Square Club

Policies

Privacy policy

Last updated: 8 September 2026

1. Introduction

Welcome to Square Club Maths Ltd. We respect your privacy and are committed to protecting your personal data. This Privacy Policy will inform you as to how we look after your personal data when you visit our website or use our online assessment platform, and tell you about your privacy rights and how the law protects you.

Square Club Maths Ltd ("we", "us", or "our") is a company registered in England and Wales.

  • Data Protection Leads: Joe Tazzyman, Adam Peters, and Josh Lury
  • Email address: info@squareclubmaths.com
  • Postal address: C/O James Bendrey Accountants Ltd Boscawen Park, St Dennis, St Austell, United Kingdom, PL26 8DT

2. Our Role: Controller vs. Processor

Data protection law makes a distinction between a "Data Controller" and a "Data Processor".

When we are the Data Processor: When a school subscribes to our platform, the school acts as the Data Controller for all student and teacher data uploaded to the system. We act solely as the Data Processor. We only process pupil data (such as names, dates of birth, and assessment scores) on the strict, documented instructions of the school to provide our educational services.

When we are the Data Controller: We act as a Data Controller for the personal data of our direct customers (e.g., a teacher purchasing a subscription), website visitors, and anyone who contacts us directly with an enquiry.

If you are a parent or pupil with questions about how your school uses Square Club Maths Ltd, please contact your school directly, as they control your data.

3. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data depending on your relationship with us:

A. School & Teacher Data (Where we are the Controller/Processor)

  • Identity & Contact Data: First name, last name, job title, school name, and school email address.
  • Financial & Transaction Data: Payment details and records of subscriptions purchased.
  • Profile Data: Usernames, passwords, preferences, and feedback.

B. Pupil Data (Where we act strictly as a Processor for the School)

  • Identity Data: First name, surname, date of birth, and pupil identifier numbers.
  • Educational Data: Year group, class/group assignments, mathematical assessment results, test responses, and progress reports.

Note: We never use pupil data for marketing, profiling, or any purpose other than providing the educational assessment service to the school.

C. Website Visitor Data (Where we are the Controller)

  • Technical Data: Internet protocol (IP) address, browser type and version, time zone setting, and operating system.
  • Usage Data: Information about how you use our website.

4. How We Use Your Personal Data (Lawful Basis)

We will only use your personal data when the law allows us to. Most commonly, we use your personal data under the following legal bases:

  • Performance of a Contract: To process a subscription, set up your school account, and provide our educational platform.
  • Legitimate Interests: To run our business, provide IT support, maintain network security, and improve our website and services.
  • Legal Obligation: To comply with tax, accounting, or legal requirements.
  • Consent: Where you have explicitly opted in to receive direct marketing from us, or accepted non-essential cookies on our website. You can withdraw this consent at any time.

5. Who We Share Your Data With

We do not sell, rent, or trade any personal data to third parties.

To provide our services, we use carefully selected third-party service providers (Sub-processors) who act on our behalf. These include:

  • Cloud Next Limited: We use Cloud Next Limited to host our website, databases, and secure data storage. All data hosted by Cloud Next Limited remains within the United Kingdom.
  • Payment Processors: We use Stripe to process subscription payments securely. We do not collect or store your full credit card details on our servers; they are collected and processed directly by Stripe in accordance with their strict security and privacy standards.
  • Communication Tools: Email systems to send service updates or support responses.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

6. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. This includes secure UK-based hosting, encryption, role-based access controls, and strict confidentiality agreements for all staff.

7. Data Retention (How long we keep it)

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for.

  • Pupil & School Account Data: Retained for the duration of the school's active subscription. Upon termination of the subscription, this data is securely deleted within 60 days, unless earlier deletion is requested by the school.
  • Financial & Billing Records: Retained for 7 years to satisfy UK tax and accounting legal requirements.

8. Your Legal Rights

Under the UK GDPR, you have rights relating to your personal data, including the right to:

  • Request access to your personal data.
  • Request correction of incomplete or inaccurate data.
  • Request erasure of your personal data.
  • Object to processing or request restriction of processing.
  • Request the transfer of your personal data to you or a third party.
  • Withdraw consent at any time (e.g., for marketing emails).

If you wish to exercise any of the rights set out above, please contact our Data Protection Leads at info@squareclubmaths.com.

Important note for parents/pupils: Because the school is the Data Controller for pupil data, any requests regarding pupil data (such as subject access requests or deletion requests) must be directed to the school. We will fully assist the school in fulfilling these requests.

9. Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.