DPIA support document
Wonde – Support Document
School data & information security overview
This document is maintained by Wonde’s Information Security Compliance team, and reflects the current information security and management procedures, controls, policies and practices across the company. It aims to clarify Wonde’s position in the data processing chain and answer frequently asked questions around how schools, Wonde and third party edtech applications (“Apps”) interact.
Company overview
| Controller Name | Wonde Limited |
|---|---|
| ICO Registration Number | ZB504536 |
| Head of Information Security | Gemma Stannard |
| Data Protection Manager | David King |
| Data Protection email | [email protected] |
Wonde Data Protection and Information Security key information
Here you’ll find further information about Wonde, including general information, the purpose of the Wonde application and how Wonde manages data subject rights.
Section 1: General details about Wonde
1. What is Wonde’s registered name, as listed on Companies House?
Wonde Limited
2. What type of organisation is Wonde?
Private limited company
3. What is Wonde’s registration number?
14160647
4. What is Wonde’s registered address?
Furlong House, 2 Kings Court, Newmarket, Suffolk, England, CB8 7SG
5. What is Wonde’s main activity?
Software development
6. What is Wonde’s website address?
7. What are the addresses of Wonde’s other offices?
Level 14, 5 Martin Place, Sydney, 2000 NSW, Australia
Tremough Innovation Centre, Tremough Campus, Penryn, Cornwall TR10 9TA
8. In which year was Wonde incorporated?
2013
Section 2: Contact details
These are the ways that customers can Wonde.
1. General enquiries email address
2. Customer support email address
3. Telephone numbers
01638 438094
4. Hours when customer support is available
Monday to Friday 8.30am to 5.30pm
5. What is the name of the individual that is responsible for data protection?
David King
6. What is their job title?
Data Protection Manager
7. What is the email address for data security enquiries?
8. What is the telephone number for data security enquiries?
01638 438094
Section 3: Accountability
1. Data processing agreement
This can be found on our website, and is located here
2. School contract
An example of our school licence terms and conditions can be provided on request.
3. A data map or similar
This can be provided on request.
4. A privacy notice or policy for customers
Link to Privacy Notice document
5. A data protection policy
We have an internal Data Protection Policy, which can be provided on request.
6. An information security policy, or similar
Held as part of our ISO 27001 certified Information Security Management System (ISMS), can be provided on request.
7. A working from home data security policy for staff
As part of our ISO 27001 certified ISMS, we have a remote working policy which can be provided on request.
8. A bring your own device policy for staff
N/A
9. A breach response process
Our data breach responsibilities are documented in our Data Processing Agreement. Additionally we have an internal data incident response policy which is reviewed annually.
10. A documented password policy that guides all users of the external service
User passwords are marked based on how easy a password is to guess, no explicit policy is provided to users.
11. A business continuity plan as it refers to the apps in question
Our business continuity plan is held as part of our ISO 27001 certified ISMS and can be provided if required.
12. Do the privacy notice and data protection policy reflect the UK GDPR and Data Protection Act 2018?
Yes
13. How regularly are our policies reviewed?
Annually at minimum
14. What is our Information Commissioner’s Office registration number?
ZA118834
15. What is the contact email for any policy queries from customers?
[email protected] or https://www.wonde.com/contact/
16. In our SLA, what is Wonde’s guaranteed uptime?
99.5%
17. How regularly do staff receive data protection training?
On induction and then annually, applies to all staff
18. How regularly do staff receive cyber security training?
On induction and then annually, applies to all staff
Section 4: Accreditations
1. Cyber Essentials
14/12/2023
2. Cyber Essentials Plus
31/01/2024
3. Does your Cyber Essentials accreditation cover the whole organisation?
Yes, the whole organisation
4. ISO27001
Yes
5. SOC 2 Type ll Certification
No
6. PCI DSS
Not applicable for Wonde
Section 5: About your software application
1. Application product name
Wonde API
2. Give an overview of Wonde’s app and describe what it is designed to do
Wonde’s innovative portal has been designed and built to integrate seamlessly with a school MIS, ensuring your data is securely maintained, managed and accessible. A single, simple to use portal enables you to access and control all of your apps.
3. Was the app built to be used by schools?
Yes
4. How is this app designed to support schools, what impact is it designed to have? For example, to improve attendance, to raise standards in maths
Improvements in the administration of software and the accuracy of the data it holds
5. Is the app sold directly to consumers, for example, parents or only to schools?
Only schools can buy the app
6. Does the app access personal data?
Yes
7. Does the app access this data from the MIS?
Yes
8. Which special category data does the app access?
This is defined by the third party app accessing the data, and approved, where required, by the school.
9. Does consent need to be sought from the parent, child or other user to use the app?
No
Wonde acts as a data processor for schools and so does not need to seek the consent of data subjects. As the data controller, the school will need to make sure they have a lawful basis in place to authorise any processing of the data.
10. Does the app collect any additional personal data in addition to what is accessed from the MIS? If yes, what data does it collect?
No
Wonde accesses the data as requested by the third party app and is approved by the school prior to any processing.
11. Which groups of people in school mainly use this app? Such as, parents, teachers, pupils, support staff
Support staff and senior leaders
12. If pupils use the app, which age group is it intended for?
They don’t use the app supplied by Wonde.
13. Which groups of data subject’s data is collected by your software?
We do not define which data subjects’ data is accessed, this is set by the app we are connecting to the MIS and approved by the school.
