1.Introduction

Please read this Privacy Notice carefully as it sets out how and why Think Academy International Education Limited (“Think Academy”, “We”, “Us”, “Our”) uses you and your child's personal data (together, “Your Data”) when you access our website, products and services, as well as explaining certain legal rights that you have under data protection laws. This Privacy Notice is incorporated into and subject to our User Agreement and our Terms and Conditions.

At Think Academy, we are committed to being responsible and transparent about how we collect and use Your Data. We respect the privacy of all individuals who interact with us and the privacy choices you make. We provide online maths lessons to children in Years 1 to 6 (typically aged between 5 and 11) via our secure online classroom (Think Academy App), together with access to high-quality study materials. We also, from time to time, provide free access to resources, blog posts and articles for parents via our website and social media platforms. In accordance with the Data Protection Act 2018 (“DPA 2018”) and the European Union’s General Data Protection Regulation (“GDPR”), Think Academy is registered on the public register of Data Controllers as maintained by the UK’s data protection regulator, the Information Commissioner’s Office (“ICO”). This means that Think Academy is legally responsible for handling Your Data.

We may change this Privacy Notice from time to time by updating this page. This Privacy Notice does not apply to any third-party websites to which you may be directed from our website. We encourage you to read the privacy statements on the other websites that you visit. We do not accept any responsibility or liability for the privacy practices of any third-party websites and your use of them is at your own risk.

2.What personal data do we collect from you

Registration data

In order to provide our Services, we will need to collect and use certain data about you such as:

• Name;
• Email address;
• Telephone number;
• IP Address
• Location data;
• Cookies;
• Payment details(see Payment card information below); and
• Subject/materials preference for you and your child.

Your child’s personal data

In addition to the above and due to the nature of our Services, we also need to collect certain personal data about your child. Personal data about children is afforded extra protection under data protection laws. We hereby ask for your explicit consent (i.e. your parental consent for children under the age of 13) for collecting your child’s personal data, including:

• your child’s name;
• your child’s age/date of birth; and
• which school they attend and which academic year they are currently in.

We will obtain these data either directly from you when you sign up to use our Services through our website, or from third parties such as your child’s school (which will only be the case where we are entering into a contract directly with the school, rather than with you). In such circumstances, your explicit consent will still be obtained before we collect your child’s personal data, i.e. the school/educational body cannot provide consent on your behalf. Please note that by providing the above information of your child to us, you have given us your explicit parental consent to process your child’s personal data in accordance with this Privacy Notice.

Payment card information

When you purchase our Services, we process payments through secure payment gateways such as PayPal or Stripe. You will be re-directed to their secure platform when making payments. We will not process any bank account, credit card or other financial details relating to you. When these third-party payment providers process Your Data, they will do so strictly in accordance with the relevant payment card industry standards.

Automated interactions

As you interact with our website, we may automatically collect information from your device by using cookies and other similar technologies. Processing such information is also necessary for us to pursue our legitimate interests in improving our website and user experience, as well as helping us to provide our products and services to you. For more information please see our Cookies Policy.

3.The legal basis upon which Think Academy process Your Data

There are a limited number of grounds on which an organisation is permitted to handle personal data, known as the “legal basis for processing”. In general, we need Your Data because it is necessary in order for Think Academy to enter into and perform its contract with you. In addition, it is in Think Academy’s legitimate interests to collect Your Data in order to provide our Services and to fulfil our legal obligations, but only in circumstances where these interests are not outweighed by the need to protect your privacy.

Furthermore, we rely on obtaining your explicit consent for handling your child’s personal data. Please note that you may withdraw consent at any time after you have given it, although this would not affect the lawfulness of Think Academy’s prior use of Your Data. However, due to the specific nature of our business, it is necessary for us to collect and use your child’s personal data, to be able to provide appropriate tutoring and courses relevant to their educational needs. So please note that withdrawing your consent may directly impact our ability to engage with them and providing our Services to you as per our contractual obligations.

4.How we use Your Data

We will only process Your Data where it is absolutely necessary for us to do so, such as:

• to enabling us to provide our Services to you and fulfil our contractual obligations to you;

• assessing course suitability for your child and the provision of tutoring and feedback;

• to communicate with you, either in the course of delivering our Services, or to improve the usefulness and effectiveness of our website and marketing channels as per Section 5 outlined below;

• for internal administration purposes (e.g. responding to your enquiries/complaints, to improve our website and Services and to comply with any legal and/or regulatory requirements placed on Think Academy, including our child safeguarding obligations); and

• processing payments.

