Square Club

Policies

GDPR policy

Last updated: 8 September 2026

1. Purpose

Square Club Maths Ltd is committed to protecting the privacy and security of personal information and to complying with applicable data protection legislation.

This Data Protection Policy sets out the principles and procedures that Square Club Maths Ltd follows when collecting, using, storing, sharing and otherwise processing personal data.

It applies to Square Club Maths Ltd's employees, contractors, representatives and any other person who processes personal data on behalf of Square Club Maths Ltd.

This policy should be read alongside our Privacy Policy, information security procedures, data retention procedures and any applicable Data Processing Agreements with schools and other customers.

2. Applicable legislation

Square Club Maths Ltd will comply with applicable UK data protection legislation, including:

  • the UK General Data Protection Regulation (UK GDPR);
  • the Data Protection Act 2018;
  • the Privacy and Electronic Communications Regulations (PECR), where applicable; and
  • other applicable data protection and privacy legislation as amended or replaced from time to time.

Square Club Maths Ltd will also take account of guidance and recommendations issued by the Information Commissioner's Office (ICO), including the Age Appropriate Design Code (Children's Code) where applicable.

3. Our approach to data protection

Square Club Maths Ltd recognises that personal data is entrusted to us by individuals, schools and other organisations. We are committed to:

  • processing personal data lawfully, fairly and transparently;
  • collecting only the information we need;
  • using personal data only for appropriate and specified purposes;
  • keeping personal data accurate and up to date;
  • retaining personal data only for as long as necessary;
  • protecting personal data against unauthorised access, loss, destruction or disclosure;
  • respecting individuals' data protection rights;
  • protecting children's personal information;
  • using appropriate contracts with organisations that process personal data on our behalf;
  • maintaining appropriate records of processing activities;
  • implementing privacy by design and default;
  • responding appropriately to personal data breaches; and
  • regularly reviewing our data protection practices.

4. Roles and responsibilities

4.1 Data Protection Lead

Square Club Maths Ltd will appoint individuals responsible for overseeing data protection compliance.

Data Protection Leads: Joe Tazzyman, Adam Peters, and Josh Lury (Founders)
Email: info@squareclubmaths.com

The Data Protection Leads will:

  • oversee implementation of this policy;
  • provide advice on data protection requirements;
  • monitor compliance;
  • coordinate responses to data subject requests;
  • oversee personal data breach management;
  • maintain relevant data protection documentation;
  • coordinate Data Protection Impact Assessments where required;
  • review data processing arrangements with suppliers;
  • provide or arrange appropriate staff training; and
  • act as a point of contact for schools, customers and individuals regarding data protection matters.

Where Square Club Maths Ltd is legally required to appoint a formal Data Protection Officer (DPO), the appropriate arrangements will be made. Where a formal DPO is not required, Square Club Maths Ltd will document this decision and ensure that sufficient responsibility and resources are allocated to data protection.

5. Data controller and data processor responsibilities

Square Club Maths Ltd may act as either a data controller or a data processor, depending on the circumstances.

5.1 Where Square Club Maths Ltd is the data controller

Square Club Maths Ltd will determine the purposes and means of processing personal data. Examples may include:

  • managing customer accounts;
  • administering subscriptions;
  • processing payments;
  • responding to enquiries;
  • maintaining business records;
  • managing supplier relationships;
  • operating our Website; and
  • sending permitted marketing communications.

5.2 Where Square Club Maths Ltd is a data processor

When a school uses Square Club Maths Ltd's assessment or reporting services and provides pupil information to Square Club Maths Ltd, the school will generally determine the purposes for which that pupil information is processed. In these circumstances, Square Club Maths Ltd will generally act as the school's data processor.

Square Club Maths Ltd will:

  • process pupil information only in accordance with the school's documented instructions and applicable law;
  • maintain appropriate security measures;
  • ensure that authorised personnel are subject to confidentiality obligations;
  • use appropriate sub-processors where required;
  • assist the school with relevant data protection obligations;
  • notify the school of relevant personal data breaches;
  • assist with data subject rights requests where appropriate;
  • assist with security, DPIAs and regulatory obligations where required;
  • delete or return personal data at the end of the relevant service, subject to legal retention requirements; and
  • maintain appropriate records of processing.