14. How many data subjects’ data is processed by the app?
Wonde will add this based on the specific school’s numbers.
15. What data categories does the software access?
We do not define the data categories, these are requested by the app we are connecting to the MIS and approved by the school.
16. Add why and how each data category is accessed by the software?
This is defined by the third party app and is approved by the school
17. Is any data collected that isn’t required for the functionality of the app?
No
18. Why is data collected that isn’t required by the app?
Upon installation, Wonde will request access to a range of data sets that are required for the majority of apps. Once approved, Wonde will have access to these data sets, but cannot extract the data until a live and approved connection with an app is established. The school has full control of this process inside the Wonde school portal. Only data that is requested by a school’s approved apps, and subsequently approved by the school, is extracted.
19. Does this app meet the ICO’s Children’s Code 2021?
This app doesn’t need to meet the code
20. Is the app developed by your organisation or by an external company?
We develop the app ourselves
21. In which country is the app developed?
Wonde was developed in the United Kingdom. Some post development support is handled by our team based in Manilla, who have no access to customers’ personal data.
22. Is test data used in software development?
Yes
Section 6: Data protection
1. Does anyone with access to customer data undergo employment screening, for example criminal history checks (DBS)? If yes, which groups?
Yes
Access to customer data is highly restricted. However, all employees undergo employment screening and are DBS checked on joining Wonde.
2. In which country does Wonde store customer data?
Within the EEA
3. List all cloud services that are provided by a third party and used by Wonde;
Wonde has a list of sub-processors located at https://www.wonde.com/security/subprocessors/
4. Do any of your third party suppliers and subcontractors have access to customers’ data?
Yes
5. Are links to third party privacy notices available to customers? If yes, how do they access these?
No
6. Is there an incident response plan for third party suppliers?
Yes
7. How long does Wonde retain customer data for?
More information on our retention period can be found in our Data Processing Agreement.
8. Is customer data retained for research or testing purposes?
No
9. Is any customer data used for advertising or targeting purposes, either directly or via third parties?
No
10. Are all of Wonde service’s web servers secured with digital certificates signed by a reputable trusted authority?
Yes
Yes, AWS (Amazon Web Services) computing environments are continuously audited, with certifications from accreditation bodies across the world, including ISO 27001, FedRAMP, DoD CSM, and PCI DSS. Wonde requires that all API calls are authenticated with a secure API token and transmitted on a secure SSL connection.Additionally, backups are all managed and stored in AWS and are encrypted at rest. The system maintains an automated 17 day back-up policy, where Wonde can restore the database to any point in time within that time window.
11. If customer data traverses public or unprotected networks, is it protected by strong encryption?
Yes
12. Is customer data encrypted at rest?
Yes
13. Are backups encrypted?
Yes
14. Are portable devices, such as laptops and mobile phones, encrypted?
Yes
15. Does this app allow users from one school to find, access or discover users from another school, or organisation, including when logging in or signing up?
No
16. Do you have in place security measures to prevent brute force type password guessing attacks? For example, account lockouts or captcha forms
Yes
17. Is there an approval process before accounts are created for staff? Please describe the process
Yes
18. Do all user and administrator accounts have a unique username and password?
Yes
19. Is there a process for removing staff accounts when they are no longer needed?
Yes
20. Are staff account privileges role based?
Yes
Data subjects rights
1. The right of rectification – How can data subjects request for their data to be corrected?
Wonde acts as a processor and will use the most up-to-date data provided by the school. As such, the school is the controller and responsible for ensuring the data provided to Wonde is accurate.
2. The right to erasure – How can data subjects request for their data to be deleted?
Removing data at a school level will cause this data to be removed for Wonde. Wonde will refer individuals to the data controller to complete this process.
3. The right to restrict processing – How can data subjects request that their data isn’t processed?
Wonde provides schools the ability to block specific individual data sets on the Wonde portal.
4. The right to be informed – How do you inform data subjects that their data is being shared?
Schools should inform data subjects that data is shared with third party apps.
5. The right of access – How do data subjects request a copy of their data?
Data subjects should contact the school in the first instance as the school remains the data controller. If a data subject contacts Wonde directly, where we are acting as a processor, we will contact the school to inform them of the request.
Individual data is identifiable and all records can be viewed within admin portals.
6. The right to data portability – Can data be extracted to be used elsewhere?
Data can be extracted in the form of a CSV file to be used elsewhere.
7. The right to object – How do data subjects object to their data being processed in the app?
At the request of the school, or the data subject via the school, Wonde can block an individual’s data from being processed.
Section 7: Network security
This section explores how secure your network is and the software it runs
1. How often does Wonde conduct vulnerability scans on your network?
More frequently than annually
2. Does Wonde have firewalls at the boundaries between your organisation’s internal networks, laptops, desktops, servers and the internet?
Yes
3. Are default passwords always changed on devices such as internet routers or hardware firewall devices?
Yes
4. Are all high-risk or critical security updates for operating systems and firmware installed within 14 days of release?
Yes
Section 8: Risk Management
1. What possible risks could this processing lead to for the data subjects?
Accidental or unlawful destruction, unauthorised disclosure and unauthorised access
2. Does Wonde have a risk assessment strategy that is established and in practice?
Yes
3. Does Wonde maintain an information security asset register?
Yes
4. Is the asset register checked at least annually for accuracy?
Yes
5. Is risk assessment conducted at least annually?
Yes
6. Does Wonde conduct regular reviews of the physical security environment of the business premises and associated physical security risks?
Yes