Terms & Conditions

The Headteacher’s Report – Terms and Conditions (Online Services)

Last updated: 3rd October 2026
These Terms and Conditions (“Terms”) apply to access to and use of:

  • https://www.theheadteachersreport.com

  • https://app.theheadteachersreport.com
    (together, the “Platform”).

These Terms are made in conjunction with (and incorporate by reference) our Privacy Notice and Service Description (together, the “Policies”). If there is any conflict, these Terms will prevail for contractual matters.

By placing an order, accessing, or using the Services, you agree to be bound by these Terms.

1. Definitions

“Affiliate” means any entity controlling, controlled by, or under common control with a party.
“AI Provider” means OpenAI (or any replacement provider notified under Schedule 2).
“Authorised Users” means your employees, governors, contractors and agents permitted to use the Services under your account.
“Business Day” means a day other than Saturday, Sunday, or a public holiday in England.
“Controller, Processor, Personal Data, Special Category Data” have the meanings given in UK GDPR.
“Customer Data” means any data, content, files, documents, text, or information submitted to the Services by you or on your behalf, including any outputs generated from such inputs.
“Documentation” means any user guides or help materials we make available.
“Fees” means the subscription fees set out in the Order Form or invoice.
“Initial Term” means the initial subscription period stated in the Order Form (typically 12 months).
“Order Form” means the order, quotation, sales order, or online checkout confirmation (as applicable) specifying Services, Fees and term.
“Services” means the subscription services described in the Service Description and provided via the Platform.
“Subscription Term” means the Initial Term plus any Renewal Terms.
“Renewal Term” means each successive 12-month renewal period unless ended under clause 13.
“UK GDPR” means the UK General Data Protection Regulation as supplemented by the Data Protection Act 2018.

2. Who We Are

The Headteacher’s Report Limited (“we”, “us”, “our”) is a company registered in England and Wales.
Registered office: 3000 Aviator Way, Manchester Business Park, Manchester, M22 5TG.
Company number: 09326818
Contact: [email protected]

3. Eligibility and Authority

3.1 You confirm you are entering into these Terms as a business customer (e.g., a school, academy trust, diocese, local authority, or supplier organisation) and that you have authority to bind your organisation.
3.2 You are responsible for ensuring Authorised Users comply with these Terms.

4. Account Security

4.1 You must keep login credentials secure and ensure only Authorised Users access the Services.
4.2 You must notify us promptly of any suspected unauthorised access or security incident relating to your account.
4.3 We may suspend access to protect the Services or Customer Data if we reasonably suspect unauthorised access or misuse.

5. Licence and Acceptable Use

5.1 Licence. During the Subscription Term, we grant you a non-exclusive, non-transferable right to access and use the Services and Documentation for your internal purposes.
5.2 Restrictions. You must not (and must not allow others to):
(a) reverse engineer, decompile, or attempt to discover source code (except as permitted by law);
(b) copy, modify or create derivative works of the Services (except as enabled within the Services);
(c) use the Services to develop a competing product;
(d) resell, rent, lease, or provide the Services to third parties as a bureau service;
(e) upload malware, attempt to disrupt the Services, or bypass security;
(f) submit unlawful, infringing, defamatory, or harmful content.

6. Service Availability and Support

6.1 We will use commercially reasonable efforts to make the Services available 24/7, excluding planned maintenance and circumstances beyond our reasonable control.
6.2 Support is provided in accordance with our support approach described in the Service Description (and may be updated reasonably from time to time).

7. Customer Data and Content Licence

7.1 Ownership. You own Customer Data. We own the Services and all related intellectual property.
7.2 Limited licence to provide Services. You grant us a non-exclusive, royalty-free licence to host, copy, transmit, process and display Customer Data only as necessary to provide, maintain, secure and support the Services, and to comply with legal obligations.
7.3 Your responsibilities. You are responsible for the legality, reliability, integrity, accuracy and quality of Customer Data and for ensuring you have all required rights and lawful basis to provide Customer Data to us.

