Table of contents
1. What does MyEdSpace do?
2. Personal data we collect and process
3. How we use your personal data (our purposes) and our legal basis for processing it
4. Who we share your personal data with
5. Cookies and similar tracking technology
6. How we keep your personal data secure
7. International data transfers
8. Data retention
9. Automated decision-making
10. Your data protection rights
11. Third Parties
12. Updates to this Privacy Notice
13. How to contact us
We recommend that you read this Privacy Notice in full to ensure you are completely informed about your personal data. However, if you only want to access a particular section of this Privacy Notice, then you can click on the relevant link above to jump to that section.
MyEdSpace respects your right to privacy. This Privacy Notice explains who we are, how we collect, share and use personal data about you and how you can exercise your privacy rights. This Privacy Notice only applies to personal data that we collect through our website at www.myedspace.co.uk and all subdomains (“Website”). We are the controller of the data.
If you are aged under 18 years of age, or are a parent or guardian of someone aged under 18 years of age please also refer to our children's online privacy notice which can be found at https://myedspace.co.uk/childrens-privacy-notice. Where a platform user is under 18, our Children's Privacy Notice governs our use of their personal data, and the marketing, advertising and profiling purposes described in this notice do not apply to them.
If you have any questions or concerns about our use of your personal data, then please contact us using the contact details under the “How to contact us” (section 13) heading below.
1. What does MyEdSpace do?
MyEdSpace is an online education provider headquartered in the UK. For more information, please see the “About Us” section of our Website at https://myedspace.co.uk/about-us
2. Personal data we collect and process
a) The personal data we collect from you, either directly or indirectly, will depend on how you interact with us and with our website. We collect personal data about you from the following different sources:
Information that we collect directly
• We collect personal data directly from you when you choose to provide us with this information online and through your other interactions with us (such as data collected via social media and any surveys, customer service communications, competitions or other promotional programmes in which you may participate). Certain parts of our website ask you to provide personal data when you engage with the following services: Account creation, customer service information, purchase of goods / services and account management..
Information that we collect indirectly
• We collect your personal data indirectly, including through automated means from your device when you use our website. Some of the information we collect indirectly is captured using cookies and other tracking technologies, as explained further in the "Cookies and similar tracking technology" section (section 5) below.
Information from third parties
• We also collect your personal data from third party sources, i.e. our service providers that provide operational assistance, email, marketing and analytics services, as well as financial and credit related services, payment services and social media platforms. Information received from third parties will be checked to ensure that the third party either has your consent or are otherwise legally permitted or required to disclose your personal data to us.
If you choose to register for a website account with us via a social media account you hold, we will collect your email from your social media account to set up your account with us and to confirm whether you logged into our website using your social media account. We do not access your personal account settings on your social media account.
In general, we will use the personal data we collect from you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect your personal data. However, we will also use your personal data for other purposes that are compatible with the purposes we have disclosed to you (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) if and where this is permitted by applicable data protection laws.
b) The table below describes the categories of personal data we collect from and about you through our online services and activities on our website
|
Personal Data Description |
Source |
|
Identity and Contact Data such as your name, email address and password, telephone number. |
• Directly from you (online or offline) • Indirectly from you • Third parties |
|
Account Data such as your login information (email and password) and profile information (contact details including your name, surname, postcode, phone, your gender (includes 'prefer not to say' option) and student status or other status relevant to your eligibility for discounts, your chosen access type (28-day rolling access or Annual (Academic Year) access), your Subscription Period start date and, for Annual (Academic Year) subscribers paying in instalments, your instalment schedule.
|
• Directly from you • Indirectly from you • Third parties |
|
Transaction Data such as truncated credit or debit card details, payment method, transaction statements, your billing address, your delivery address or the delivery address of the intended recipient of your order, payments and orders to and from you, and other details of products that you have supplied to or purchased through the website. We do not collect or store your full credit or debit card details (which are processed by payment service providers who are separate controllers of your data. Please refer to your payment service provider's privacy notice for further details on their data collection practices).
