AcademyOS

1. Introduction

This Privacy Policy explains how we collect, use, store, and protect personal data, including the personal data of children under the age of 18. We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), as applicable.

2. Data Controller

3. Personal Data We Collect

We may collect and process the following categories of personal data:

• Child’s full name
• Child’s age and/or date of birth
• Child’s school or educational institution (if applicable)
• Child’s contact details (email address and/or telephone number, where appropriate)
• Parent or legal guardian’s name
• Parent or legal guardian’s contact details (email address and telephone number)
• Emergency contact information
• Attendance records, participation records, or progress data related to activities or courses
• Technical data such as IP address, browser type, and device information

We do not knowingly collect special category data unless explicitly required and lawful safeguards are in place.

4. Lawful Basis for Processing

We process personal data under one or more of the following lawful bases:

• Consent: Where explicit consent has been provided by a parent or legal guardian for children under the applicable digital consent age.
• Performance of a contract: Where processing is necessary to deliver services or activities requested.
• Legal obligation: Where processing is required to meet safeguarding, education, or regulatory requirements.
• Legitimate interests: Where processing is necessary for operational purposes and does not override the rights of the child.

5. Children’s Data and Parental Consent

We take additional measures to protect children’s personal data. Where required by law, we obtain verifiable consent from a parent or legal guardian before collecting or processing a child’s personal data. Children’s data is never used for marketing purposes without explicit parental consent.

6. How We Use Personal Data

Personal data is used only for purposes including:

• Registering children for activities, courses, or services
• Communicating with children and parents/guardians regarding schedules, updates, or safety matters
• Managing attendance, participation, and progress
• Ensuring safeguarding and welfare
• Maintaining internal records and compliance obligations
• Improving our services and website functionality

7. Data Sharing

We do not sell personal data. We may share personal data only with:

• Staff and volunteers who require access for safeguarding and operational purposes
• Service providers acting as data processors under written agreements
• Regulatory or safeguarding authorities where legally required

All third parties are required to maintain appropriate data protection and security standards.

8. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including legal, safeguarding, and reporting requirements. Retention periods are reviewed regularly. Data relating to children is securely deleted or anonymised once it is no longer required.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data, including access controls, encryption where appropriate, and staff training on data protection and safeguarding responsibilities.

10. Data Subject Rights

Under GDPR, data subjects (or their parents/legal guardians) have the right to:

• Access personal data
• Rectify inaccurate or incomplete data
• Request erasure of personal data
• Restrict or object to processing
• Request data portability
• Withdraw consent at any time (where consent is the lawful basis)

Requests can be made by contacting us using the details above. We may need to verify identity before responding.

11. Cookies and Online Tracking

Our website may use cookies or similar technologies. Where cookies are not strictly necessary, consent will be obtained before they are placed on the user’s device. Further details are provided in our Cookie Policy.

Manage cookie preferences

12. International Transfers

We do not transfer personal data outside the UK or EEA unless appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses.

13. Complaints

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the relevant supervisory authority, such as the Information Commissioner’s Office (ICO) in the UK.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be published on our website.

15. Cookies

We use essential cookies to support login sessions and security. Optional cookies are only used if you choose to accept them. You can update your preferences at any time.

Manage cookie preferences