Data Protection Policy

1. Purpose and Scope

This policy sets out how Portsdown Tuition (the operator of SoloCogs, Portsmouth) complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all personal data processed through SoloCogs, regardless of format.

2. Data Protection Principles

All personal data processed by SoloCogs must comply with the following principles (UK GDPR Article 5):

1. Lawfulness, fairness and transparency - data is processed lawfully and transparently
2. Purpose limitation - data is collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes
3. Data minimisation - data collected is adequate, relevant, and limited to what is necessary
4. Accuracy - data is accurate and kept up to date
5. Storage limitation - data is kept no longer than necessary for its purpose
6. Integrity and confidentiality - data is processed securely, protecting against unauthorised access, loss, or destruction
7. Accountability - the data controller (Portsdown Tuition) is responsible for and able to demonstrate compliance

3. Data Controller

Portsdown Tuition (sole-trader operator of SoloCogs) is the data controller for all personal data processed through this platform. As a small organisation, a Data Protection Officer (DPO) is not legally required; however, data protection responsibility rests with Portsdown Tuition directly.

4. Categories of Data Processed

Standard personal data

• Names, email addresses, year groups
• Account credentials (hashed passwords)
• Subscription and billing information
• Login and session timestamps

Special category data

• Student emotional wellbeing data (Zones of Regulation check-ins, including written notes)
• Safeguarding records, including disclosures
• Learning data that may reflect educational needs or neurodivergent profiles

Special category data is processed only where there is a lawful basis to do so, including safeguarding obligations under the Children Act and Schedule 1 of the Data Protection Act 2018.

5. Lawful Bases for Processing

SoloCogs processes data on the following lawful bases:

• Contract (Art. 6(1)(b)): to deliver the platform and tuition services
• Legal obligation (Art. 6(1)(c)): safeguarding disclosures, statutory reporting
• Legitimate interests (Art. 6(1)(f)): platform security, fraud prevention, service improvement
• Vital interests (Art. 6(1)(d)): where a child's safety requires immediate action

6. Data Security Measures

SoloCogs implements the following technical and organisational security measures:

• All data transmitted over HTTPS using TLS encryption
• Database hosted on Supabase with Row-Level Security (RLS) policies restricting data access to authorised users only
• Passwords hashed using industry-standard algorithms; plain-text passwords are never stored
• Safeguarding and wellbeing data accessible only to the DSL
• Regular review of access controls and third-party processor agreements

7. Third-Party Processors

SoloCogs uses the third-party processors listed below. The full, dated, versioned register (the canonical source for procurement) lives at policy-sub-processors.html; the summary here is aligned with it.

• Supabase Inc. - database, authentication, storage. Data hosted in the UK (London, AWS eu-west-2). Supabase DPA signed via Dashboard → Organization → Legal Documents.
• Cloudflare, Inc. - hosting, CDN, DDoS protection. Handles connection-level metadata only. Cloudflare DPA signed via Dashboard → Manage Account → Configurations.
• Stripe Payments Europe Ltd. - sole payment processor for all consumer and school subscriptions. Receives billing data only; never receives child or learning data. Independent controller for card data.
• Google LLC (Google Cloud + Gemini API) - AI-assisted generation of teacher-side educational illustrations. No student data is ever sent to Google. Google Cloud DPA accepted at project creation.
• Google LLC (Tag Manager) - client-side tag orchestration. Gated on consent - no analytics tags fire until the cookie banner is accepted.
• Google LLC (Google Analytics 4) - anonymised page-view + event analytics. Only if the user accepts analytics via the cookie banner. Google acts as an independent controller for the cookies it sets.
• jsDelivr (Prospect One) + Google Fonts - public CDNs delivering the Supabase JavaScript SDK and the Atkinson Hyperlegible / Lexend web fonts to the browser. See only the connection metadata, never any account data.
• Transactional email provider (Supabase Auth + Resend) - sends account emails (password reset, subscription receipts, safeguarding referrals where applicable). DPA covered by the Supabase agreement; Resend acts as sub-processor to Supabase.
• Wonde (Wonde Ltd) - UK Management-Information-System aggregator, engaged only once school-roster sync is turned on for a specific school. Added to a school customer's arrangement with 30 days' notice; not used for consumer accounts.
• Statutory agencies - police, social services, NSPCC, ICO - where a safeguarding obligation or legal requirement to share is triggered. Not a routine sub-processor.

Any new third-party processor will be assessed for GDPR compliance before engagement, and a DPA will be in place before any personal data is shared. Existing customers will be notified at least 30 days in advance.

8. International Transfers

Personal data is primarily hosted in the UK (Supabase Postgres cluster in AWS eu-west-2, London). Where a specific transfer outside the UK is required (for example, Google Cloud regions serving the Gemini API used only for teacher-side illustration generation, or Stripe processing card data via its EU / global network), we rely on the UK's adequacy decisions where available and on the ICO's approved International Data Transfer Addendum + Standard Contractual Clauses where not. No transfer of student personal data outside the UK is made for the core learning service.

9. Data Retention Schedule

• Account data (active): Retained for the life of the account
• Account data (closed): Deleted within 90 days of closure
• Learning and progress data: Up to 3 years after last login. This includes any read-only snapshot kept when a student chooses to start afresh - see the Data Retention section of the privacy notice.
• Safeguarding records: Minimum 7 years, or until the data subject reaches age 25
• Financial/billing records: 6 years, as HMRC requires business records to be kept for six years from the end of the financial year they relate to

10. Data Breach Response

In the event of a personal data breach, SoloCogs will:

1. Contain and assess the breach as quickly as possible
2. Determine whether notification to the ICO is required (required within 72 hours where the breach is likely to result in risk to individuals' rights and freedoms)
3. Notify affected individuals where there is a high risk to their rights and freedoms
4. Document the breach, its effects, and the remedial action taken

To report a suspected data breach, contact Jazz immediately via the contact page.

11. Data Subject Rights

Individuals whose data we process have the following rights under UK GDPR. Requests will be responded to within one calendar month:

• Right of access (Subject Access Request)
• Right to rectification
• Right to erasure ("right to be forgotten"), subject to legal retention requirements
• Right to restriction of processing
• Right to data portability
• Right to object
• Rights related to automated decision-making (SoloCogs does not make solely automated decisions with legal or significant effect)

12. Policy Review

This policy is reviewed annually and updated following any significant change to legislation, platform processing activities, or data breach incidents.