Legal
Privacy notice
The short version for children
ElevenMaths keeps the information needed to give you lessons, save your work and help your teacher support you. Your account is created for you; there is no public sign-up.
- Your teacher can see your learning and the work for your class.
- We do not sell your information or use it to build advertising profiles.
- We try to collect as little information about you as we can.
- You or your parent or carer can ask us what we hold, correct it, or ask us to delete it.
If anything here is unclear, ask an adult you trust or email contact@elevenmaths.co.uk.
Who this notice is for
This notice covers children using ElevenMaths, their parents or carers, teachers, and people who enquire about the course. It explains how the organisation operating ElevenMaths acts as data controller. The controller's legal name and postal address are available on request, and privacy questions can be sent to the email address below.
Information we collect
- Account and class details: name, email address, account role, class membership, assignments and access status.
- Learning records: diagnostic, practice and mock-test answers, scores, working, completion history and teacher notes.
- Live lessons and whiteboards: lesson attendance and session activity, shared lesson state, drawings and accessible summaries saved to the live whiteboard. Where a lesson uses Zoom, Zoom carries the lesson audio, video and meeting connection; the ElevenMaths site does not itself record that audio or video.
- Feedback: short ratings, experience choices and optional comments.
- Technical and security records: sign-in, device, browser, network, error and limited product-event data used to operate, protect and repair the service.
- Enquiries: a parent or carer's name, email, optional telephone number, child's school year, preferred class time and message.
Why we use it and our legal basis
- To provide accounts, classes, lessons, practice, feedback and support: necessary to perform the contract with the parent or carer, or to take steps they request before a contract.
- To let teachers review assigned pupils' work and improve teaching: our legitimate interests in delivering and improving an effective course. We balance those interests against each child's rights.
- To keep the service safe, prevent misuse, diagnose failures and protect accounts: our legitimate interests and, where applicable, legal obligations.
- To keep records required by tax, consumer, safeguarding or other law: compliance with a legal obligation.
- To answer an enquiry: steps requested before a possible contract. If a separate optional use genuinely requires consent, we will ask clearly and it can be withdrawn. We do not use consent where another basis is the real reason for processing.
Children's best interests
Children's wellbeing and privacy come first when we design the service or make a decision about their information. Defaults should be private, collection should be limited, and children should not be nudged to share more data than they need to learn. We do not sell personal data, show behavioural advertising, or create advertising profiles. We do not make solely automated decisions that have legal or similarly significant effects on a child.
Who can see or process information
Pupils see their own work. Assigned teachers can see learning needed to teach and support them. Administrators manage accounts and service access. People answering enquiries see only the enquiry. We use service-provider categories including Supabase for database and authentication services, Vercel for hosting and delivery where that deployment is used, Sentry for error monitoring only when configured, and Brevo for enquiries and service emails. We also use Zoom to carry live-lesson meeting connections, audio and video. Where a provider processes personal information for us, it does so under our instructions for the agreed service. We review provider contracts, locations and settings when we choose or change a provider.
International transfers
A provider may process information outside the UK. Where UK adequacy regulations do not cover the destination, including where Zoom infrastructure outside the UK carries a lesson connection, we rely on an appropriate safeguard such as the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses, with a transfer risk assessment where required. You may ask us for information about the safeguard used.
How long we keep information
We keep information only for as long as it is needed. Our standard periods are:
- Enquiries: 24 months from receipt, unless needed for an ongoing relationship.
- Active account, class, learning, whiteboard and feedback records: while the account is in use, then normally no more than 12 months after the course or account relationship ends.
- Accounts placed in the recycle bin: inaccessible immediately and scheduled for permanent deletion after two months unless restored.
- Routine technical and security logs: normally no more than 90 days.
- Support correspondence: normally no more than 24 months after the issue closes.
- Records that law requires us to keep, such as payment and tax records: for the period required by that law, commonly up to six years.
- Backups: removed on the backup rotation, targeted to be within 90 days after deletion from the live service.
We may keep a record longer if needed for a legal claim, safeguarding concern or legal duty. We will restrict access and delete it when that reason ends.
Your rights
Children have data-protection rights of their own. A child can exercise them if they understand the request; a parent or carer may also act for a child when appropriate. Depending on the circumstances, you can ask for a copy, correction, deletion or restriction; object to legitimate-interest processing; ask for portable data; or withdraw consent without affecting earlier lawful use. We may need to check identity and authority before sharing information. Some rights have legal limits, which we will explain if they apply.
Security
We use access controls, private-by-default class access, authentication, encrypted connections, monitoring and database security rules. No online service can promise perfect security. Please tell us promptly if you think an account or a child's information is at risk.
Contact and complaints
To ask a question or exercise a right, email contact@elevenmaths.co.uk or use the help centre. You can also complain to the UK Information Commissioner's Office. Visit the ICO data protection complaints page or call 0303 123 1113. We would welcome the chance to help first, but you do not have to contact us before the ICO.
Changes to this notice
We will update the date at the top and explain important changes in clear language. Where a change significantly affects children, we will use an age-appropriate notice as well as informing the parent or carer where appropriate.