|
• Directly from you • Indirectly from you • Third parties |
|
Social Media such as social media handle and log in details where you choose to log in to the website using your social media account. |
• Indirectly from you • Third parties |
|
Communications Data such as your feedback on our products and services or the performance of our website and other communications with us (including when you interact with our customer service agents offline), any queries you raise, competition and survey entries, chat, email or call history on the website or with third party service providers. This will include information as to how you contact customer services and the channel of communication that you use or any information that you send to us. We will do this if you complain about the performance of our website and send us screenshots). |
• Directly from you • Indirectly from you • Third parties
|
|
Advertising and Marketing Data such as your interests based on your use of our website and other websites and online services, your purchases, survey responses, promotions you enter, preferences in relation to receiving marketing materials from us, communication preferences, preferences for particular products or services and your subscription details. |
• Directly from you • Indirectly from you • Third parties
|
|
Device Data collected from (or as a result of your using) your device (including by means of cookies and similar tracking technology), including your IP address, your ISP, and the browser you use to visit our Website, device type, unique device identification numbers or other identifiers including advertising identifiers |
• Indirectly from you |
|
Website Usage Data such as activity and Website page interaction, information that we capture using cookies and similar technologies (see the "Cookies and similar tracking technology" section below). This will include page views and searches, log-in information, clicks, operating system, information about content viewed, watched or downloaded for offline access, length of visits to certain pages, length of website use, purchase history and other functional information on website performance (for example, application version information, diagnostics, and crash logs). |
• Indirectly from you |
|
User Content, such as homework and coursework responses, message content with teachers and mentors. |
• Directly from you |
|
Study Aid Interaction Data such as pseudonymised question text submitted to the Study Aid, AI-generated responses, conversation history, interaction timestamps, daily usage counts, safeguarding flags (where triggered), and student feedback flags. Personal identifiers in question text are automatically anonymised before AI processing. |
• Directly from you |
|
Research and Attainment Data such as exam results you or your parent or guardian share with us voluntarily, or identifying information (name, date of birth, postcode, UPN) used to link your account to national education records within a government-approved secure research environment. Identifying data is only used for this purpose where you have given explicit consent, or where we hold the necessary government accreditation and approvals and have notified you in advance. |
Directly from you; via ONS Secure Research Service (where approved) |
Some of the personal data that you provide includes sensitive personal data, such as health-related information or information about your race or ethnicity, which we need for providing our educational services and surveys to improve our services. Where we process special category personal data, such as health information, additional learning needs, or information about your race or ethnicity, to provide our educational services and support, we rely on your explicit consent (UK GDPR Article 9(2)(a)), which you can withdraw at any time by contacting [email protected]. Where we process such data for safeguarding purposes, we rely on the substantial public interest condition for the safeguarding of children (Article 9(2)(g) with Schedule 1 to the Data Protection Act 2018). Where we process it to protect someone's vital interests, we rely on Article 9(2)(c)
The provision of account data and education history is necessary for the performance of our contract with you and/or to enter into a contract with you. If you do not provide this data, then we will not be able to perform a contract with you.
3. How we use your personal data (our purposes) and our legal basis for processing it
We use the personal data that we collect from and about you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect your information. Depending on our purpose for collecting your information, we rely on one of the following legal bases:
• Contract - we require certain personal data in order to provide the goods and support the services you purchase or request from us;
• Consent - in certain circumstances, we may ask for your consent (separately from any contract between us) before we collect, use, or disclose your personal data, in which case you can voluntarily choose to give or deny your consent without any negative consequences to you;
• Legitimate interests - we will use or disclose your personal data for the legitimate interests of either MyEdSpace or a third party, but only when we are confident that your privacy rights will remain appropriately protected. If we rely on our (or a third party's) legitimate interests, these interests will normally be to: operate, provide and improve our business, including our website ; communicate with you and respond to your questions; improve our website or use the insights to improve or develop marketing activities and promote our products and services; detect or prevent illegal activities (for example, fraud); and/or to manage the security of our IT infrastructure, and the safety and security of our employees, customers, vendors and visitors. Where we require your data to pursue our legitimate interests or the legitimate interests of a third party, it will be in a way which is reasonable for you to expect as part of the running of our business and which does not materially affect your rights and freedoms. We have identified below what our legitimate interests are.
• Legal obligation - there are instances where we must process and retain your personal data to comply with laws or to fulfil certain legal obligations.
