Privacy Notice

1. Who controls your information

Grierson Teacher Coaching is the data controller for the information described here. Where a school supplies participant details or manages its staff, the school may also be a controller for its own use of that information.

2. Information we collect

• identity, account and contact details, including name, email and telephone number;
• school, organisation, role, team membership and licence information;
• programme progress, answers, reflective notes, coaching goals, messages, feedback and certificates;
• order, invoice, payment status and transaction references (Stripe processes complete card and bank details; we do not store your complete card number);
• support, complaint, cancellation and other correspondence;
• security and technical records such as sign-ins, authentication state, device/browser information, IP address and audit logs; and
• launch-list details: first name, email, and the date and wording of consent.

We normally receive information from you, your school or organisation, other authorised team members, and our payment and technical providers.

3. Why we use it and our lawful bases

• Contract: to create accounts, take and administer orders, provide programme access, coaching, support, certificates, invoices and service messages.
• Legitimate interests: to operate and improve a secure coaching service, manage school relationships, prevent fraud and misuse, keep appropriate audit records, and respond to enquiries. We balance these interests against your rights.
• Legal obligation: for tax and accounting records, legal claims, consumer requests, safeguarding duties where applicable, and compliance with lawful requests.
• Consent: for launch notifications and any other optional communication described when you choose it. You may withdraw consent at any time.

Information needed to create an account, provide a place or complete a purchase is contractual. If it is not provided, we may be unable to supply that part of the service.

If you ask to be notified when programme enrolment opens, we use your launch-list details only for that notification and reasonable follow-up. They are not added to an unrelated marketing list, and are kept until the opening notification and follow-up period have passed unless you withdraw consent sooner.

4. Coaching reflections and sensitive information

Coaching responses may reveal health, disability, ethnicity, religious beliefs, trade-union membership or other special-category information even though we do not ask you to provide it. Please avoid including unnecessary sensitive information and do not identify pupils, parents or colleagues in reflections or messages.

Where sensitive information is volunteered and genuinely needed to provide the coaching you requested, we handle it with additional care and rely on the applicable UK GDPR condition, which may include your explicit consent. Where a safeguarding or legal issue arises, another condition permitted by law may apply. Contact us if you want sensitive information reviewed or removed.

5. Who receives information

Access is limited to authorised Grierson Teacher Coaching staff and coaches who need it. School team managers can see administrative information about their organisation, such as membership, assigned places and completion status; reflective coaching content is not made available to them unless the service clearly says so or you choose to share it.

We use service providers acting under contract, including Supabase for authentication, database and file infrastructure, Vercel for website hosting, Stripe for payment and invoicing, and Resend for service emails. We may also disclose information to professional advisers, regulators, courts, law enforcement, or another party where the law requires or permits it. We do not sell personal information.

6. International transfers

Some providers or their sub-processors may process information outside the United Kingdom. Where UK adequacy regulations do not apply, we use an approved safeguard such as the UK International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, together with appropriate technical and organisational measures. Contact us for more information about the safeguard relevant to your information.

7. How long we keep information

We keep account, programme and coaching records while access is active and normally for up to 24 months afterwards so we can provide support, handle disputes and maintain continuity. We may delete or anonymise them sooner where appropriate. Financial, order and tax records are normally retained for up to six years after the relevant accounting period or transaction. Security logs and failed or expired transaction records are kept only for the period reasonably needed to protect the service and investigate issues.

Launch-list details are kept until the opening notification and a reasonable follow-up period have passed, unless you withdraw consent sooner. Complaints, safeguarding information or legal claims may be retained longer where the circumstances or law require it. We consider the nature, sensitivity and legal purpose of information when applying these periods.

8. Security and automated decisions

We use access controls, encrypted connections, authentication controls, audit records, backups and provider security measures appropriate to the service. No online system is completely risk-free, so please use a strong unique password and tell us promptly about suspected unauthorised access.

We do not use your information to make solely automated decisions that produce legal or similarly significant effects. Stripe may use automated tools to help detect payment fraud under its own privacy notice.

9. Cookies and similar storage

The platform uses essential browser storage and cookies needed for sign-in, security and core preferences. We do not currently use non-essential advertising or behavioural-tracking cookies. If that changes, we will update this notice and request consent where required.

10. Your rights

Depending on the circumstances, you may ask for access to your information, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Some rights are subject to legal exceptions.

Email us using the address above. We may need to verify your identity and will normally respond within one month. You will not usually be charged. If your school controls the information concerned, we may direct the request to its appropriate contact.

You may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113. We would appreciate the opportunity to address your concern first.

11. Changes to this notice

We may update this notice when our service, providers or legal duties change. The date above shows the current version. We will draw attention to a material change through the platform or by email where appropriate.