Privacy Policy

Scholarised (“the Company”, “we”, “us”) is the data controller for personal data processed through Scholarised. We are based in United Kingdom. We process personal data in line with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

For any privacy question, or to exercise a right described below, contact us at [email protected].

• Account data - your name, email address, password (stored encrypted) and the role you hold (student, parent, mentor and so on).
• Profile data - optional details you add, such as an avatar, bio, subjects or availability.
• Children’s data - where a parent sets up a linked child account, the child’s name and learning activity, managed by the parent.
• Mentor verification data - information mentors provide for approval and background (DBS) checks. This can include special category and criminal-record information, handled with extra care and only for safeguarding.
• Booking and learning data - sessions you book or deliver, course progress, quiz results and certificates.
• Payment data - credit purchases and payout records. Card payments are processed by Stripe; we do not store full card numbers.
• Communications - messages you send us and your notification preferences.
• Technical data - limited information needed to run and secure the service, such as sign-in session data.

We use personal data for the following purposes, relying on these UK GDPR lawful bases:

• To provide the service - creating your account, running sessions, courses, credits and payouts. Lawful basis: performance of a contract.
• To take payment - processing credit purchases and mentor payouts. Lawful basis: performance of a contract.
• To keep the platform safe - vetting mentors, background checks and safeguarding. Lawful basis: legal obligation and substantial public interest (safeguarding), and our legitimate interest in a safe service.
• To communicate with you - service messages, session reminders and support. Lawful basis: performance of a contract and our legitimate interests.
• To improve and secure the service - maintaining, protecting and improving the platform. Lawful basis: our legitimate interests, balanced against your rights.
• To meet legal duties - keeping records and responding to lawful requests. Lawful basis: legal obligation.

Where we rely on consent (for example any optional communications), you can withdraw it at any time without affecting processing that already took place.

Scholarised is used by children, so we follow the principles of the UK Children’s Code (the Age Appropriate Design Code). In practice this means:

• The best interests of the child come first when we design features and decide how data is used.
• High privacy by default - child accounts are set to the most protective settings, and we do not make a child’s data or profile public.
• Data minimisation - we collect only what a child account needs to learn and be kept safe, and no more.
• No profiling of children for marketing, and no advertising based on their behaviour.
• We do not use nudge techniques to encourage children to weaken their privacy or share more data.
• Parental involvement - child accounts are set up and overseen by a parent or guardian, and we give parents visibility of and control over their child’s account.
• Clear, age-appropriate information so young people can understand how their data is used.

If you believe a child has given us data without the involvement of a parent or guardian, contact us and we will take appropriate steps, including deleting it where required.

We do not sell your personal data. We share it only where needed to run the service:

• Mentors and learners - the limited information needed to arrange and deliver a booked session (for example a first name and the session details).
• Stripe - our payments provider, to take payment for credits and pay mentors.
• Background-check provider - to carry out mentor DBS checks, for mentors only.
• Infrastructure and email providers - the hosting and email services that run the platform and send service messages, acting on our instructions.
• Authorities - where we are legally required to, or where it is necessary to protect a child or investigate a safeguarding concern.

Our providers act as our processors under contracts that require them to protect your data and use it only for the services they provide to us.

Some providers may process data outside the UK. Where they do, we rely on safeguards recognised under UK data protection law (such as UK adequacy regulations or the International Data Transfer Agreement) so your data keeps an equivalent level of protection.

We keep personal data only as long as we need it for the purposes above, then delete or anonymise it. In practice we keep account data while your account is active and for a reasonable period afterwards; we keep payment and payout records for as long as tax and accounting law requires; and we keep safeguarding records for as long as is appropriate to protect children. Where you ask us to delete your account, we do so unless we must keep certain records by law.

We use only the cookies and local storage needed to make the platform work - for example to keep you signed in and to remember basic preferences. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings, though the service may not work properly without the essential ones.

We use appropriate technical and organisational measures to protect personal data, including encryption of passwords and in transit, access controls, and secure handling of sensitive mentor verification data. No online service can be completely secure, but we work to protect your information and to respond quickly to any issue. If a data breach is likely to be a risk to you, we will notify you and the Information Commissioner’s Office (ICO) as the law requires.

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to how we use your data;
• receive certain data in a portable format;
• withdraw consent where we relied on it.

To exercise any of these, contact us at [email protected]. We will respond within the time limits set by law. There is normally no charge.

Children have the same data rights as adults. For younger children, a parent or guardian usually exercises these rights on their behalf; older children may exercise their own rights where they are able to understand them. Parents managing a linked child account can view and update that account and can ask us to correct or delete the child’s data.

We do not make decisions that have a legal or similarly significant effect on you using automated processing alone, and we do not profile children for marketing.

We may update this policy from time to time. If we make a significant change we will take reasonable steps to tell you, for example by a notice in the app or by email. The “last updated” date at the top shows when it last changed.

If you have a question or concern about your data, please contact us first at [email protected], or by post at Scholarised, United Kingdom. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk. We would appreciate the chance to address your concern before you approach the ICO.