When processing Your Data, we will ensure that we only process the necessary information required to fulfil our purposes, so that we can keep Your Data to a minimum. Where possible, we will process Your Data in a pseudo-anonymised or anonymised form.

5.Marketing purposes

Think Academy may use Your Data for marketing purposes, i.e. to form a view on which of our Services may be of interest to you.

You will receive marketing communications from us if you have requested to receive information from us, interacted with one of our advertisements on social media or have signed up to use our Services and you have not opted out of receiving our marketing materials.

In line with direct marketing rules, where we send marketing messages to you by email and/or SMS, you can ask us to stop at any time by following the unsubscribe link in the email and/or SMS. If you have received marketing material from Think Academy via social media and do not wish to do so, please adjust your social media advertisement/privacy settings.

Where you opt out of receiving these marketing messages, this will not apply to Your Data as a result of signing up to/engaging with our Services.

6.Data sharing

We may share Your Data to third-party service providers acting on our behalf when it is necessary to carry out our Services and fulfil our contractual obligations to you. Any third-party service provider will only use Your Data to provide that service under appropriate contractual arrangements with Think Academy. However, we will retain control of Your Data and any third-party service provider that we use must act in accordance with our instructions and data protection laws. We may also share Your Data with a purchaser or potential purchaser of our business.

In some circumstances, we may have to disclose Your Data for legal or regulatory purposes, such as where we have to report a child safeguarding issue to a relevant authority or where a court, the police or other law enforcement agency or regulatory body has asked us for it.

7.Data Transfer (Overseas)

As part of TAL Education Group’s global business and IT infrastructure needs, at times it may be necessary for Think Academy to send Your Data (such as your IP address, live location) outside of the UK (such as China, Hong Kong and US) in accordance with our legal basis of processing Your Data.

Where it is absolutely necessary to transfer Your Data outside of the UK, we will take all steps reasonably necessary to ensure that there are appropriate safeguards and contractual protections to protect Your Data in accordance with the applicable data protection laws, such as relying on a recognised legal adequacy mechanism which may include entering into approved standard contractual clauses relevant to transfers of Your Data, imposing contractual obligations on the recipients of that data to protect Your Data to the standard required in the UK and putting in place measures to supplement transfer tools.

8.How long we retain Your Data

We will only hold Your Data for as long as it is necessary:

• for performance of the Services you have requested; and/or
• as required by law; and/or
• for accounting or regulatory purposes; and/or
• as otherwise described in this privacy notice.

Any data processed under the lawful basis of contract will be kept for a period of six years after the contract ends.

9.Data storage

We are committed to ensuring that Your Data is kept securely. This includes implementing appropriate physical and technological security measures, such as access controls and careful selection of staff and third-party service providers. Where data is sent overseas, appropriate contractual provisions are in place to ensure the continued security of Your Data. All user data are stored in our AWS cloud computing services.

10.Your Rights

You have various legal rights in relation to Your Data. This Privacy Notice does not list every right that you have under the DPA 2018 and GDPR, but we have set out the ones we consider most relevant to you in the context of Think Academy handling Your Data for the purpose of providing our Services to you.

You may have the right to ask Think Academy to:

• provide a copy of Your Data;
• correct any inaccuracies of Your Data;
• withdraw or restrict your consent at any time to Think Academy handling Your Data, where we rely on consent as the legal basis to do this; and
• delete Your Data, where there is no lawful justification for Think Academy to retain it.

In most cases, we will deal with your requests free of charge and within one month of receipt of your request. However, there are exceptions that can allow us to charge a reasonable fee to cover our administration costs and/or extended the time period for dealing with your request to two months from receipt of your request, such as where your request is complex or repetitive. If an exception applies, we will keep you informed.

We will never charge you to change your marketing preferences or unsubscribe to our marketing communications.

You may also have the right to object to Think Academy using Your Data, where we do this for the purposes of our legitimate interests as outlined above. If you lodge such an objection, we will stop using the relevant data unless we identify compelling legitimate grounds for continuing to use Your Data which override you or your child’s rights and interests.

11.Our complaints procedure

If you are unhappy with the way Think Academy is handling Your Data, please contact our Data Protection Officer first via email data.enquiries@tal.com and let us know. We will ensure at all times that your privacy complaints will be treated seriously, dealt with promptly and in a confidential manner.

If you do not agree with the way we have processed Your Data or responded to your concerns, you have a right to submit a complaint to the ICO. For more information please visit https://ico.org.uk/make-a-complaint/.