# How does Varsio protect student data?

URL: https://varsio.co.uk/answers/how-does-varsio-protect-student-data
Updated: 2026-11-11

Answers

# How does Varsio protect student data?

Shacksolutions is Cyber Essentials certified and registered with the ICO, and our data processing agreement carries the term "Never trained on student data." Before launch we will host student data in the UK, commission an independent penetration test and give your data protection officer a DPIA pack.

Published 11 November 2026 2 min read

## In place today

- **Cyber Essentials certified.** The certificate is public, number 3dc96ad7-519d-48a3-9d98-77cc96f8ff34. The NCSC calls Cyber Essentials “the minimum standard of cyber security recommended by the Government”, and it covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Ours is Cyber Essentials, not Cyber Essentials Plus, which adds an independent test of the systems. Under PPN 014, suppliers must recertify every 12 months.
- **Registered with the ICO,** registration ZC251198. That means Shacksolutions pays the data protection fee and appears on the ICO’s register of fee payers; it is a legal duty, not a certification.
- **A UK company,** registered in England and Wales, number 13337279.
- **A team that has launched a campus app before,** as [the case study](https://varsio.co.uk/answers/rhul-mobile-case-study) describes.

## In your contract

- **“Never trained on student data.”** This is a term in our data processing agreement.
- A contract template.
- A list of every supplier that handles student data.
- Your data back at the end, and a written exit plan.

## Before launch

- UK hosting for student data.
- An independent penetration test.
- A DPIA pack for your data protection officer.
- A privacy page in the app.
- The app built to WCAG 2.2 AA and tested with VoiceOver and TalkBack.

## Where student data lives

We will host student data in the UK. Any supplier that handles it elsewhere will be named in our sub-processor list. On your instruction we will delete it within 30 days, backups included, and at contract end we will return or delete it.

Read rates are reported by year, course and hall without names, and no group under 10 is reported, so the figures describe groups, not individual students.

## What your data protection officer will check

The ICO’s guidance gives the list. A contract with a processor must set out the subject matter and duration of the processing, its nature and purpose, the types of personal data and the people they relate to, and your rights and obligations as controller. It must also cover processing only on your documented instructions, confidentiality, security, sub-processors, helping you with people’s rights, helping you meet your own obligations (such as security, breach notification and DPIAs), what happens at the end of the contract, and audits.

The ICO also says a DPIA is required where processing uses innovative technology, AI included, combined with at least one other high-risk criterion from the European guidelines, and recommends one “if in any doubt”. An app with an AI assistant for students is likely to meet that test. Our DPIA pack, ready before launch, will help your data protection officer with it.

## This website

This site, varsio.co.uk, sets no cookies and uses no analytics or advertising trackers. The [privacy notice](https://varsio.co.uk/privacy) covers what the demo form collects.

## Sources

1. [Shacksolutions' Cyber Essentials certificate](https://registry.blockmarktech.com/certificates/3dc96ad7-519d-48a3-9d98-77cc96f8ff34/), IASME, through BlockMark. Read 11 November 2026.
2. [Cyber Essentials overview](https://www.ncsc.gov.uk/cyberessentials/overview), National Cyber Security Centre. Read 11 November 2026.
3. [PPN 014: Cyber Essentials scheme](https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html), Cabinet Office, GOV.UK. Read 11 November 2026.
4. [Register of fee payers](https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/), Information Commissioner's Office. Read 11 November 2026.
5. [What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), Information Commissioner's Office. Read 11 November 2026.
6. [When do we need to do a DPIA?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/), Information Commissioner's Office. Read 11 November 2026.