Privacy Policy

1. Who we are

HeartSmart ("we", "our", "us") is the data controller for personal data collected through this platform. We are committed to protecting your privacy and processing your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

We collect the following categories of personal data:

• Account data: name, email address, role, and school affiliation provided during registration.
• School data: school name, address, contact details, and subscription information.
• Usage data: resources accessed, saved resources, and login activity.
• Technical data: IP address, browser type, and cookies (see our Cookie Policy).

3. Legal basis for processing

We process your personal data under the following lawful bases:

• Contract: processing necessary to fulfil the subscription agreement with your school.
• Legitimate interests: to operate, maintain, and improve our platform and to prevent fraud.
• Consent: for optional analytics and marketing cookies.
• Legal obligation: where we are required to retain or disclose data by law.

4. How we use your data

• To provide and manage your access to the platform
• To communicate important updates about your account or subscription
• To process payments and manage school subscriptions
• To understand usage patterns and improve our services
• To comply with legal and regulatory obligations

5. Data sharing

We do not sell your personal data. We may share it with trusted third-party service providers (such as payment processors and cloud infrastructure providers) strictly to deliver our services. All processors are bound by contractual obligations consistent with UK GDPR.

6. Data retention

We retain personal data for as long as your school's subscription is active and for up to 3 years afterwards for legal and audit purposes. You may request earlier deletion — see your data rights.

7. International transfers

Your data is stored and processed within the UK and EEA. Where we use third-party services that process data outside these areas, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses).

8. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or port your personal data. You also have the right to object to certain processing and to withdraw consent at any time.

9. Cookies

We use cookies to operate and improve our platform. For full details, see our Cookie Policy.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on our platform.

11. Contact us

For privacy-related queries, contact our Data Protection Officer at info@heartsmart.scholl or via our contact form. You also have the right to lodge a complaint with the ICO.