Privacy policy

Who controls your data

For the marketing site, we are the data controller. For everything inside a school's own Friends of School site and app, the school is the controller and we act as its processor: the school decides what is collected and who can see it, and we handle it on the school's written instructions.

That distinction matters. If you are a parent and you want data corrected or deleted, your school can usually act faster than we can, because it is the school's decision to make.

What we collect

We collect different data depending on how you use Friends of School:

• Visitors to this site: only what is needed to serve the page. See the cookie policy for what is and is not stored in your browser.
• Enquiries: the name, email address, phone number, school name, and message you choose to send us when you ask for a demo.
• Committee members and staff: name, email address, role, and the actions taken in the admin tools, so a school can see who changed what.
• Parents: name, contact details, the classes and clubs their children are linked to, messages sent in class groups, and orders placed in the school shop.
• Children: name, year group and class, club and event bookings, and, where a school switches on the learning games, progress within those activities.

Children's data

Children's data is collected on the instruction of the school, under the school's own lawful basis and its arrangements with parents. We do not build advertising profiles, we do not sell data, and we do not use children's data to train machine-learning models.

Learning-game progress is visible to the child's parents and to staff the school authorises. It is not published to other parents and is not turned into a public leaderboard.

Why we can use it

For the marketing site and enquiries, our lawful basis is legitimate interest in responding to people who contact us about the product, and consent where you opt in to anything further.

Inside a school's site and app, the school sets the lawful basis, usually public task or legitimate interest for school communications, and consent for optional extras. We process on the school's instructions under a data processing agreement.

Who we share it with

We do not sell personal data. We share it only with service providers who help us run Friends of School, each under contract and only for that purpose: [hosting provider], [database and storage provider], [transactional email provider], Blink Payments for UK payments, Razorpay for India payments, Botim Pay for UAE payments, and [push notification provider]. Complete the named contracting entities, locations, and transfer terms before launch.

One of the points of Friends of School is that parents do not share contact details with each other. Class messaging routes through the app, so phone numbers and email addresses are not exposed between parents.

Where it is held, and for how long

Data is stored in [region]. Where data moves outside the UK, UAE, or India, we rely on [transfer mechanism, e.g. UK IDTA / standard contractual clauses].

We keep enquiry data for [period]. School data is retained for as long as the school's contract runs, and deleted or returned within [period] of it ending, unless the school or the law requires otherwise.

Your rights

Depending on where you live, you can ask to see the data we hold about you, have it corrected or deleted, object to or restrict how it is used, take a copy elsewhere, and withdraw consent you previously gave. Exercising these rights is free and does not affect your service.

If the data sits inside a school's site, ask the school first. It is the controller. If you are not satisfied, you can complain to your regulator: the ICO in the UK, the UAE Data Office, or the Data Protection Board of India.

Security, and telling you when something goes wrong

We use encryption in transit and at rest, role-based access so committee members see only their school, and audit logging of administrative actions. No system is perfectly secure, and we will not claim otherwise.

If a breach affects your data, we will notify the school without undue delay, and regulators and individuals where the law requires it.

How to reach us

Write to legal@aqualeo.co, or to [registered address]. Our data protection contact is [name and email].