Privacy Policy
Last updated: 26 June 2026
This privacy policy explains how PupilPower collects and uses personal data through our website, pupilpower.com - including when you contact us or use our contact form. It applies to our website only. It does not cover the PupilPower software product.
This is a website privacy policy. It covers the personal data we collect from people who visit pupilpower.com or get in touch with us - for example, teachers, SENCOs, and staff at schools and organisations.
It does not cover the PupilPower product. Any personal data relating to children - including eye-tracking, assessment or other data generated when the product is used in a school - is handled entirely separately, under the agreements and privacy information put in place with the relevant school, trust or organisation. None of that data is collected through this website.
1. Who we are
PupilPower is the "data controller" for the personal data described in this policy. This means we are responsible for deciding how and why your data is used.
- Company name: PupilPower Ltd
- Registered in: England and Wales
- Company number: 16625108
- Contact for data protection matters: hello@pupilpower.com
If you have any questions about this policy or about how we use your data, please contact us using the details above.
2. The personal data we collect
When you use our contact form, we ask for and collect:
- Your name
- Your email address
- Your role and the school or organisation you are part of
- Your response to the question about the biggest challenge you face in supporting children early
When you use our website, we may also collect limited technical data automatically, such as your IP address, browser type and information about how you use the site. See the Cookies and analytics section below.
Please don't include sensitive information in the free-text field. The "biggest challenge" box is for general context about your work. Please do not enter special category data (such as health, disability or diagnostic details) or any information that identifies a specific child. If you need to discuss something specific, we'll arrange an appropriate and secure way to do so.
3. How we use your data, and our lawful basis
Under UK data protection law, we must have a valid "lawful basis" for using your personal data. The table below sets out what we do and why.
| What we do | Why | Lawful basis |
|---|---|---|
| Respond to your enquiry and contact you about it | So we can answer your question and follow up | Legitimate interests - it is in our interest, and yours, to respond to enquiries we receive |
| Keep a record of your enquiry in our systems | To manage our relationship with you and keep track of who we are speaking to | Legitimate interests - running and developing our organisation |
| Understand the challenges schools and organisations face, to improve our service | To shape PupilPower around real needs in the sector | Legitimate interests - improving and developing our product |
| Send you updates or marketing about PupilPower (only if relevant) | To keep you informed where you would expect or have asked to hear from us | Consent, or legitimate interests with an easy opt-out, as permitted by law |
| Comply with our legal obligations | Where the law requires us to | Legal obligation |
Marketing: We will only send you updates or marketing where you have agreed, or where we are otherwise permitted to do so. You can opt out at any time by emailing us at hello@pupilpower.com, and we will stop.
Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights, and we are satisfied they are not. You can ask us for more detail about this assessment, and you have the right to object (see Your rights).
4. Who we share your data with
We don't sell your personal data. We do share it with a small number of trusted service providers ("processors") who help us run our organisation. These currently include:
- A CRM / contact management system - to store and manage enquiries and contacts.
- Knowledge and workspace tools - to organise our work, including records of enquiries.
- A website platform and hosting provider - to build and host our website, and to process information submitted through it.
- A database / backend provider - to store the data submitted through our website, including contact form enquiries.
- An email sending service - to send emails, such as confirmations and notifications relating to your enquiry.
- An email provider - to send and receive messages and correspond with you.
- A website analytics provider - to understand how our website is used.
Each of these providers is GDPR-compliant and acts on our instructions under a written data processing agreement, and is only permitted to use your data to provide their service to us. We may also disclose data where required by law or to protect our legal rights. We can provide the names of our current processors on request - please contact us at hello@pupilpower.com.
5. Sending data outside the UK
Some of our service providers are based outside the UK, or store data outside the UK (for example, in the United States). Where your personal data is transferred outside the UK, we make sure it is protected by appropriate safeguards recognised under UK data protection law - for example, a UK "data bridge" (adequacy decision) where one applies, or the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
You can ask us for more information about these safeguards using the contact details in section 1.
6. How long we keep your data
We keep your personal data only for as long as we need it for the purpose it was collected. How long that is depends on the nature of our contact with you:
- General enquiries (no ongoing relationship): where you contact us with a one-off question that does not lead to an ongoing relationship, we keep your data for 3 to 6 months and then delete it.
- Potential leads and prospective partners: where your enquiry relates to a possible working relationship, we keep your data while you are considering working with us, for up to 1 to 2 years from our last meaningful contact.
- Customer, support and contractual matters: where our contact relates to a contract or service, we keep relevant records for up to 6 years (5 years in Scotland). This reflects the time limits for bringing legal claims under the Limitation Act 1980, and provides an audit trail in case of a dispute.
After these periods we delete or anonymise your data, unless we are required to keep it for longer by law. If you ask us to delete your data sooner, we will do so unless we have a legal reason to keep it.
7. Your rights
Under UK data protection law, you have the right to:
- Be informed about how we use your data (which this policy is intended to do)
- Access the personal data we hold about you
- Rectification - ask us to correct data that is inaccurate or incomplete
- Erasure - ask us to delete your data in certain circumstances
- Restrict how we use your data in certain circumstances
- Object to us using your data where we rely on legitimate interests, and to object to direct marketing at any time
- Data portability - ask us to transfer your data in certain circumstances
- Withdraw consent at any time, where we rely on consent
To exercise any of these rights, contact us using the details in section 1. We will respond within one month. There is normally no charge.
Complaints
If you are unhappy with how we have handled your personal data, you have two options:
- Complain to us directly. Please contact us using the details in section 1, and we will look into it. We will acknowledge your complaint, investigate it without undue delay, and keep you informed of the outcome.
- Complain to the regulator. You can complain to the Information Commissioner's Office (ICO) - the UK's data protection regulator. We would, however, appreciate the chance to address your concerns first.
The ICO is being reconstituted as the Information Commission under the Data (Use and Access) Act 2025. Its contact details remain the same for now.
- Website: ico.org.uk
- Helpline: 0303 123 1113
8. Cookies and analytics
We use Google Analytics to understand how visitors use our website - for example, which pages are visited and how people arrive at the site. Google Analytics sets cookies and processes limited data about your visit. We use this only to improve our website, not to identify you personally.
You can control or refuse cookies through your browser settings, and you can opt out of Google Analytics specifically by installing Google's browser opt-out add-on.
9. How we keep your data secure
We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. Access to enquiry data is limited to people who need it to do their job.
10. Children
Our website and contact form are intended for use by adults - for example, teachers, SENCOs, school and trust staff, and people at partner organisations. They are not intended for use by children. As noted at the top of this policy, data relating to children that arises from the PupilPower product is handled separately under arrangements with the relevant school or organisation.
11. Changes to this policy
We may update this policy from time to time. When we do, we will change the "last updated" date at the top. If we make significant changes, we will take reasonable steps to bring them to your attention.
12. Contact us
If you have any questions about this policy or about how we use your personal data, please contact us at hello@pupilpower.com.