Privacy Policy

SEAG Success ("we", "us" or "our") is committed to protecting the privacy and personal data of everyone who uses our platform. This Privacy Policy explains what data we collect, why we collect it, how we use it, and the rights you have under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By using SEAG Success, you agree to the practices described here.

1. Who We Are

SEAG Success is operated by its founders, a husband and wife who are both Northern Ireland-based educators. For all data-related enquiries, please contact us at admin@learningsuccess.co.uk.

2. What Data We Collect

2.1 Account Information

When you register for an account, we collect:

• Parent/guardian name and email address
• A securely hashed password
• Your child's first name (or a chosen display name), year group, and date of birth
• Your school (if applicable)

For school accounts, we also collect school name and the contact details of the teacher or administrator who registers.

2.2 Usage and Practice Data

When your child uses the platform, we collect:

• Answers given to practice questions
• Scores and results from practice papers
• Time spent on each session and any pause activity
• Topics accessed and questions attempted

This data is used solely to provide the service — to generate personalised feedback, calculate scores, populate the parent and teacher dashboards, and prioritise unseen questions in future papers.

2.3 Newsletter and Email Subscribers

If you sign up for our newsletter or email updates via our website, we collect your email address. This is used solely to send you news, tips, and updates about SEAG Success. You can unsubscribe at any time by emailing admin@learningsuccess.co.uk.

2.4 Contact Form Data

If you contact us via our website forms, we collect your name, email address and the content of your message. School enquiry forms additionally collect your school name, role, phone number (optional) and pupil numbers. This information is used only to respond to your enquiry.

2.5 Technical Data

We automatically collect certain technical data when you use our platform, including:

• IP address (used for rate-limiting login attempts and fraud prevention)
• Anonymised IP address (last octet removed, e.g. 192.168.1.0) recorded with each page visit for self-hosted analytics purposes
• Browser type and device information
• The URL path visited and referring URL
• Session data stored in a secure server-side session

Page visit logs are retained for up to 90 days and are used solely for understanding how the platform is used (e.g. which pages are visited and overall traffic levels). We do not use third-party analytics trackers such as Google Analytics.

3. Lawful Basis for Processing

We process your personal data on the following legal bases:

• Contract performance: To provide the SEAG Success service you or your school has subscribed to.
• Legitimate interests: To improve the platform, prevent fraud and protect the security of our service.
• Legal obligation: To comply with applicable laws and regulations.
• Consent: For any optional communications (where applicable).

4. Children's Data

SEAG Success is designed for use by P6 and P7 primary school pupils (typically aged 10–12) under the supervision of a parent, guardian or teacher. We do not knowingly collect personal data directly from children without verifiable parental or school consent. Accounts for children are created and managed by a parent, guardian or school administrator.

We collect only the minimum child data necessary to deliver the service: a display name, year group, date of birth, and practice activity. Date of birth is used to provide age-appropriate content and to notify parents when their child approaches the transition from primary to post-primary education. We do not collect children's email addresses, home addresses or any other unnecessary personal information.

5. How We Share Your Data

We do not sell or rent your personal data to third parties. We may share data in the following limited circumstances:

• School access: If your child is enrolled through a school account, the relevant teacher(s) and school administrator can view their practice results and progress data.
• Hosting providers: Our platform is hosted on IONOS servers. Data is stored within the EEA. IONOS acts as a data processor under a data processing agreement.
• Payment processing: Subscription payments are processed by Stripe, Inc. When you subscribe, your payment card details are handled directly by Stripe and are never stored on our servers. Stripe acts as a data processor under their own Data Processing Agreement. See stripe.com/gb/privacy for Stripe's privacy policy.
• Legal requirements: We may disclose data if required by law or to protect the safety of any person.

6. Data Retention

We retain your personal data for as long as your account is active. If you close your account, we will delete your personal data within 60 days, except where we are required to retain it by law.

Contact form submissions are retained for up to 12 months for the purposes of responding to enquiries.

7. Cookies

We use essential session cookies to keep you logged in during your visit. These cookies are strictly necessary for the platform to function and are deleted when you close your browser (or when your session expires). If you select "Remember me for 30 days" at login, a persistent cookie is stored for that duration to restore your session. We do not use third-party tracking, advertising or analytics cookies.

8. Security

We take appropriate technical and organisational measures to protect your personal data, including:

• All passwords are hashed using bcrypt — we never store passwords in plain text
• CSRF token protection on all forms and API endpoints
• Rate-limiting on login attempts to prevent brute-force attacks
• HTTPS encryption for all data in transit

No method of transmission over the internet is completely secure, but we are committed to using industry-standard practices.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate data.
• Right to erasure: You can ask us to delete your data ("right to be forgotten").
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can ask for your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests.

To exercise any of these rights, email us at admin@learningsuccess.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page will always reflect the most recent version. Significant changes will be communicated to registered users by email.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at admin@learningsuccess.co.uk.