Privacy Policy - those who can

Privacy Policy – Did Teach Limited Did Teach Limited (“the Company”) is committed to protecting the privacy and security of personal data entrusted to us by our users, customers, employees, and partners. As an organisation that collects, processes, and analyses information – including structured data provided by thousands of teachers through our platform, www.thosewhocan.org – we recognise our responsibilities under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy sets out the principles, standards, and procedures that guide our approach to data protection and privacy. It is designed to ensure that all personal data is handled lawfully, fairly, and transparently, and that the rights of individuals are respected at every stage of the data lifecycle. The Policy covers all personal data processed by the Company, whether in digital or physical form.

By adhering to this Policy, we aim to maintain the trust of our community, uphold our legal obligations, and support the responsible and innovative use of data for the benefit of the education sector. For more information about how we use cookies and similar technologies, please see our Cookie Policy.

1. Interpretation

1.1 Definitions:

Aggregated Data: Data that is combined with information from other users so that it does not identify any individual.

Anonymised Data: Data that has been processed to remove all personal identifiers, so that it cannot be linked to any individual by any means reasonably likely to be used.

Automated Decision-Making (ADM): A decision based solely on automated processing (including profiling) that produces legal effects or significantly affects an individual.

Automated Processing: Any automated use of personal data to evaluate personal aspects, including profiling and AI-based analysis.

Company name: Did Teach Limited.

Company Personnel: All employees, workers, contractors, consultants, directors, and others acting for or on behalf of Did Teach Limited.

Consent: Freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes.

Controller: Did Teach Limited, which determines the purposes and means of processing personal data.

Cookies: Small text files placed on your device to collect standard internet log information and visitor behaviour information. For more information, see our Cookie Policy.

Data Subject: a living, identified or identifiable individual about whom we hold Personal Data.

Data Subjects may be nationals or residents of any country and may have legal rights regarding their Personal Data.

Data Privacy Impact Assessment (DPIA): tools and assessments used to identify and reduce risks of a data processing activity. A DPIA can be carried out as part of Privacy by Design and should be conducted for all major system or business change programmes involving the Processing of Personal Data.

Data Protection Officer (DPO): Martin Stickley info@thosewhocan.org 1

Explicit Consent: consent which requires a very clear and specific statement (that is, not just action).

UK GDPR: the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) as defined in the Data Protection Act 2018. Personal Data is subject to the legal safeguards specified in the UK GDPR.

Personal Data: Any information relating to an identified or identifiable individual, including structured data, pseudonymised data, and special categories of data.

Personal Data Breach: any act or omission that compromises the security, confidentiality, integrity, or availability of Personal Data or the physical, technical, administrative, or organisational safeguards that our third-party service providers or we put in place to protect it. The loss, or unauthorised access, disclosure, or acquisition, of Personal Data is a Personal Data Breach.

Privacy by Design: implementing appropriate technical and organisational measures in an effective manner to ensure compliance with the UK GDPR.

Privacy Notices (also referred to as Fair Processing Notices) or Privacy Policies: separate notices setting out information that may be provided to Data Subjects when the Company collects information about them. These notices may take the form of:

a) general privacy statements applicable to a specific group of individuals (for example, employee privacy notices or the website privacy policy); or

b) stand-alone, one-time privacy statements covering Processing related to a specific purpose.

Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.

Pseudonymisation or Pseudonymised: replacing information that directly or indirectly identifies an individual with one or more artificial identifiers or pseudonyms so that the person to whom the data relates cannot be identified without the use of additional information which is meant to be kept separately and secure.

Pseudonymised Data: Data that has had personal identifiers replaced with artificial identifiers or pseudonyms, but could still be linked to an individual with additional information kept separately. Special Categories of Personal Data: Data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, sex life, sexual orientation, biometric or genetic data.

2. Introduction

2.1 This Privacy Policy sets out how Did Teach Limited (“we”, “our”, “us”, “the Company”) handles the personal data of our users, customers, suppliers, employees, and other third parties.

2.2 This Policy applies to all personal data we process, regardless of format or media, and to all Company Personnel.

3. Scope of Policy

3.1 We recognise that the correct and lawful treatment of Personal Data will maintain trust and confidence in the organisation and will provide for successful business operations. Protecting the 2 confidentiality and integrity of Personal Data is a critical responsibility that we take seriously at all times.

3.2 All individual business areas, units, departments, and line managers are responsible for ensuring all Company Personnel comply with this Privacy Policy and need to implement appropriate practices, processes, controls, and training to ensure that compliance.

3.3 The DPO is responsible for overseeing this Privacy Policy and, as applicable, developing Related Policies and Privacy Guidelines. That post is held by Martin Stickley, and he can be reached at info@thosewhocan.org

4. Personal data that we collect about you and the protection principles we adhere to

4.1 We may process certain types of personal data about you as follows:

a) Identity Data may include your first name, maiden name, last name, username, marital status, title, date of birth and gender.

b) Contact Data may include your billing address, delivery address, email address and telephone numbers.

c) Financial Data may include your bank account and payment card details.

d) Transaction Data may include details about payments between us and other details of purchases made by you.

e) Technical Data may include your login data, internet protocol addresses, browser type and version, browser plug-in types and versions, time zone setting and location, operating system and platform and other technology on the devices you use to access this site.

f) Profile Data may include your username and password, purchases or orders, your interests, preferences, feedback and survey responses.

g) Usage Data may include information about how you use our website, products and services.

h) Marketing and Communications Data may include your preferences in receiving marketing communications from us and our third parties and your communication preferences.