8. AI-Assisted Drafting

8.1 The Services may include AI features that generate suggested draft text based on information submitted through the Platform.
8.2 Human review required. AI outputs are suggestions only and may be incomplete, inaccurate, or inappropriate. You are responsible for reviewing, editing and verifying outputs before use or publication.
8.3 Data minimisation. You agree not to submit directly identifiable pupil data (e.g., names, DOB, addresses, UPNs) to AI features and to avoid submitting Special Category Data unless strictly necessary and lawful.
8.4 Provider. AI features are provided via the AI Provider acting as a sub-processor (see Schedule 2).
8.5 No automated decision-making. The Services do not make automated decisions about individuals.

9. Integrations (including MIS)

9.1 Where you connect third-party systems (e.g., MIS via Wonde), you authorise us to access and process the data made available through that integration in accordance with these Terms and Schedule 1.
9.2 You acknowledge that availability of integrations depends on third parties and may change. We will use reasonable efforts to maintain key integrations but cannot guarantee third-party continuity.

10. Fees and Payment

10.1 Fees are payable per school / per organisation as stated in the Order Form.
10.2 Invoices are payable within 30 days unless otherwise stated.
10.3 We may suspend access for overdue amounts after giving reasonable notice.
10.4 Fees exclude VAT (added where applicable).
10.5 We may increase Fees for a Renewal Term by giving at least 90 days’ notice prior to renewal.

11. Confidentiality

11.1 Each party must protect the other’s Confidential Information and use it only to perform obligations under these Terms.
11.2 Confidential Information excludes information that is public, independently developed, already known lawfully, or required to be disclosed by law.
11.3 Customer Data is your Confidential Information.

12. Data Protection

12.1 Where we process Personal Data on your behalf in providing the Services, you are the Controller and we are the Processor, and Schedule 1 applies.
12.2 Each party will comply with applicable data protection laws.
12.3 Our Privacy Notice applies where we act as Controller for our own business purposes (e.g., account administration, billing contacts, marketing).

13. Term, Renewal, and Termination

13.1 Term. The Subscription Term begins on the Effective Date in the Order Form and continues for the Initial Term.
13.2 Auto-renewal. The Subscription Term renews automatically for 12 months unless either party gives written notice at least 90 days before the end of the then-current term.
13.3 Termination for cause. Either party may terminate for material breach not remedied within 30 days of written notice.
13.4 Suspension. We may suspend access if necessary to protect the Services, for non-payment, or for misuse. Suspension does not waive payment obligations.

14. Export, Return and Deletion of Customer Data

14.1 Export during term. You can export/download your reports and available Customer Data from the Platform during the Subscription Term.
14.2 Post-termination retrieval. Following termination or expiry, we will provide a reasonable opportunity (typically 30 days) to retrieve Customer Data using the export tools or by reasonable written request, subject to payment of outstanding Fees.
14.3 Deletion. After the retrieval period, we will delete or anonymise Customer Data in accordance with our retention/deletion approach, except where we must retain it to comply with law or for legitimate dispute/security purposes (then deleted as soon as no longer required).
14.4 Backups. Customer Data may persist in encrypted backups for a limited period until backup rotation.

15. Intellectual Property

15.1 We retain all rights in the Services, Documentation, branding, and underlying technology.
15.2 You retain all rights in Customer Data.
15.3 Outputs. To the extent permitted by law, you own the AI-generated outputs produced from your inputs (as part of Customer Data). We do not claim ownership of your outputs.

16. Warranties and Disclaimers

16.1 Each party warrants it has authority to enter into these Terms.
16.2 Except as stated in these Terms, the Services are provided “as is” and we exclude all implied warranties to the extent permitted by law.
16.3 We do not warrant that AI outputs will be accurate or fit for a particular purpose.

17. Limitation of Liability

17.1 Nothing in these Terms limits liability for death/personal injury caused by negligence, fraud, or any liability that cannot legally be excluded.
17.2 Subject to 17.1, we will not be liable for indirect or consequential losses, loss of profits, loss of business, loss of goodwill, or loss of anticipated savings.
17.3 Subject to 17.1, our total aggregate liability arising out of or relating to these Terms in any 12-month period will not exceed the Fees paid by you in that 12-month period.

18. Force Majeure

Neither party will be liable for failure or delay caused by events beyond reasonable control (including major outages, disasters, or third-party infrastructure failures). The affected party will notify the other and resume performance as soon as reasonably practicable.

19. Changes to the Services or Terms

19.1 We may update the Services to improve performance, security, compliance, or functionality.
19.2 We may update these Terms from time to time. Material changes will be notified via the Platform or email. Continued use after the effective date constitutes acceptance.

