No data made available via Assembly/Groupcall will be used for the purposes of advertising or marketing, or for any purpose other than the service explicitly provided to a school
- All CEC and Assembly/Groupcall staff having access to personal data hold a valid Disclosure and Barring Service certificate.
Where is my Compass+ data stored?
All Compass+ data is stored in a secure database, hosted on Amazon Web Services cloud-based servers in the EU.
Will you be sharing my Compass+ data with anyone?
Yes. There are three types of data are used in Compass+, they are student data, user data and partner data. Let’s look at how each of these is shared:
Student data:
To deliver the Compass+ service to a school, student personal data is shared with these organisations for the following purposes:
- The school (joint data controllers) using Compass+. Much of the data shared with the school in Compass+ is student data which originates from the school’s Management Information System (MIS). The school controls the access to the data and only data authorised by the school is shared with Compass+. In addition, users of Compass+ in the school can add data relating to careers provision to individual student records. This data is only accessible to the school via Compass+ and is not shared back to the school’s MIS.
- CEC’s cloud-based server partner (data processor), a provider of cloud hosting services. CEC applications used for processing student data are hosted on servers in the EU.
- CEC’s software development partner (data processor), specialising in school MIS integration who develops and maintains Compass+ and the databases which support it.
- Assembly/Groupcall (data processor), is contracted by CEC and by the school to extract data from the school’s MIS for the purposes of sharing with third party applications such as Compass+. Compass+ does not share any data back to Assembly/Groupcall
CEC also uses third-party platforms to manage the reporting of issues experienced by Compass+ users. Personally identifiable data may be added to these platforms by customers, customer service staff or developers to support the identification and resolution of these issues. Any student data and careers partner contact data is removed from the third party systems once the issue is resolved. These platforms are:
- CEC’s customer service desk ticketing system – software to manage the reporting and communications with users regarding their issue
- CEC’s development team ticketing systems – software to manage the reporting and communications with technical staff at CEC’s software development partner regarding issues
User data:
In the delivery of the Compass+ service, CEC uses third party systems to process user data relating to the use of the service to obtain user statistics and insights to analyse and better understand usage of the tool to improve the service.
Partner data:
Business contact data about a school’s careers partners is also held in Compass+ for their school’s Compass+ users.
Other articles you may find helpful:
- Why upgrade to Compass+
- How to upgrade to Compass+
- How we use your data in Compass+
- Training & support