Privacy Notice

1. Who we are

GCSESpark provides GCSE learning support and is the data controller for this service. Contact: hello@gcsespark.co.uk. If you are in the UK/EU, you can also contact us to exercise your data rights.

2. Data we collect

• Account: email address, basic profile, parent email (if provided).
• Learning data: subjects, preferences, diagnostic responses, session content you enter.
• Technical: device/browser info, IP, logs for security and reliability.
• Payment metadata (if you subscribe) handled via our payment provider; we do not store card numbers.

3. Why we process data

• Provide the service (lawful basis: contract).
• Safety, security, fraud prevention (legitimate interests).
• Legal compliance (e.g., safeguarding or lawful requests).
• Service improvement and reliability insights (legitimate interests, using minimised or aggregated data).
• Where we rely on consent (for example, optional non-essential cookies), you can withdraw it at any time.

4. Sharing

We use trusted processors (hosting, limited analytics for ops, email). We do not sell personal data. We may share if required by law or to protect users. Parental/guardian contacts may view child-related data when linked. Payment information is processed by our payment provider.

5. Third-party providers

We use third-party service providers to deliver GCSESpark (for example, hosting, authentication, email, payments, and AI processing). These providers act on our instructions as processors where applicable and are required to protect data.

If we offer optional integrations (for example, exporting content to another platform), your use of that integration may also be subject to the third party's terms and policies.

6. International transfers

Data may be processed outside the UK/EU with appropriate safeguards (e.g., SCCs/IDTA or equivalent where applicable).

7. Retention

We keep data while you have an account and delete or anonymise when no longer needed, subject to legal obligations, dispute handling, and backup/archival constraints.

We do not retain personal data permanently just for personalisation. You can request deletion; some limited data may remain in backups for a period before being overwritten.

For more detail, see Data Retention.

8. Your rights

• Access, rectify, erase, restrict, object, and portability where applicable.
• Withdraw consent where we rely on it (we minimise consent reliance).
• Lodge a complaint with the ICO (UK) or your local authority. Please contact us first so we can help.

To exercise rights, contact hello@gcsespark.co.uk.

9. Cookies

We use limited cookies and similar technologies for authentication, security, and basic service operation. For more details and controls, see our Cookie Policy.

10. Automated decision-making

We do not make decisions that have legal or similarly significant effects on you solely by automated means. We may use automated tools to help with safety, fraud prevention, and personalisation, with appropriate human oversight where needed.

11. Security

We use encryption in transit/at rest, least-privilege access, and monitoring. Report issues to security@gcsespark.co.uk. No system is perfect; choose strong device protections and keep access secure.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and regulators where required by law.

12. Children

The service supports GCSE learners; under-18s should involve a parent/guardian. We minimise data and do not use it for marketing. If you believe a child's data was provided improperly, contact us.

If a user is under 16, they should only use GCSESpark with parent/guardian involvement and any required consent. If we learn we have collected a child's personal data unlawfully, we will take steps to delete it as soon as reasonably practicable.

For schools and institutions, see Schools & Institutions.

13. Changes

We will update this notice when practices change. If changes are material, we will try to provide notice via the site or by email. Continued use means you accept the updated notice.