Data protection impact assessment (DPIA): draft

Tool: Chalkie AI Supplier: Chalkie AI Ltd (UK, company 15812522)
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-01). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	lesson planning / teacher tools
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: teacher-facing; pupils can join teacher-led Live Activities (chalkie.live) without accounts [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	processor for content submitted by the school and for Live Activities (school is controller, DPA 1.2); independent controller of teacher account data where teachers sign up directly
Where data is stored	EU hosting (DigitalOcean, Amsterdam) with a worker server and encrypted backups in London; AI sub-processors (Google Vertex AI global endpoint, OpenAI, OpenRouter/Anthropic and others, mostly US) get prompts and uploaded files without account name or email, though prompts can contain anything typed; Laravel Forge (US) has root access to the servers; transfers under SCCs, UK IDTA/Addendum or DPF (DPA 9)
Trains AI on inputs	no - "Chalkie does not use Customer personal data or Customer content to train AI models" (DPA 2.2); student answers are not sent to AI providers
How long inputs are kept	while the account is active or until deleted, backups up to about 90 days; Live Activities results kept until the teacher deletes them; returned or deleted within 30 days of termination (DPA)
Data processing agreement	https://chalkie.ai/en/dpa/uk-eu Signs individual DPAs: yes - UK/EU DPA accepted via the Terms, by a school admin, or signed
Supplier DPO / UK representative	not stated (contact hello@chalkie.ai)
Minimum age	18+ for account holders (teachers); pupils join teacher-led Live Activities without accounts
Other safety notes	no tracking on student-facing Live Activities pages; 24-hour breach notice; display names typed by pupils may include real names; PostHog analytics receives AI prompts and responses; marketing website loads analytics and ad cookies before consent
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Green, pupils Amber.

Risk	Suggested measure	Likelihood / severity	Residual risk
Data may be stored outside the UK/EU (Mixed)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: 18+ for account holders (teachers); pupils join teacher-led Live Activities without accounts	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://chalkie.ai/en/privacy
https://chalkie.ai/en/dpa/uk-eu
https://chalkie.ai/en-gb/terms