Store My Library
About Contact

PARENT & STUDENT PRIVACY NOTICE

Privacy Notice

How we use and protect parent and student personal information

Version 1.0 | Effective 24 August 2026

This Privacy Notice explains how Student Success Formula Ltd uses personal information about parents/carers and students aged 11-18. It is a notice, not a request to waive privacy rights. We design our handling of children's information with their best interests in mind.

1. Who we are

Student Success Formula Ltd is the data controller. Company number 09420874. Registered office: Tbxh@ Sunley House, Bedford Park, Croydon, United Kingdom, CR0 2AP. Privacy enquiries: [email protected] or +44 7961 311717.

2. Information we collect

  • Parent/carer details: name, relationship to the student, contact details, account details, purchase, payment and contract records.
  • Student details: name, date of birth, approved display name or nickname, age cohort and school year (but we do not ask for the school name as standard).
  • Learning information: subjects, exam boards, goals, strengths, study challenges, quiz results, course progress, attendance, agreed actions and coaching notes.
  • Optional support information: accessibility needs, SEND or other information a parent chooses to provide so we can make reasonable adjustments. Please provide only what is relevant.
  • Participation information: Community posts, chat, polls, submitted work, feedback, live-session participation and communications with us.
  • Recordings: image, voice, approved display name, chat, screen share or work shown during recorded group or one-to-one sessions.
  • Technical information: login, device, browser, IP address, security and platform activity records, plus cookies or similar technologies described by the platform cookie notice.
  • Safety and administration information: moderation, safeguarding, complaints, warnings, incidents and support requests.

3. Why we use it and our lawful bases

  • Contract: to enrol the student, provide the course, coaching, Community, archives and support; administer access and payments; and communicate about the service.
  • Legitimate interests: to keep the service safe, moderate activity, prevent misuse, improve quality, maintain records, investigate concerns and protect our rights. Where a child is involved, we weigh these interests against the child's rights and best interests.
  • Legal obligation: to meet accounting, tax, consumer, data-protection and safeguarding duties.
  • Vital interests: in a genuine emergency where using information is necessary to protect someone.
  • Consent or explicit consent: where required, for optional marketing or relevant special-category information. Consent may be withdrawn without affecting earlier lawful use.

We do not sell personal information. We do not use student information for targeted advertising or make decisions about students solely by automated means that produce legal or similarly significant effects.

4. Age-separated access and privacy controls

Students are placed in ages 11-13, 14-16 or 17-18 access groups. Students do not have direct messaging or a public member directory. They must use a first name or approved nickname and must not share surnames, school names, addresses, telephone numbers or social-media handles. Access is changed when a student moves cohort.

5. Live sessions and recordings

  • Group sessions are normally recorded. Recordings are placed only in restricted archives for authorised students. A student moving cohort may keep recordings previously made available from the former cohort while enrolled, but does not receive future former-cohort recordings.
  • One-to-one sessions are normally recorded and placed in the student's restricted personal portal. They are for that student and authorised parent/carer only.
  • Cameras are optional in group sessions. Students must still engage appropriately through voice, chat, polls, reactions or agreed activities.
  • Participants must not download, screen-record, photograph, copy or share another person's image, voice, work, messages or personal information.
  • We may edit, withhold or remove a recording for safety, privacy, quality, legal or technical reasons.

6. Who receives information

We share information only as reasonably necessary with service providers that help us operate, such as Kajabi, payment processors, video-meeting, cloud-storage, email and communications providers; authorised DBS-checked staff or contractors; professional advisers and insurers; and regulators, police, social services or other authorities where required for safeguarding or law. Providers act under appropriate contractual and security requirements where applicable.

If you choose to contact us through WhatsApp, Meta processes information under its own terms. For privacy or cancellation requests, email or telephone may be more appropriate. We do not ask parents to send detailed sensitive information in a WhatsApp message.

7. International transfers

Some service providers may process information outside the United Kingdom. Where UK data-protection law requires it, we use an approved safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, and assess supplementary safeguards where appropriate.

8. How long we keep information

  • Contracts, payment, tax and core transaction records: normally six years after the end of the financial year or contract, as appropriate.
  • Account, onboarding, course progress and routine coaching records: while enrolled and normally up to 12 months afterwards, unless needed longer for a dispute, safeguarding or legal obligation.
  • Group recordings: normally up to three years from recording where needed for an authorised archive, and possibly less where privacy or safeguarding requires removal.
  • One-to-one recordings: while enrolled and normally for 90 days after the service ends, unless the parties agree a shorter period or the recording is needed for a concern or legal claim.
  • Community content: while the account or relevant space is active and normally up to 12 months afterwards, subject to platform controls and safety needs.
  • Complaints and legal records: normally up to six years after closure. Safeguarding records are retained according to the circumstances and applicable safeguarding guidance.

These periods are working standards, not promises to retain every item for the full period. We may delete or anonymise information sooner where it is no longer needed.

9. Security

We use proportionate access controls, age separation, account security, restricted archives, moderation, staff controls and secure service providers. No online service can guarantee absolute security. Parents and students must protect login details and report suspected unauthorised access promptly.

10. Your rights

  • Ask for access to personal information and a copy of it.
  • Ask us to correct inaccurate or incomplete information.
  • Ask for erasure or restriction where the law provides this right.
  • Object to processing based on legitimate interests or to direct marketing.
  • Ask for data portability where the legal conditions apply.
  • Withdraw consent at any time where consent is the basis used.
  • Complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Children have their own data-protection rights. A parent may usually help a child exercise them, but we may consider the child's age, understanding, best interests and confidentiality before responding. We may need to verify identity.

11. Safeguarding and emergencies

For a safeguarding concern, email [email protected] with the subject “URGENT Safeguarding Concern” or call +44 7961 311717. These channels are not continuously monitored emergency services. If someone is in immediate danger, call 999.

12. Changes and questions

We review this notice and will tell parents about material changes before a new use begins where required. Questions or rights requests may be sent to the contact details above.

Authoritative guidance

This notice has been prepared with reference to the UK GDPR transparency requirements and the ICO's guidance on children's information, lawful bases and individual rights. It should be reviewed when providers, retention practices or programme features change.