The following table provides more details on our purposes for processing your personal data and the related legal bases. The legal basis under which your personal data is processed will depend on the data concerned and the specific context in which we use it.
|
Purpose/Activity |
Type of personal data |
Lawful basis for processing including basis of legitimate interest |
|
Register your account on our website, to manage and administer your account, to facilitate purchases you make (including, where applicable, providing special discounts, and to administer your chosen Subscription Period; whether 28-day rolling access or Annual (Academic Year) access, including upfront and instalment payment schedules. |
Identity and Contact Data Account Data Transaction Data Communication Data Device Data Location Data |
• Performance of a contract with you. • Consent (in the case of processing of Location Data). |
|
Provide and deliver and services. |
Identity and Contact Data Account Data Communication Data Transaction Data Device Data Location Data |
• Performance of a contract with you. • Consent (in the case of processing of Location Data). |
|
Process transactions (online / ecommerce payments), including online delayed payment options (via Stripe), and transaction fee recovery. |
Identity and Contact Data Account Data Communication Data Transaction Data |
• Performance of a contract with you. |
|
Respond to your communications regarding our products and services, send you service updates, confirmations, invoices, technical notices, updates, security alerts, support and administrator messages, respond to your enquiries, requests or complaints. |
Identity and Contact Data Account Data Transaction Data Communication Data Uploaded Content Device Data Website Usage Data
|
• Performance of a contract with you. • Otherwise, as necessary for our legitimate interests (to operate, provide and improve our business; to communicate with you), where our communications are not necessary to perform or enter into a contract with you. |
|
Reviewing communications with you for customer support and quality assurance and training purposes, and related recordkeeping.
|
Identity and Contact Data Account Data Transaction Data Communications Data Uploaded Content Device Data Website Usage Data |
• Necessary for our legitimate interests (to operate, provide and improve our business; to communicate with you), where our communications are not necessary to perform or enter into a contract with you. |
|
Keep our business, including our website and our employees, customers, vendors, and visitors secure and address threats to their safety or the safety of others; to detect and prevent fraud online. For example, online we use malware and spyware monitoring tools to detect suspicious activity and algorithms to detect unauthorised access. |
Identity and Contact Data Account Data Transaction Data Device Data Website Usage Data Communications Data Location Data |
• Necessary for our and our third parties' legitimate interests (to operate and provide our business, including our website; to detect or prevent illegal activities (e.g. fraud) and/or to manage the security of our IT infrastructure, and the safety and security of our employees, customers, vendors, and visitors). |
|
Manage compliance with our terms of service, manage our compliance hotline and related internal reporting.
|
Identity and Contact Data Account Data Communications Data Transaction Data Uploaded Content Social media |
• Performance of a contract with you. • Otherwise, as necessary for our legitimate interests (to operate, provide and improve our business, including our website; to detect or prevent illegal activities (e.g. fraud) and/or to manage the security of our IT infrastructure, and the safety and security of our employees, customers, vendors, and visitors • Legal obligations |
|
To administer and maintain our website and our IT systems (including monitoring, troubleshooting, data analysis, testing, system maintenance, repair and support, reporting and hosting of data). |
Identity and Contact Data Account Data Device Data Website Usage Data
|
• Our and our third parties' legitimate interests (to operate, provide and improve our [business, including our website; to detect or prevent Illegal activities (e.g. fraud) and/or to manage the security of our IT infrastructure). |
|
Manage our use of tracking technologies such as cookies (including enabling you to manage your cookie preferences) and analyse collected data to learn about our website, to improve our website, and to develop new products and services. This includes website analytics, identifying browsing / purchasing trends and patterns and evaluating this information on an aggregated, group(s) basis (Social Media, Marketing Data) and individual basis (Account Data, Device Data, Location Data and Website Usage Data).