The controller/processor relationship will be documented in a written Data Processing Agreement. The ICO identifies written contracts between controllers and processors as an important part of UK GDPR accountability.

6. Data protection principles

Square Club Maths Ltd will apply the following data protection principles.

6.1 Lawfulness, fairness and transparency

Personal data will only be processed where there is a valid lawful basis. Individuals will be given clear information about how their personal information is used through appropriate privacy notices.

6.2 Purpose limitation

Personal data will only be collected and used for specified, explicit and legitimate purposes. We will not use personal data for incompatible purposes without an appropriate legal basis.

6.3 Data minimisation

We will collect and process only the personal information reasonably necessary for the relevant purpose. Schools and users should not upload unnecessary personal information into Square Club Maths Ltd services.

6.4 Accuracy

Reasonable steps will be taken to ensure personal information is accurate and, where necessary, kept up to date. Inaccurate information will be corrected or deleted where appropriate.

6.5 Storage limitation

Personal information will not be kept for longer than reasonably necessary. Retention periods will be established for different categories of personal information.

6.6 Integrity and confidentiality

Personal information will be protected using appropriate technical and organisational security measures.

6.7 Accountability

Square Club Maths Ltd will maintain appropriate documentation and evidence to demonstrate compliance with applicable data protection requirements.

7. Lawful bases for processing

Square Club Maths Ltd will identify an appropriate lawful basis before processing personal data. Depending on the circumstances, this may include:

  • consent;
  • performance of a contract;
  • compliance with a legal obligation;
  • protection of vital interests;
  • legitimate interests; or
  • another lawful basis available under applicable data protection legislation.

Where legitimate interests are relied upon, Square Club Maths Ltd will consider and document the relevant legitimate interest assessment where appropriate.

8. Special category data

Square Club Maths Ltd will not intentionally collect special category personal data unless there is a specific and lawful reason to do so. Where special category data is processed, Square Club Maths Ltd will ensure that both an appropriate UK GDPR lawful basis and an applicable condition for processing special category data have been identified.

9. Children's data

Square Club Maths Ltd recognises that children require particular protection in relation to their personal information. Because Square Club Maths Ltd services may be used to record and analyse pupil assessment information, additional care will be taken when processing children's information.

Square Club Maths Ltd will:

  • process pupil information only for legitimate and specified purposes;
  • minimise the personal information collected;
  • apply appropriate access controls;
  • restrict access to authorised individuals;
  • avoid using pupil information for unrelated advertising purposes;
  • not sell pupil information;
  • use appropriate security measures;
  • provide appropriate assistance to schools in meeting their data protection obligations; and
  • consider children's rights and interests when designing or changing services.

Where Square Club Maths Ltd acts as a processor, the school remains responsible for determining the purposes and lawful basis for processing pupil information, subject to the terms of the relevant agreement.

10. Privacy by design and default

Data protection will be considered when developing, modifying or introducing new systems, products and services. Before introducing significant new processing activities, Square Club Maths Ltd will consider:

  • what personal information is required;
  • why it is required;
  • whether less information could be used;
  • who will have access;
  • how the information will be secured;
  • how long it will be retained;
  • whether information will be shared with third parties;
  • whether international transfers are involved;
  • whether children or vulnerable individuals are affected; and
  • whether a Data Protection Impact Assessment is required.

Privacy and security settings should, wherever practicable, be configured to protect personal information by default.

11. Data Protection Impact Assessments

Square Club Maths Ltd will carry out a Data Protection Impact Assessment (DPIA) where processing is likely to result in a high risk to individuals' rights and freedoms. A DPIA may be considered where, for example:

  • new technology is introduced;
  • large amounts of personal information are processed;
  • children’s information is processed in a new or significantly changed way;
  • systematic monitoring is introduced;
  • profiling or automated decision-making is introduced;
  • sensitive or special category information is processed; or
  • a significant change is made to how personal information is used.

The DPIA will identify relevant risks and document measures intended to reduce those risks.

12. Data security

Square Club Maths Ltd will implement appropriate technical and organisational measures to protect personal information. Depending on the circumstances, these may include:

  • password protection;
  • role-based access controls;
  • authentication controls;
  • encryption;
  • secure hosting;
  • secure backups;
  • software and security updates;
  • malware protection;
  • access logging;
  • secure transmission of information;
  • confidentiality obligations;
  • staff training;
  • supplier due diligence; and
  • procedures for responding to security incidents.

