For teachers and school staff — how WholeRecord uses your words
Public notice · WholeRecord · v1.0 · Last updated: 19 August 2026
What this page is for
WholeRecord is a tool that reads a person’s own childhood school reports and gives them a written summary of the patterns across those reports. People upload their own reports (or, for a 14–17-year-old, a parent does, with the young person’s agreement).
Those reports contain things you wrote — your comments about a pupil. We receive your words only because they appear in a school report uploaded by the pupil, former pupil, or parent/guardian. We do not receive them from schools and we do not collect them directly from teachers. This page explains, plainly, what WholeRecord does and does not do with your words, and how to reach us.
What WholeRecord does with your words
- It reads the words in the report the person uploaded — which includes your written comments — to produce a summary for that person about their own school record.
- It looks for patterns across years and across different reports. Your comment is read as one of those observations.
What WholeRecord does not do
- We don’t ask for your name or build a record of who you are. The tool has no “teacher” field, and it never lifts a name out of a report to identify you. It notes only, in a rough structural way, that comments came from different sources (for example, a different subject or a different report) — it never works out which teacher wrote anything.
- We don’t single you out, score you, judge you, or build any profile of you. You are not the subject of the summary — the person who uploaded their records is.
- We don’t keep your words or the report afterwards. They’re used to make the summary and then discarded — we don’t store them, and we don’t use them to train any AI. (We keep only the few basic business and consent records needed to run the service — none of them about you.)
- We never add a teacher’s name to a quote. The tool never writes “[your name] said…” and never labels a comment with who wrote it — where your words are quoted, they appear simply as a quote from the person’s own report.
- We don’t make any automated decision about you. The summary is information for the person who uploaded their records to read and decide on — it decides nothing about you.
One honest point: if your name happens to be written inside a sentence in the report (for example, “Mrs Smith says…”), we don’t rewrite the pupil’s report, so on the rare occasion your words are quoted — whether the exact sentence or a short passage our system reproduces — your name stays inside the quote, exactly as it was written in the report. That’s text the person who uploaded already has in their own report; WholeRecord doesn’t create any new record of who you are.
What the person receives — and may keep
The person who uploaded the report receives the written summary and may keep it (for example, as a PDF). Because that summary can contain short, exact quotes from their own reports, we include a note on every reading asking them to consider other people’s privacy — including school staff — before sharing it, and pointing teachers and school staff to this page.
Our legal basis
Our legal reason for reading the words in these reports is what the law calls “legitimate interests” — our genuine interest in running WholeRecord so that a person can understand their own school record. Your comment is an unavoidable part of the report that person uploads about themselves, so we rely on this basis for the brief, small processing of your words. We have weighed our interest against your rights and freedoms in a formal assessment (a Legitimate Interests Assessment) and concluded it is fair — largely because we don’t build any record of who you are, we don’t keep your words or the report afterwards, and we never make you the subject of anything. You can ask us about that assessment at the address below.
Why we can do this without writing to you individually
Data-protection law normally asks us to tell people directly when we use information about them. It also recognises that direct notice is not always possible or proportionate. In those cases, the law allows us to make the information publicly available instead and provide a way to contact us.
We rely on that route here. We do not collect or keep teachers’ contact details. To contact teachers individually, we would have to extract names from old reports, infer or trace the schools, and try to find current contact details — and that would mean collecting and using more information about teachers than the product itself needs. There may also be many teachers across one person’s school records, and the processing of any one teacher comment is brief, limited, and not about the teacher.
So, instead of writing to each teacher individually, we publish this page and provide the contact route below.
Where this happens, and who handles it
The report text is handled only by our cloud-hosting provider and our AI-inference provider, both under contract. We do not share report content with schools, employers, teachers, advertisers, or data brokers. Your reports are read for AI inference in the EU/EEA and are not sent outside Europe for that reading or for storage. The website and request handling run on a global hosting network, through which the report text passes only momentarily, in memory, while your reading is produced — it is never stored there. Nothing from the reports is kept afterwards: your words exist in the system only for the few moments it takes to produce one person’s summary, and are then gone. (These providers are named, and any UK/EU transfer details and safeguards set out, in our privacy notice.)
Your rights — how to reach us
You can contact us at any time at privacy@thewholerecord.com. Because we read your comments on the basis of legitimate interests, you have the right to object to this processing at any time — just email us and tell us. One honest limit: because we keep no record of who teachers are and build no index of teachers, we may not be able to find or block your comments in future uploads unless you can give us enough information to identify them; we will always tell you what we can and cannot do.
You can also ask us to confirm whether we hold any personal data about you, to see it, to correct it, to delete it, to restrict how it’s used, or to object to the processing. Some of these may have little to act on in practice, because we do not retain report content or build any record that identifies you — so there is normally nothing held about you to access or delete.
If you contact us, we will keep your email and our reply normally for about 60 days, then delete them — the same period as in our main privacy notice — unless a legal reason requires us to keep them longer, or your message is a rights request or complaint, in which case we keep a short record of the request and how we handled it as an accountability record. That is the one situation in which we hold information about you — and only because you got in touch.
We’ll respond within one month. You don’t need an account, and you don’t need to have used WholeRecord. The fuller explanation of all these rights is in our privacy notice.
You also have the right to lodge a complaint with a data-protection supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in Spain, the Agencia Española de Protección de Datos (aepd.es). If you are in Ireland, you can also contact the Data Protection Commission (dataprotection.ie). We’d appreciate the chance to help first, but you can go to them directly.
Who we are
WholeRecord is run by Joseph Griffiths (sole trader), based in Spain. Contact: privacy@thewholerecord.com.
Our representative in the UK — a contact point for people in the UK — is [UK representative name and contact details — to be named before launch].