Data Sharing Agreement - MIS

Document Aims

This document details the data objects and items that are shared, the use of, use by, storage and storage duration, safeguarding and security of the data that Schools will share with us The Morrisby Organisation (the “company”) company number 1183700.

This document provides a framework for Morrisby’s Data Sharing Agreement (DSA) with the school. The DSA is an important document, which supports the joint obligation of Morrisby and the School to comply with the Data Protection Act 2018, the General Data Protection Regulation (GDPR), and with the Information Commissioner’s Office (ICO) mandate. In order to use Morrisby a school/organisation must understand and accept this agreement.

Definitions

Term Definition
data controller, data processor, personal data, processing shall have the meanings as defined in the DPA and GDPR
Groupcall the company and provider of the Xporter on Demand software
School Management System or MIS the software used by the customer to manage their student and staff data
School or customer means the educational institution or organisation that Morrisby provides the platform to
XoD or Xporter on Demand an automated self-service solution to securely collect and deliver data to one or more selected partners, provided by Groupcall
Candidate or Student The end user of Morrisby’s service who is receiving careers guidance

Overview of MIS Integration via Groupcall

The primary purpose of MIS integration between the School and Morrisby via Groupcall is to facilitate the import of entire year groups onto the Morrisby system and therefore allow reporting across year groups on Student progress and activities on the Morrisby platform.

Groupcall is the provider that enables the MIS integration. Their installation at the School integrates into the School’s MIS and pulls that data into its system from which Morrisby pulls the data it needs. The School has full control over when the data sharing begins and ends, and has to approve all the data that Morrisby requests to access.

Setup

  1. If the school does not already have a Groupcall installation, then Groupcall will need to configure the School MIS to sync with Groupcall Xporter-on-Demand.
  2. XoD will not allow transfer of School data to Morrisby by default. The School must specifically give permission via the XoD web console to allow sharing to occur.
  3. Morrisby will request access to a set of data scopes, which the school will need to approve via an “Authorisation”. Morrisby only stores and uses a subset of the data within these data scopes. The specific data that is used is listed in the “Processed Data” section of this document.

Morrisby does not upload any data back to Groupcall and the School.

Processed Data

As part of the Groupcall setup, Morrisby requests access to a set of data scopes that Groupcall defines. Morrisby does not use all of the data within these scopes.

The Groupcall data scopes that Morrisby requests access to:

  • School
  • Staff,
  • Student,
  • StudentExtended,
  • StudentFunding,
  • SEN,
  • Photos,
  • UPN.

The data that Morrisby uses from the MIS is listed below:

  • School: Name, DfE#, URN, Term dates
  • Staff: First/Last Name, Email, Photo, Position, Registration Group
  • Groups: (Year & Registration): name, type, assigned students
  • Student: Firstname, last name, DoB, UPN, email, photo, group membership (Year and Reg), leaving date, SEN and Pupil Premium status, EAL/ESL

Withdrawing Access

Schools can revoke access by using the Groupcall XoD console, specifying an end date for the data access available to Morrisby. After this date Groupcall will no longer share data with Morrisby. Schools need to provide Groupcall with 72 hours notice to the date of cancellation.

Morrisby will not automatically delete data at the end of the MIS data sharing agreement. The School needs to ask Morrisby for any data deletions required. The reason for this is that most schools require access to the data even after the MIS data sharing has ended. Additionally, Morrisby Profile candidates have access-for-life to Morrisby’s services therefore deleting these students’ data is not normally appropriate.

Data Lifecycle

The School’s data point of origin remains in the school MIS for the data listed in Processed Data, which means the School is responsible for the quality of the data that is being shared.

Any of the changes the school makes to the data in the MIS will be synchronised to Morrisby as described below. Data synchronisation is currently a manually instigated process that a school staff member with sufficient access privileges can perform. Morrisby has plans to make student data synchronisation automatic at a later date.

New ‘personal' records

When a new staff or student record is detected during the MIS synchronisation and meets the selection criteria it will be uploaded to Morrisby.

Changed ‘personal’ records

When an updated staff or student is detected during the MIS synchronisation, and meets the selection criteria it will be updated in Morrisby.

Deleted ‘personal’ records

When a staff member, or student in the MIS is deleted Morrisby does NOT automatically revoke access. It is the responsibility of the school's nominated Morrisby Safeguarding Lead to monitor and ensure the correct people have access to the correct students on the Morrisby platform. School staff can also inform Morrisby when a student leaves the school and Morrisby will move the student out of the school record.

New Group Memberships

When a person is detected to have a new or changed group membership, e.g. registration group, etc. this will be notified to Morrisby on the next transfer and will then be reflected in the user interface for authorised users.

Deleted or Ended Group Membership

When a person is detected to have left a group membership, e.g. year group, class group, etc. this will be notified to Morrisby on the next transfer and the user records will be updated accordingly.

Security

Data sharing between Morrisby and Groupcall XoD is performed in a secure manner. The data is securely uploaded using industry standard SSL encryption and a unique identifier configured in Groupcall XoD ensures that the information is linked to the correct customer account on Morrisby. Groupcall Xporter accesses the school MIS system using credentials that the School provides and cannot access it without them.

For more information about the security policies that apply to the Morrisby platform, please contact us at: support@morrisby.com

Support

For enquiries and support regarding MIS integration and/or the data sharing agreement please contact Morrisby at:

Last Updated: 11 June 2020