Legal

Privacy Policy

Last updated: 30 April 2026

School Spend is built on a simple principle: your school’s financial data belongs to your school. We’ve designed the product so that we genuinely cannot access it, even if we wanted to. This policy explains exactly how that works.

Who we are

School Spend is a software product operated by School Spend Ltd. We provide a purchase order management and financial control system for UK schools, built to run inside Microsoft 365. Our contact email is hello@schoolspend.co.uk.

What data we collect

We collect the minimum possible. Here’s what we hold:

Contact information you provide when booking a demo or contacting us — name, school name, email address and phone number.
Usage data from our website — standard analytics (pages visited, browser type, approximate location) via cookies. No personal information is attached to this.

What we do not collect: We do not collect, store or have access to any of your school’s financial data — purchase orders, invoices, budgets, staff information, or audit logs. All of that data lives exclusively in your school’s Microsoft 365 tenancy.

Where your school’s data lives

The School Spend application runs entirely inside your school’s Microsoft 365 environment. All data created in the system is stored in your school’s SharePoint, under your school’s Microsoft data residency and governance settings.

School Spend has no servers that receive, process or store your financial data. We have no database containing your school’s records. This is by design, not by accident.

Your existing Microsoft Data Processing Agreement covers all data created in the application. You do not need a separate DPA with School Spend for the operation of the software.

Authentication and access

Users sign in using their existing Microsoft 365 school accounts via Microsoft Entra ID (formerly Azure Active Directory). We do not store passwords or authentication tokens. Access control is managed entirely through Microsoft’s identity platform.

Your IT administrator controls who can access the system by managing your school’s Microsoft 365 accounts — the same way they control access to any other M365 application.

Cookies

Our website (schoolspend.co.uk) uses cookies for:

Essential cookies — required for the website to function correctly.
Analytics cookies — anonymous data to understand how visitors use our website. No personal information is collected or shared with third parties for advertising purposes.

You can disable cookies in your browser settings at any time.

How we use your contact information

If you contact us or book a demo, we use your details to:

Respond to your enquiry or arrange your demo
Send you information about School Spend that you’ve requested
Provide onboarding and support once you become a customer

We do not sell your data. We do not share it with third parties for marketing purposes. We will never add you to a mailing list without your explicit consent.

Data retention

We retain contact information for as long as necessary to manage our relationship with you. If you ask us to delete your data, we will do so promptly. Email hello@schoolspend.co.uk to make a deletion request.

Your rights under UK GDPR

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Object to processing of your data
Lodge a complaint with the ICO (ico.org.uk)

To exercise any of these rights, contact us at hello@schoolspend.co.uk.

Changes to this policy

We may update this policy from time to time. Any significant changes will be communicated to existing customers by email. The date at the top of this page will always reflect when it was last updated.

Questions about privacy?

We’re happy to talk through any data or compliance questions — especially around how School Spend works within your Microsoft 365 environment. Email us at hello@schoolspend.co.uk