|
Account Data Device Data Website Usage Data Social media Location Data Account Data Advertising and Marketing Data Communications Data
|
• Consent (where required under applicable law: see cookie consent tool on our website). • Otherwise (for strictly necessary cookies) our legitimate interests to operate, provide and improve our business, including our website, to improve our website or use the insights to improve or develop marketing activities and promote our products and services. |
|
Analyse data including metrics related to consumer transactions and behaviour (online and offline), to assess trends and the effectiveness of our advertising and marketing campaigns, to help us understand your needs and provide you with better service and offers, to drive customer engagement, promote our brand, and inform other business decisions by understanding consumer behaviour. |
Account Data Transaction Data Device Data Website Usage Data Social media Communications Data Marketing Data |
• Consent (where required under applicable law). • Otherwise our legitimate interests (to operate, provide and improve our business], including our website, to improve our website or use the insights to improve or develop marketing activities and promote our products and services). |
|
Contact current and prospective customers (including website visitors) about our products and services, promotions, competitions and events we think may be of interest, including our newsletter and other promotional mailers and electronic communications. |
Account Data Website Usage Data Marketing Data Communication Data Social media Uploaded Content Data
|
• Consent (where required under applicable law). • Otherwise our legitimate interests (to operate, provide and improve our business; to communicate with you and to develop marketing activities and promote our products and services). |
|
Personalise and customise your experience, including to provide local or otherwise targeted content and information for customers, and to tailor the content and advertising served on our website. |
Account Data Marketing Data Website Usage Data Device Data Social media |
• Consent (where required under applicable law). • Otherwise our legitimate interests (to operate, provide and improve our business, including our website, to use the insights to improve or develop marketing activities and promote our products and services). |
|
Personalise, target, and deliver advertising for our products and services on third party websites, apps, and other online services (including to identify audiences and individuals like you to better tailor our marketing campaigns and communications) and measure the effectiveness of our campaigns and adjust our methods. |
Account Data Marketing Data Website Usage Data Social media Contact Device Data
|
• Consent (where required under applicable law). • Otherwise our legitimate interests (to improve our business to promote our products and services and to use the insights to improve or develop our marketing activities).
|
|
Analyse social media performance metrics to evaluate and execute social media campaigns, including to interact with our current and prospective customers on various social media channels to promote our products, run contests and promotions, answer questions and otherwise drive and monitor customer engagement and satisfaction. |
Account Data Marketing Data Social media Communication Data Uploaded Content Data Website Usage Data Device Data
|
• Consent (where required under applicable law). • Otherwise our legitimate interests (to improve our business, to promote our products and services and to use the insights to improve or develop marketing activities).
|
|
Administer sweepstakes, competitions or surveys
|
Identity and Contact Data Account Data Communication Data Uploaded Content Data Social media |
• Our legitimate interests (to drive customer engagement and to collect user perceptions and measure satisfaction). |
|
Comply with legal and regulatory obligations to which we are subject, including our obligations to respond to your requests under data protection law. |
Identity and Contact Data Account Data Transaction Data Website Usage Data Location Data Communication Data Uploaded Content Data |
• Legal obligation. |
|
Protect our legal rights (including where necessary, to share information with law enforcement and others), for example to defend claims against us and to conduct litigation to defend our interests. |
Identity and Contact Data Account Data Transaction Data Location Data Website Usage Data Communication Data
|
• Our legitimate interests to protect our business interests. |
|
Study Aid; educational chat support. Processing student questions through our Study Aid feature to generate subject-specific educational responses. Includes: pseudonymised transmission of question text to Claude (Anthropic) via AWS Bedrock (UK); automated PII anonymisation before AI processing; content safety filtering; safeguarding detection and escalation where a welfare concern is identified; audit logging for safety monitoring; conversation history storage for student access. |
Study Aid Interaction Data, Account Data |
Legitimate interests (Article 6(1)(f) UK GDPR): to provide and improve our educational services, and to keep students safe. Full Legitimate Interests Assessment available on request. For safeguarding flag retention: legal obligation. |