20. Customer Logo and Case Studies

We may only use your organisation’s name and logo as a customer reference with your prior written consent (email sufficient). You may withdraw consent at any time.

21. Communications

Notices under these Terms must be in writing and sent to the email or postal addresses set out in the Order Form (or later updated by notice). Service notices may be provided via the Platform.

22. General

22.1 Assignment. We may assign these Terms as part of a merger, acquisition, or sale of assets. You may not assign without our written consent.
22.2 Third-party rights. No third party has rights to enforce these Terms.
22.3 Severability. If any provision is invalid, the rest remains effective.
22.4 Governing law. English law governs these Terms and courts of England and Wales have exclusive jurisdiction.

Schedule 1 — Data Processing Addendum (UK GDPR Article 28)

A. Scope and Roles

  1. Controller/Processor. You are the Controller. We are the Processor for Personal Data processed on your behalf as part of the Services.

  2. Subject matter. Provision of the Services (report drafting, self-evaluation tools, policy/compliance drafting, integrations, AI-assisted drafting).

  3. Duration. For the Subscription Term plus any limited post-termination retention in clause 14.

B. Processing Details

  1. Nature of processing. Collection, storage, structuring, retrieval, consultation, use, transmission (including to authorised sub-processors), and deletion of Personal Data.

  2. Purpose. To provide, secure, maintain and support the Services and related support/incident handling.

  3. Categories of Data Subjects. Staff users (including headteachers/governors), and data subjects referenced in Customer Data (typically pupils/staff in aggregated form).

  4. Types of Personal Data. Account and contact data; school contextual and statistical data; content entered into the Platform. (You have stated you do not request directly identifiable pupil data via MIS integrations; you will instruct users not to enter it into AI features.)

C. Processor Obligations

  1. We will:

    • (a) process Personal Data only on your documented instructions (including these Terms);

    • (b) ensure personnel with access are bound by confidentiality;

    • (c) implement appropriate technical and organisational measures (see Schedule 3);

    • (d) respect conditions for engaging sub-processors (Section D);

    • (e) assist you with responding to data subject rights requests, taking into account the nature of processing;

    • (f) assist you with security, breach notifications, DPIAs and prior consultation where reasonably required and proportionate;

    • (g) at end of Services, delete or return Personal Data in accordance with clause 14;

    • (h) make available information reasonably necessary to demonstrate compliance with this Schedule.

D. Sub-processors

  1. You authorise the sub-processors listed in Schedule 2.

  2. We will notify you of any intended material changes to sub-processors (addition/replacement) and, where reasonably practicable, provide an opportunity to object on reasonable grounds related to data protection. If you object and we cannot reasonably resolve it, either party may terminate the affected Services.

E. International Transfers

  1. Where processing involves transfers outside the UK, we will ensure appropriate safeguards (e.g., UK IDTA / UK Addendum) are in place.

F. Security Incidents and Breach Notification

  1. We will notify you without undue delay after becoming aware of a Personal Data Breach relating to Personal Data processed under this Schedule and provide information reasonably required to support your compliance.

G. Audit and Compliance

  1. On reasonable notice, we will provide information and responses sufficient for you to verify compliance (e.g., security summaries, sub-processor list, policy statements). Any on-site audit will be subject to reasonable limits to protect confidentiality and security and may be satisfied by independent reports where available.

Schedule 2 — Sub-Processors

We use the following sub-processors (or equivalent replacements notified under Schedule 1):

Sub-processor Purpose Typical location
Wonde MIS integration UK
Linode Hosting / infrastructure UK
Google Workspace Business operations, support, backups (as applicable) UK/EU/US
Mailchimp Email communications (newsletters/updates) US
OpenAI (ChatGPT API) AI-assisted drafting US

(You may add other suppliers used for analytics/support — but keep this list accurate.)

Schedule 3 — Security Measures

We maintain appropriate technical and organisational measures, including:

  • TLS/HTTPS encryption for data in transit

  • Encrypted backups and controlled backup access

  • Access controls and least-privilege permissions

  • Strong authentication controls for admin access

  • Secure API authentication and key management

  • Network protections (firewalls and monitoring)

  • Logging and alerting for security events (where applicable)

  • Organisational measures: confidentiality obligations, restricted access, security incident handling procedures