GDPR documentation

Echo is a staff wellbeing service operated by Expert Voice Ltd (trading as Echo), a company registered in England & Wales with company number 16790518.

Our UK Privacy Lead can be contacted at dpo@teachecho.co.uk. Registration with the Information Commissioner's Office (ICO) is in progress.

When a school or Multi-Academy Trust (MAT) uses Echo to collect wellbeing data from its own staff, the school/MAT is the Data Controller and Echo acts as a Data Processor on its behalf. Our processing of that data is governed by our Data Processing Terms.

When you visit our public website, create an account, or contact us directly, Echo is the Controller for that data and this Privacy Policy applies.

Account data

• Email address (used to sign in and receive survey invitations).
• Display name and job title (optional, set by you in your profile).
• School or trust you belong to (assigned by a sysadmin or trust administrator — staff cannot self-assign).
• Role within Echo (teacher, school administrator, MAT administrator or sysadmin).

Survey responses

• Numeric scale answers (1–5) to monthly wellbeing questions, displayed on a 0–10 index.
• Optional free-text comments and 'shout-out' recognition messages.
• Survey submissions are stored without staff identifiers — Echo does not record which member of staff submitted which response.
• Only aggregated results (with a minimum response threshold) are visible to school and trust leaders.

Technical data

• Authentication session token, stored in your browser's local storage.
• Standard server logs (IP address, user-agent, request path, timestamp) retained for up to 30 days for security and debugging.

Echo's production database, authentication system and application logic run on infrastructure located in the European Union (Ireland/Frankfurt). We do not transfer staff survey data outside the UK or EEA for storage.

A limited subset of data is processed by sub-processors whose primary region is outside the EEA (transactional email and AI summarisation). Where this occurs we rely on the UK International Data Transfer Addendum and standard contractual clauses, plus our sub-processors' own UK/EU data protection commitments.

We rely on the following sub-processors to deliver Echo:

• Survey responses: retained for the duration of your school or trust's subscription, plus 12 months, then deleted.
• Account profiles: deleted within 30 days of an account being closed or removed by an administrator.
• Staff email invitation lists: retained while you are a customer; deleted on contract termination.
• Server logs: rotated after 30 days.
• Backups: encrypted database backups are retained for up to 35 days on a rolling basis.

Under UK GDPR you have the right to access the personal data we hold about you, to ask us to correct or erase it, to restrict or object to processing, and to data portability. To exercise any of these rights, email us at dpo@teachecho.co.uk and we will respond within one calendar month.

Because survey responses are submitted anonymously, we cannot link a specific response back to an individual to delete it on request. You always have the option to skip any survey.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

• All traffic to Echo is encrypted in transit with TLS 1.2 or higher.
• All data at rest is encrypted by our hosting provider.
• Access to production data is restricted to named engineers and audited.
• Row-level security policies in our database ensure schools can only see their own data.
• We follow a least-privilege model for system roles and review access regularly.

Echo is a service for school and trust staff. It is not directed at children and we do not knowingly collect data about pupils through the Echo product.

We may update this policy from time to time. Significant changes will be communicated to account holders by email. The version and last-updated date at the top of this page always reflect the current policy.

Privacy queries: dpo@teachecho.co.uk