|
AI personalisation of learning experiences. Beyond the Study Aid (covered above), we do not currently use AI to personalise your learning experience. If we introduce AI personalisation features in the future, they will be off by default for users under 18 and will apply only where switched on by the user or, for under-18s, by their parent or guardian. We will update this notice, and complete a data protection impact assessment, before any such feature launches. |
Identity and Contact Data, Account Data, Website Usage Data, User Content (if introduced) |
Consent (Article 6(1)(a)). Processing ceases if consent is withdrawn. |
|
Service improvement research. We use anonymised, aggregated platform data to improve our services and contribute to research on educational outcomes. No identifiable data leaves MyEdSpace for this purpose. |
Anonymised Account, Usage, Study Aid, and User Content data
|
Legitimate interests (Article 6(1)(f)); Article 9(2)(j) for special category data. LIA available on request. |
|
Outcomes research: self-reported data and accredited research partners. Where you share exam results with us directly, or where we work with UKSA-accredited researchers on approved projects, we use that data to evaluate our teaching effectiveness. For research partnerships, identifying data is shared solely to enable record linkage inside the ONS Secure Research Service; only aggregate findings return to us. We participate only in projects with formal government approval, a clear public benefit, and committed publication of results. |
Research and Attainment Data, Identity and Contact Data, Account Data |
Consent (Article 6(1)(a); Article 9(2)(a) for special category data). Consent is collected separately from sign-up and may be withdrawn at any time by contacting [email protected]. |
|
Direct access to national education records (future). Where MyEdSpace holds UKSA accredited researcher status and DfE approval under the Digital Economy Act 2017, we may access the National Pupil Database inside the ONS Secure Research Service to evaluate educational outcomes associated with our platform. All processing occurs within that secure environment; no individually linked data returns to us. We will notify users and provide a right to object before activating this route. |
Research and Attainment Data, Identity and Contact Data (for linkage only) |
Legitimate interests (Article 6(1)(f)); Article 9(2)(j) for special category data. Statutory gateway: Digital Economy Act 2017. LIA will be completed and made available before activation. |
4. Who we share your personal data with
We share your personal data with the following categories of recipients:
• our current or future affiliates and group companies;
• messages you send to mentors, shared with those mentors;
• homework and coursework responses, shared with the teachers providing the relevant course;
• third party service providers, as listed in the table below;
• law enforcement bodies, regulators, or courts where required by law or to protect legal rights or vital interests; and
• a prospective buyer in connection with any acquisition or merger of our business.
We do not share your mobile opt-in data or consent with any third parties for marketing or promotional purposes.
International transfers. Some of our service providers are based outside the UK. Where we transfer personal data internationally, we use Standard Contractual Clauses (SCCs) approved under UK GDPR, or rely on an adequacy decision recognising the destination country as providing adequate protection. The transfer basis for each provider is shown in the table below.
Interest-based advertising applies only to visitors to our public marketing website and to adult account holders. We do not serve interest-based or behavioural advertising to logged-in students under 18, and we do not share their personal data with advertising networks for ad-targeting purposes.
|
Provider |
Purpose |
Data categories |
Location |
|
Infrastructure & Security |
|||
|
Amazon Web Services |
Cloud hosting for all platform applications and databases |
Account, student, usage data |
USA: SCCs |
|
Auth0 (Okta) |
User login and authentication |
Name, email |
USA: SCCs |
|
Cloudflare |
CDN and DDoS protection |
IP address, device data |
USA: SCCs |
|
Study Aid |
|||
|
Anthropic (via AWS Bedrock UK) |
Generates AI responses for Study Aid. Does not train on customer data. |
Pseudonymised question text (PII removed before transmission) |
UK only |
|
Langfuse (EU) |
Audit logging and safety monitoring for Study Aid |
Pseudonymised interaction data, timestamps, safety flags |
EEA: adequacy |
|
Communications |
|||
|
Amazon SES |
Transactional emails (lesson reminders, account alerts) |
Name, email |
USA: SCCs |
|
GetStream |
In-platform chat between students and teachers |
Name, message content |
USA: SCCs |
|
Wazzup |
Managed WhatsApp messaging between students and academic mentors |
Name, phone number, message content |
EEA: adequacy |
|
WhatsApp (Meta) |
Message delivery for the mentor channel (end-to-end encrypted) |
Phone number, message content |
USA: SCCs |
|
Bitrix24 |
CRM used to manage mentor communications |
Name, contact details |
EEA: adequacy |
|
Google Workspace |
Email and internal communications |
Name, email, communications data |
USA: SCCs |
|
Intercom |
Customer Service |
Name, Email, Phone, Order ID. |
USA: SCCs |
|
CRM & Marketing |