13. Access controls

Access to personal data will be limited to people who need it for legitimate business or service-related purposes. Access will be granted according to role and responsibility. Where appropriate:

  • accounts will use individual credentials;
  • passwords must be kept confidential;
  • access rights will be reviewed periodically;
  • former employees and contractors will have their access removed promptly; and
  • inappropriate or unauthorised access will be investigated.

14. Data retention

Square Club Maths Ltd will maintain appropriate retention periods for different categories of personal information. Information will be deleted or securely disposed of when it is no longer required, unless there is a legal or legitimate reason for retaining it. For pupil information processed on behalf of schools, retention will generally follow the school's documented instructions and the relevant contractual arrangements.

Square Club Maths Ltd retention schedule: Pupil assessment data and school account data is retained for the duration of the active subscription, plus 60 days post-termination, after which it is securely deleted. Financial and tax records are kept for 7 years as required by UK law.

15. Data sharing

Personal data will only be shared where there is an appropriate legal basis and where the sharing is necessary for a legitimate purpose. Third parties may include:

  • hosting providers;
  • cloud service providers;
  • payment providers;
  • email and communication providers;
  • IT and security providers;
  • professional advisers;
  • analytics providers; and
  • regulators or public authorities where legally required.

Where a third party processes personal data on Square Club Maths Ltd's behalf, appropriate contractual arrangements and due diligence will be undertaken.

16. Sub-processors

Where Square Club Maths Ltd acts as a data processor, it may use third-party sub-processors to provide elements of the service. Sub-processors will be selected with regard to security, reliability, data protection practices, the nature of the processing, location of processing, and contractual safeguards. Where required, schools will be informed of relevant sub-processors in accordance with the applicable Data Processing Agreement.

17. International transfers

Where personal data is transferred outside the UK, Square Club Maths Ltd will ensure that an appropriate legal transfer mechanism and safeguards are in place. These may include an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

18. Data subject rights

Square Club Maths Ltd recognises the rights available to individuals under applicable data protection law. Depending on the circumstances, these include rights to be informed, access personal information, correct inaccurate information, request deletion, restrict processing, data portability, object to processing, and exercise rights relating to automated decision-making and profiling.

All requests will be handled in accordance with applicable legal requirements. Where Square Club Maths Ltd acts as a processor, requests relating to pupil information will normally be referred to the relevant school/controller, with Square Club Maths Ltd providing appropriate assistance.

19. Data subject access requests

Requests for access to personal information must be passed to the Data Protection Leads as soon as reasonably practicable. Square Club Maths Ltd will:

  • verify the identity of the requester where appropriate;
  • identify the information covered by the request;
  • establish whether any exemptions apply;
  • locate relevant information;
  • consult relevant third parties where necessary; and
  • provide the required response within the applicable legal timeframe.

Staff must not delete, amend or conceal personal information in response to a data subject request.

20. Personal data breaches

A personal data breach may include loss of personal information, theft, unauthorised access, accidental disclosure, sending information to the wrong recipient, hacking, malware or ransomware, accidental deletion, or unauthorised alteration of information.

All suspected personal data breaches must be reported immediately to:

Data Protection Leads: Joe Tazzyman, Adam Peters, and Josh Lury
Email: info@squareclubmaths.com

Square Club Maths Ltd will investigate suspected breaches and take appropriate steps to contain, assess and remedy them. Where required by law, Square Club Maths Ltd will notify the ICO within the applicable timeframe and notify affected individuals where required. Where Square Club Maths Ltd is acting as a processor, the relevant school/controller will be notified without undue delay in accordance with the applicable Data Processing Agreement.

21. Personal data breach register

Square Club Maths Ltd will maintain an appropriate record of personal data breaches, including breaches that do not require notification to the ICO. Records should include the date and time of the incident, what happened, the categories of information affected, the individuals affected, the likely consequences, the measures taken to contain the incident, the measures taken to prevent recurrence, whether the ICO was notified, and whether affected individuals were notified.

22. Staff confidentiality and training

Anyone with access to personal data must understand their responsibilities. Square Club Maths Ltd will provide appropriate data protection and information security training to relevant staff and contractors. Staff must:

  • keep personal information confidential;
  • only access information required for their role;
  • follow security procedures;
  • use approved systems;
  • report suspected breaches promptly;
  • not disclose personal information without appropriate authority; and
  • comply with this policy.

