Our Commitment to Privacy
Whitespace is committed to protecting the privacy and safety of students, teachers, and schools. This privacy policy explains how we collect, use, and protect your information in compliance with UK GDPR and educational data protection standards.
Information We Collect
Student Information
- First name only (no surnames collected)
- Year group and classroom assignment
- Learning interactions and progress
- Safety monitoring data for safeguarding
Teacher Information
- Name and professional email address
- School affiliation
- Classroom management data
- Teaching materials and resources
School Administrator Information
- Organisation details and settings
- User management data
- Platform configuration
How We Use Information
We use collected information exclusively for:
- Providing educational AI services
- Ensuring student safety and safeguarding
- Supporting teachers in classroom management
- Improving our educational tools
- Complying with legal obligations
We NEVER: Sell student data, use data for advertising, train AI models on student conversations, or share data with third parties for non-educational purposes.
Data Protection Rights
Under UK GDPR, you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of data
- Object to data processing
- Data portability
- Restrict processing
- Withdraw consent where applicable
To exercise these rights, contact your school's data protection officer or email us at darren@coxon.ai
Student Safety & Safeguarding
We prioritise student safety through:
- Automated monitoring for inappropriate content
- Detection of potential safeguarding concerns
- Immediate alerts to teachers and safeguarding leads
- Compliance with UK safeguarding regulations
- Regular safety audits and reviews
All safety monitoring is conducted in accordance with:
- Keeping Children Safe in Education (KCSIE)
- Working Together to Safeguard Children
- UK Safeguarding legislation
Data Security
We implement industry-standard security measures:
- Encryption at rest and in transit (AES-256)
- Regular security audits and penetration testing
- Secure data centres located in the UK
- Strict access controls and authentication
- Incident response procedures
- Staff training on data protection
Student data is stored securely and never leaves the UK without appropriate safeguards.
Data Retention
- Student data: Duration of school year plus 1 year
- Safety logs: 7 years per safeguarding requirements
- Teacher accounts: While employed at subscribing school
- Deleted data: Permanently removed within 30 days
All data is securely destroyed upon request or contract termination.
International Transfers
Data is primarily stored and processed in the UK. Any international transfers comply with UK GDPR requirements including:
- Adequacy decisions
- Appropriate safeguards
- Standard contractual clauses
Children's Privacy
- We do not collect data directly from children under 13
- Student accounts are created by schools
- No marketing to children
- Parental rights respected per school policies
Data Breach Procedures
In the event of a data breach:
- Immediate containment and assessment
- Notification to ICO within 72 hours if required
- Notification to affected schools
- Full investigation and remediation
- Lessons learned implementation
Third Party Services
We use limited third-party services:
- Cloud infrastructure: UK-based providers only
- Analytics: Privacy-preserving, aggregated data only
- Support tools: Under strict data protection agreements
No student data is shared with third parties for commercial purposes.
Cookies and Tracking
We use essential cookies only for:
- Authentication and security
- Session management
- Preference settings
No tracking or advertising cookies are used.
Contact Information
Data Protection Officer
Kompass Education Limited
Email: darren@coxon.ai
Address: 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London, W1T 6EB
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Phone: 0303 123 1113
Changes to This Policy
We may update this policy to reflect changes in law or practices. Schools will be notified of material changes at least 30 days in advance. Last updated: 27 September 2025