|||
|
HubSpot |
CRM and marketing email automation |
Name, email, phone, subscription data |
USA: SCCs |
|
Advertising & Paid Marketing |
|||
|
Meta (Facebook / Instagram) |
Paid social advertising via pixel |
IP address, device ID, browsing behaviour |
USA: SCCs |
|
Google Ads |
Paid search and display advertising via tag |
IP address, device ID, browsing behaviour |
USA: SCCs |
|
ByteDance (TikTok) |
Paid social advertising via pixel |
IP address, device ID, browsing behaviour |
USA: SCCs |
|
Snap Inc. (Snapchat) |
Paid social advertising via pixel |
IP address, device ID, browsing behaviour |
USA: SCCs |
|
Stape |
Server-side tag management forwarding event data to ad and analytics platforms |
IP address, device ID, event data |
EEA: adequacy |
|
Payment Processing |
|||
|
Stripe |
Subscription payment processing |
Name, billing address, payment method |
USA: SCCs |
|
PayPal |
Alternative payment processing |
Name, email, transaction records |
USA: SCCs |
|
Shopify |
E-commerce order processing |
Name, email, order data |
Canada: adequacy |
|
Analytics & Business Intelligence |
|||
|
Snowplow |
Granular event-level behavioural data collection, piped to data warehouse |
IP address, device ID, session and event data |
UK only |
|
Amplitude |
Product analytics and user behaviour tracking |
Device data, usage data, pseudonymised IP |
USA: SCCs |
|
PostHog |
Product analytics and platform engagement tracking |
Device data, usage data, pseudonymised IP |
USA: SCCs |
|
Snowflake |
Data warehouse for analytics |
Pseudonymised usage data |
USA: SCCs |
|
Holistics |
Data visualisation and reporting |
Pseudonymised usage data |
Singapore: SCCs |
|
Research |
|||
|
UKSA-accredited research organisations |
Record linkage to national education data for approved research projects. Consent required. Aggregate findings only returned to MyEdSpace. |
Name, DOB, postcode, UPN |
UK only |
|
ONS / Department for Education |
Direct National Pupil Database access under Digital Economy Act 2017 accreditation. Future use only. Users notified in advance. |
Linkage keys only |
UK only |
|
Platform & Account Management |
|||
|
Filament |
Internal customer account and student data management |
Name, email, account, subscription, student data |
UK only |
• third party services when you use third party services linked through our website, for example, third party payment services, your personal data will be collected by the provider of such services. Please note that when you use third party services, their own terms and privacy notices will govern your use of their services;
• any competent law enforcement body, regulatory, government agency, court or other third party (such as our professional advisers) where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights or so a third party can defend theirs, or (iii) to protect your vital interests or those of any other person;
• a buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal data only for the purposes disclosed in this Privacy Notice; or
• any other person with your consent to the disclosure (obtained separately from any contract between us)
5. Cookies and similar tracking technology
We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use personal data about you, including to serve interest based advertising. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Notice https://myedspace.co.uk/cookies-notice.
6. How we keep your personal data secure
We use appropriate technical and organisational measures to protect the personal data that we collect and process about you. The measures are designed to provide a level of security appropriate to the risk of processing.
7. International data transfers
In some cases, where your personal data is transferred to or third parties, it is processed in countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).
Where we transfer your personal data to countries or organisations outside of the European Economic Area and the UK, which have been formally recognised as providing an adequate level of protection for personal data, we rely on the relevant “adequacy decisions” from the European Commission and “adequacy regulations" (data bridges) from the Secretary of State in the UK.
Where the transfer is not subject to an adequacy decision or regulations, we have taken appropriate safeguards to ensure that your personal data will remain protected in accordance with this Privacy Notice and applicable laws. The safeguards we use to transfer personal data are in case of our third party service providers and partners the European Commission’s Standard Contractual Clauses as issued on 4 June 2021 under Article 46(2) including the UK Addendum and the UK International Data Transfer Agreement permitted under Article 46(2) of the UK GDPR for the transfer of data originating in the UK.
Study Aid sub-processors: AWS Bedrock (eu-west-2) operates within the UK; no international transfer. Langfuse EU Cloud operates within the EEA and is covered by the UK-EU adequacy regulation; no further safeguard required. Anthropic Ireland Limited is the contracting entity for UK customers under the Anthropic Bedrock Commercial Terms, which incorporate a Data Processing Addendum. Processing by Anthropic occurs within the AWS eu-west-2 (UK) environment.
All research-related processing, including any access to national education records, takes place within the United Kingdom.
