This privacy policy (Policy) applies to the Avidator platform and website (Platform), operated by Avidator Ltd (company number 14030277) whose registered office is at Office 3002, 182-184 High Street North, London, England, E6 2JA (we, us or our).

Our data protection contact is available at support@avidator.uk.

This Policy applies to the following users of the Platform:

• parents and guardians of children enrolled in Avidator programmes (Consumer Users);
• children accessing the Platform under their parent’s or guardian’s account and supervision;
• schools, educational institutions and programme operators contracting with Avidator (Institutional Users); and
• visitors to the Avidator website.

Children do not register directly on the Platform. All accounts for children are created and managed by a parent or guardian, and children access the Platform under the supervision of the parent or guardian who holds the account.

1. The personal data we collect

1.1    Children. We collect the following personal data about children enrolled in Avidator programmes:

• full name;
• date of birth;
• school name;
• academic year / year group;
• learning progress and assessment results;
• homework submissions and uploaded files or images;
• chat and messaging content with authorised teaching staff; and
• where required by a local authority or council for specific events, any additional data categories as notified at the time of collection (see clause 1.5 below).

1.2    We do not record live video or audio of children during online sessions. Pre-recorded instructor videos may be made available on the Platform, but these do not involve the recording of children.

• Parents and guardians. We collect the following personal data about parents and guardians:

• full name;
• email address;
• mobile phone number (used for OTP pick-up verification and platform communications);
• details of children linked to the account;
• payment and billing information (once paid services are introduced); and
• communications and correspondence with Avidator.

1.4    Where a school or institution contracts with Avidator on behalf of its pupils, we collect the contact details of the relevant administrators or staff, together with registration and enrolment information provided in connection with the programme.

1.5    Special category data. For certain specific events, a local authority or council may require us to collect additional information about children or parents that constitutes special category data under UK GDPR (for example, health, dietary or medical information relevant to the event). Where this applies, we will:

• notify you clearly at the point of collection of what data is being collected and why;
• identify the Article 9 condition we rely on for processing that data (which will typically be explicit consent from the parent or guardian, or substantial public interest / safeguarding, depending on the circumstances); and
• process that data only to the extent strictly necessary for the relevant event.

We do not collect health, SEN or medical information in the ordinary course of platform use.

1.6    Our OTP pick-up verification system sends a one-time passcode to the registered parent or guardian’s mobile number at pick-up. The OTP is not retained beyond the session; however, a record of completed pick-ups is maintained for safeguarding purposes.

1.7    When you visit the Avidator website, we automatically collect certain technical data, including your IP address, browser type, pages visited and time spent on each page. We use Google Analytics for this purpose. See clause 8 for further information.

How we use personal data

• We use children’s personal data to:
• deliver online classes, tutoring, assessments and mock examinations;
• track and report on learning progress to parents, guardians and schools;
• manage attendance and authorise pick-up via the OTP system;
• enable children to submit homework, access uploaded materials and communicate securely with authorised teaching staff; and
• comply with our safeguarding obligations and, where applicable, obligations imposed by local authorities or councils in connection with specific events.
• We use parents’ and guardians’ personal data to:
• register and manage accounts;
• send OTP messages for authorised pick-up;
• communicate about your child’s progress, upcoming events and platform updates;
• send marketing communications where you have consented or where we are otherwise permitted to do so (see clause 9);
• process payments once paid services are introduced; and
• respond to queries and support requests.

2.3    We do not use children’s personal data for marketing or profiling purposes.

3. Lawful bases for processing

3.1    We process personal data on the following lawful bases under UK GDPR:

• Contractual necessity: processing required to deliver the services enrolled for, including account management, OTP verification and platform access;
• Legitimate interests: processing necessary for our legitimate interests in improving the Platform, communicating about service updates, and safeguarding the welfare of children, where those interests are not overridden by your rights and freedoms. This includes our safeguarding responsibilities, which we rely on as a strong and pressing legitimate interest where a formal legal obligation does not directly apply;
• Legal obligation where applicable: processing required to comply with a specific legal obligation, including obligations imposed by a local authority or council, or applicable regulatory requirements; and
• Consent: where we rely on consent (for example for marketing communications or certain cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

3.2    Where we process special category data (see clause 1.5), we will identify and document the applicable Article 9 condition at the time of collection.

3.3    Because children enrolled on the Platform are under 18, all consents and account registrations are handled by a parent or guardian on the child’s behalf.

4. Who we share personal data with

4.1    India-based support and teaching staff. We use a partner company based in India to provide technical support for the Platform and to deliver online teaching services. Staff based in India may access personal data held on the Platform as follows:

• Personal data (such as names, contact details and child information): read-only access, on our written instructions and for specified support purposes only.
• Learning and progress content (such as lesson content, topic progress and assessment records): staff may view and update this data in the course of delivering and administering classes.
• Our Indian partner acts as a data processor on our behalf and may only process personal data in accordance with our documented instructions. They are contractually bound to apply appropriate confidentiality and security obligations.

4.2    International transfer safeguards. Because India does not currently hold an adequacy decision under UK GDPR, transfers to our Indian partner are governed by the EU Standard Contractual Clauses (as amended by the UK Addendum to the EU SCCs) or the UK International Data Transfer Agreement (IDTA), as applicable, together with a Data Processing Agreement and a Transfer Risk Assessment. We have adopted a consistent transfer mechanism for all transfers to this partner and copies of the relevant safeguards are available on request.

