Privacy & Cookie Policy

At Learning Loft, we are committed to protecting the privacy and security of all users, including children, parents, teachers, and school staff. This Privacy & Cookie Policy explains what personal data we collect, why we collect it, how we store and protect it, and your rights regarding that data. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all relevant guidance from the Information Commissioner's Office (ICO). Where children's data is involved, we take additional safeguarding measures in line with the Children's Code (Age Appropriate Design Code).

We collect only the minimum data necessary to deliver our educational services. This may include:

• Account Information: Name, email address, school or organisation name, job role
• Student Data: First name, class/year group, reading levels, quiz results, assessment scores, and learning progress
• Usage Data: How users interact with apps and features (e.g. pages visited, features used, time spent)
• Technical Data: IP address, browser type, device information, and operating system
• Communication Data: Messages sent via the platform, feedback forms, and support requests

We do not collect sensitive personal data (such as ethnicity, religion, or health data) unless explicitly provided by a school under a separate Data Processing Agreement.

Your data is used strictly for the following purposes:

• To provide access to our educational apps and platform features
• To personalise learning experiences for students (e.g. recommended books, adaptive quizzes)
• To track and report on student progress to teachers and parents
• To communicate important updates, such as changes to our terms or new features
• To ensure platform security, prevent fraud, and detect misuse
• To respond to support requests and feedback

We do not sell, rent, or share your data with third parties for marketing purposes.

We take the security of your data extremely seriously:

• All data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Data is stored on secure, ISO 27001 certified cloud infrastructure
• Access to personal data is restricted to authorised personnel only
• We conduct regular security reviews and vulnerability assessments
• Student data is logically separated by school/organisation
• We maintain audit logs of data access for accountability

We retain personal data only for as long as necessary:

• Active accounts: Data is retained for the duration of the account or subscription
• Inactive accounts: Data is deleted or anonymised after 24 months of inactivity
• Student data: Deleted within 90 days of a school ending their subscription, unless transfer is requested
• Backup data: Removed from backups within 30 days of deletion from live systems

Schools may request earlier deletion at any time by contacting us.

Learning Loft is designed for use by children in educational settings. We recognise the additional responsibility this places on us:

• Children's data is processed under the lawful basis of legitimate interests (educational provision) or contractual necessity with the school
• We do not require children to create accounts with personal email addresses
• We do not use children's data for profiling, advertising, or any purpose beyond education
• All content moderation features are designed with child safety in mind
• Schools act as the data controller for student data; Learning Loft acts as the data processor

Under the UK GDPR and Data Protection Act 2018, you have the right to:

• Access — Request a copy of the personal data we hold about you
• Rectification — Request correction of inaccurate or incomplete data
• Erasure — Request deletion of your data ("right to be forgotten")
• Restriction — Request that we limit how we process your data
• Portability — Request your data in a machine-readable format
• Objection — Object to processing of your data
• Withdraw consent — Where processing is based on consent, withdraw it at any time

To exercise any of these rights, please contact us at info@learningloft.co.uk

We will respond to all data rights requests within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use a limited number of trusted third-party services to operate our platform:

• Cloud hosting: For secure data storage and application delivery
• Authentication: For secure login and session management
• Analytics: For understanding platform usage (anonymised where possible)

All third-party providers are vetted for GDPR compliance and are bound by data processing agreements. We do not share identifiable student data with any third party without explicit consent from the school.

In the unlikely event of a data breach:

• We will notify the ICO within 72 hours where required
• We will notify affected schools and individuals without undue delay
• We will provide a clear description of the breach, the data involved, and the steps taken to mitigate it
• We maintain an internal breach register and conduct post-incident reviews