8. Data retention
We retain the personal data we collect from you where we have an ongoing legitimate need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). In certain circumstances, we will need to keep your information for legal reasons after our contractual relationship has ended. The specific retention periods depend on the nature of the information and why it is collected and processed and the nature of the legal requirement.
When we have no ongoing legitimate need or legal reason to process your personal data, we will either delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.
Study Aid: interaction logs (question text, responses, timestamps, usage data) held in Langfuse and the MES database are retained for a maximum of two academic years from the date of collection, and deleted by 31 July at the end of that second year., consistent with our standard student data retention policy. Safeguarding flags and related records generated by the Study Aid are retained until the student reaches the age of 25, or for such longer period as required under applicable safeguarding law.
The following standard retention periods apply to other categories of personal data:
Account and subscription data: retained for the duration of your subscription and for six years following the end of the subscription, to allow for legal compliance, dispute resolution, and tax record-keeping.
Transaction data: retained for seven years from the date of the transaction, in line with HMRC requirements.
Communications data (customer service records, queries, complaints): retained for three years from the date of the communication.
Marketing data: retained until you withdraw consent or opt out, after which it is deleted within 30 days.
Device and usage data: retained in identifiable form for up to 13 months, after which it is anonymised or deleted.
9. Automated decision-making
Study Aid
The Study Aid uses a generative AI model (Claude, operated by Anthropic) to produce educational responses to student questions. This does not constitute automated decision-making with legal or similarly significant effect under UK GDPR; the Study Aid provides information and explanations; it does not make decisions about students. Students decide how to use the responses they receive.
Every Study Aid response is labelled "AI generated." Students can flag any response using the thumbs up / thumbs down button on the interface. Negative feedback is reviewed by our team.
If the Study Aid's automated safeguarding detection system identifies a potential welfare concern in a conversation, the AI response is suppressed and replaced with a welfare support message (details of Childline, the Samaritans, and Crisis Text Line). This is not a decision about the student; it is a safety intervention. A member of our welfare team reviews flagged conversations manually.
Other automated processing
In some other instances, our use of your personal data may involve automated decisions (including profiling) to decide which educational services apply to you based on your account data. These are unlikely to be decisions that legally or significantly affect you. Where we make such automated decisions, you have the right to contest the decision, express your point of view, and request human review. To exercise this right, contact us using the details in Section 13.
10. Your data protection rights
Individuals located in the UK and EEA have the following data protection rights. To exercise any of them see specific instructions below or contact us using the contact details provided under the “How to contact us” heading below (section 13).
• You may access, correct, update or request deletion of your personal data.
• You can object to processing of your personal data, ask us to restrict processing of your personal data or request portability of your personal data, (i.e. your data to be transferred in a readable and standardised format.
• You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), please get in touch with us using the contact details provided under the “How to contact us” heading below (section 13). If you choose to opt out of marketing communications, we will still send you Service-related communications necessary for us to deliver the service to you (see below)
• To enable you to use the service, from time to time, we will need to send you Service-related communications. These may include lesson reminders, weekly parent reports on attendance and performance, notifications about missing homework, alerts regarding account inactivity, and updates relating to lesson rescheduling. These communications are sent on the basis of our legitimate interests in delivering and improving our services and do not require prior consent.
• If we have collected and processed your personal data with your consent, then you can withdraw your consent at any time by using the contact details provided under the “How to contact us” heading below (section 13). Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.
• You may have the right to complain to a supervisory authority about our collection and use of your personal data. For more information, please contact your local supervisory authority. Contact details for supervisory authorities in Europe are available here and for the UK here. Certain supervisory authorities will require that • you exhaust our own internal complaints process before looking into your complaint.
• Research processing. Where processing for direct ONS/DfE access is based on legitimate interests, you have the right to object at any time by contacting [email protected]. Where processing is based on consent (self-reported data and research partnerships), you may withdraw consent at any time.
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
11. Third Parties
Our services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Notice does not apply to your activities on those third party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.
12. Updates to this Privacy Notice
We may update this Privacy Notice from time to time in response to changing legal, regulatory, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.
You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.
13. How to contact us
If you have any questions or concerns about our use of your personal data, please contact our data protection officer using the following details: [email protected] or you can write to us:
71-75 Shelton Street WC2H 9JQ
MyEdSpace Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZB855656.