4.3    Overseas teaching staff. From time to time we may engage teaching assistants or qualified teachers based outside the United Kingdom, including in India, to deliver online classes or provide teaching support to children. Where such individuals access personal data as part of their teaching duties, the same transfer safeguards described in clauses 4.1 and 4.2 apply. All overseas teaching staff are engaged under written agreements restricting their use of personal data to the delivery of the relevant teaching services.

4.4    Schools and institutions. Where access to the Platform is provided through a school or institution, we share information about attendance, progress and participation with the relevant school or programme operator for the purposes of delivering the educational service.

4.5    Third-party service providers. We share data with providers who help us operate the Platform, including our SMS provider (for OTP delivery), hosting and infrastructure providers, payment processors (once paid services are introduced) and our analytics provider. All providers are bound by contractual obligations to process data only as instructed and to maintain appropriate security standards.

4.6    Councils and local authorities. For certain events, we may share information with a relevant local authority or council where required to do so. We will only do so on a lawful basis and will inform you at the point of collection where this applies.

4.7    Legal disclosures. We may disclose personal data to law enforcement, regulatory bodies or courts where required by law, or where necessary to protect the safety or welfare of a child or other person.

5. Retention

5.1    We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Children’s and parents’ data: retained for the duration of enrolment and for [3] years after the end of the programme or the child’s last activity, after which it is securely deleted or anonymised;
• OTP and pick-up records: retained for [12] months after the relevant programme ends, for safeguarding purposes;
• Chat and messaging content: retained for [12] months after the message is sent, unless a longer period is required for safeguarding or legal reasons;
• Uploaded files and homework submissions: retained for the duration of enrolment and for [12] months thereafter;
• Assessment and progress records: retained for [3] years after the child’s last activity, to enable parents to request historical academic records;
• Financial and billing records (once introduced): retained for [7] years in accordance with HMRC requirements; and
• Website analytics data: retained in accordance with the settings described in our Cookie Policy at [COOKIE POLICY URL].

5.2    Requests for deletion before the end of a retention period may be submitted using the contact details at the top of this Policy. We will comply where we are not required by law or safeguarding obligations to retain the data.

6. Security

• We implement the following measures to protect personal data:
• encryption of data in transit and at rest;
• access controls restricting personal data to authorised personnel only;
• regular security reviews and system monitoring;
• contractual security obligations placed on all data processors and overseas partners; and
• staff training on data protection and safeguarding.

 

6.2    In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will notify affected individuals where required.

7. Your rights

7.1    Under UK GDPR, you (and parents or guardians acting on behalf of a child) have the following rights:

• Right of access: to request a copy of the personal data we hold;
• Right to rectification: to ask us to correct inaccurate or incomplete data;
• Right to erasure: to ask us to delete data, subject to our legal and safeguarding obligations;
• Right to restriction: to ask us to restrict processing in certain circumstances;
• Right to data portability: where processing is based on consent or contract, to receive data in a machine-readable format;
• Right to object: to object to processing based on legitimate interests, including direct marketing; and
• Right to withdraw consent: to withdraw consent at any time where processing is based on consent.

7.2    To exercise any of these rights, please contact us at support@avidator.uk. We will respond within one month. We may extend this by a further two months for complex or numerous requests, in which case we will notify you.

7.3    You have the right to lodge a complaint with the ICO at www.ico.org.uk.

8. Cookies and analytics

8.1    The Avidator website uses Google Analytics and may use other analytics or tracking technologies to collect information about how visitors use the site. For full details of the cookies we use, the purposes for which they are used, and how to manage your preferences, please see our Cookie Policy at [COOKIE POLICY URL].

8.2    Where required by law, we will obtain your consent before placing non-essential cookies. You can manage your preferences through our cookie consent tool or your browser settings at any time.

9. Marketing communications

9.1    We may send marketing communications to parents and guardians by email or SMS about Avidator programmes, events, workshops and courses, on the basis of consent or our legitimate interests in communicating with existing customers.

9.2    You can opt out at any time by clicking the unsubscribe link in any marketing email, replying STOP to any marketing SMS, or contacting us at support@avidator.uk. Opting out will not affect service communications such as OTP messages, progress updates or account notifications.

10. Payments

10.1  The Platform is currently provided free of charge. When paid services are introduced, payment and billing information will be collected from parents or guardians. Payment data will be processed by our third-party payment processor and will not be stored directly on the Platform. We will update this Policy before any paid services go live.

11. Safeguarding

11.1  All data relating to children is processed in accordance with our safeguarding obligations. In particular:

• children’s personal data is never used for marketing or profiling purposes;
• access to children’s data by staff and overseas partners is logged and monitored;
• live recording of children is not permitted on the Platform; and
• any safeguarding concerns identified through the Platform are handled in accordance with our Safeguarding Policy and reported to the relevant authorities where required.

12. Changes to this Policy

12.1  We may update this Policy from time to time. Where we make material changes, we will notify parents and guardians by email and will update the date at the top of this document.

13. Governing law

13.1  This Policy and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it shall be governed by and construed in accordance with the law of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any such dispute or claim.