Failure to follow data protection requirements may result in disciplinary or contractual action where appropriate.

23. Direct marketing

Marketing activities must comply with applicable data protection and electronic communications legislation. Before sending marketing communications, Square Club Maths Ltd will establish the appropriate lawful basis and ensure that applicable consent and/or opt-out requirements are met. Recipients will be provided with a straightforward method of unsubscribing from marketing communications.

24. Cookies and online tracking

Square Club Maths Ltd will use cookies and similar technologies in accordance with applicable privacy and electronic communications requirements. Non-essential cookies and tracking technologies will only be used where the necessary consent or other lawful basis has been established. The Website's Cookie Policy should provide further information about the cookies and technologies actually used.

25. Third-party suppliers

Before appointing a supplier that will process personal information on behalf of Square Club Maths Ltd, appropriate due diligence will be undertaken. Written contracts will be used where required.

26. Records of processing activities

Square Club Maths Ltd will maintain appropriate records of its processing activities. Where Square Club Maths Ltd acts as a processor, appropriate processor records will also be maintained. The ICO recommends maintaining written records of processing activities and keeping them up to date.

27. Complaints

Anyone who has concerns about Square Club Maths Ltd's handling of personal information should contact:

Data Protection Leads: Joe Tazzyman, Adam Peters, and Josh Lury
Email: info@squareclubmaths.com

Square Club Maths Ltd will investigate complaints and seek to resolve them appropriately. Individuals also have the right to complain to the Information Commissioner's Office (ICO). ICO website: https://ico.org.uk/

28. Policy review

This policy will be reviewed at least annually and whenever there is a significant change to applicable data protection law, Square Club Maths Ltd's services, the types of personal information processed, suppliers or sub-processors, security arrangements, or the purposes for which personal information is processed.

29. Approval

  • Policy owners: Joe Tazzyman, Adam Peters, and Josh Lury
  • Approved by: Joe Tazzyman, Adam Peters, and Josh Lury
  • Approval date: 8 September 2026
  • Next review date: 8 September 2027
  • Version: 1.2

Appendix 1 — Data Protection Checklist

Square Club Maths Ltd should be able to demonstrate that it:

  • Maintains an up-to-date Privacy Policy.
  • Maintains this Data Protection Policy.
  • Maintains appropriate Records of Processing Activities.
  • Has identified lawful bases for its processing.
  • Has identified controller/processor relationships.
  • Has appropriate Data Processing Agreements with relevant customers.
  • Has assessed its suppliers and sub-processors (e.g., Cloud Next Limited, Stripe).
  • Maintains appropriate retention periods.
  • Has appropriate information security measures.
  • Has a procedure for responding to data subject rights requests.
  • Has a personal data breach procedure.
  • Maintains a breach register.
  • Considers DPIAs for high-risk processing.
  • Provides appropriate staff data protection training.
  • Reviews access permissions.
  • Reviews this policy regularly.
  • Has appropriate arrangements for international transfers.
  • Has considered whether a formal DPO is legally required.
  • Maintains appropriate evidence of compliance.

Appendix 2 — Key Contacts

  • Data Protection Leads: Joe Tazzyman, Adam Peters, and Josh Lury (Founders)
  • Data Protection Email: info@squareclubmaths.com
  • Legal Entity: Square Club Maths Ltd
  • Registered Address: C/O James Bendrey Accountants Ltd Boscawen Park, St Dennis, St Austell, United Kingdom, PL26 8DT

Appendix 3 — Related Documents

This policy should be read alongside:

  • Square Club Maths Ltd Privacy Policy
  • Square Club Maths Ltd Cookie Policy
  • Square Club Maths Ltd Data Processing Agreement (DPA)
  • Square Club Maths Ltd Information Security Policy (Procedures covered within this document)
  • Square Club Maths Ltd Data Retention Policy (Procedures covered within this document)
  • Square Club Maths Ltd Personal Data Breach Procedure (Procedures covered within this document)
  • Square Club Maths Ltd Records of Processing Activities
  • Square Club Maths Ltd Data Protection Impact Assessments
  • Supplier/Sub-processor Register (including Cloud Next Limited and Stripe)