4.2 We do not collect any Special Categories of data.

4.3 We adhere to the principles relating to Processing of Personal Data set out in the UK GDPR which require Personal Data to be:

(a) Processed lawfully, fairly and in a transparent manner (lawfulness, fairness and transparency);

(b) collected only for specified, explicit and legitimate purposes (purpose limitation);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which it is Processed (data minimisation);

(d) accurate and where necessary kept up to date (accuracy);

(e) not kept in a form which permits identification of Data Subjects for longer than is necessary for the purposes for which the data is Processed (storage limitation);

(f) Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful Processing and against accidental loss, destruction or damage (security, integrity and confidentiality);

(g) not transferred to another country without appropriate safeguards in place (transfer limitation); and

(h) made available to Data Subjects and allow Data Subjects to exercise certain rights in relation to their Personal Data (data subject’s rights and requests).

4.4 We are responsible for and must be able to demonstrate compliance with the data protection principles listed above (accountability).

5. Structured Data, Anonymisation and Aggregation

5.1 Collection of Structured Data via Platform Tools: When you use our platform tools (including surveys, forms, or other interactive features), we collect structured data that may include your responses, preferences, and other information you provide. At the point of submission, this data may be linked to you and is treated as personal data under the UK GDPR.

5.2 Anonymisation and Pseudonymisation: Pseudonymisation is a process where your personal identifiers are replaced with artificial identifiers or pseudonyms. While this reduces the risk of identification, the data could still be linked back to you with additional information kept separately and securely. Anonymisation is a process where all personal identifiers are removed so that the data can no longer be linked to you by any means reasonably likely to be used. Once data is fully anonymised, it is no longer considered personal data and is not subject to data protection law.

5.3 Identifiability at Submission: Please note that, at the moment you submit information via our platform tools, your data may be technically identifiable and is treated as personal data. We apply all relevant safeguards and protections at this stage. Only after we have removed all personal identifiers and aggregated your data with that of other users do we consider it anonymised.

5.4 Aggregated and Anonymised Data: We may process your data in an aggregated and/or anonymised format for analytics, research, and service improvement. Aggregated data is combined with data from other users and does not identify you. Anonymised data cannot be linked to you by us or any third party. We never attempt to re-identify anonymised data, and any attempt to do so is strictly prohibited.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store certain information about your interactions with our website. Cookies help us to provide you with a better user experience, analyse site usage, and deliver relevant content and advertising.

For detailed information about the cookies we use, the purposes for which we use them, and how you can manage your cookie preferences, please refer to our Cookie Policy.

7. How we collect your data and our adherence to lawfulness, fairness and transparency

7.1 We collect personal data about you through the following means:

a) Direct Interactions: You may provide data by completing forms on our website, corresponding with us by post, phone, email, or otherwise, including when you create an account, place an order, subscribe to our services or publications, request information or marketing, participate in promotions, or provide feedback.

b) Automated Technologies: We automatically collect technical and usage data about your equipment, browsing actions, and patterns as you interact with our website. This is achieved through cookies, server logs, and similar technologies. For further details, please refer to our Cookie Policy.

c) Third Parties and Public Sources: We may receive personal data about you from third parties and publicly available sources, including:

i. Technical data from analytics and advertising partners (such as Google), social media platforms (such as Facebook, Twitter, LinkedIn, Instagram), and search information providers;

ii. Contact, financial, and transaction data from payment and delivery service providers (such as Stripe and PayPal);

iii. Identity and contact data from publicly available registers (such as Companies House and the Electoral Register).

7.2 We process Personal data lawfully, fairly and in a transparent manner.

7.3 We only collect, process and share Personal Data fairly and lawfully and for specified purposes. The UK GDPR restricts our actions regarding Personal Data to specified lawful purposes. These restrictions are not intended to prevent processing but ensure that we process Personal Data fairly and without adversely affecting you.

7.4 The UK GDPR allows processing for specific purposes. The lawful basis for processing your data is set out below:

(a) the Data Subject has given their Consent;

(b) the processing is necessary for the performance of a contract with the Data Subject;

(d) to pursue our legitimate interests (or those of a third party) for purposes where they are not overridden because the processing prejudices the interests or fundamental rights and freedoms of Data Subjects.

7.5 The lawful basis for each processing activity is documented.

8. Consent

8.1 As a Controller, we only process Personal Data on one or more of the lawful bases set out in the UK GDPR, which include Consent.

8.2 As the Data Subject, you consents to the processing of your Personal Data if you clearly indicate agreement to the processing. Consent requires affirmative action, so silence, pre-ticked boxes or inactivity will not be sufficient to indicate consent. If Consent is given in a document that deals with other matters, then the Consent must be kept separate from those other matters.

8.3 You must easily be able to withdraw Consent to processing at any time and withdrawal is promptly honoured.

9. Transparency (notifying Data Subjects)

9.1 The UK GDPR requires us to provide detailed, specific information to you depending on whether the information was collected directly from you or from elsewhere. The information must be provided through an appropriate Privacy Notice, which must be concise, transparent, intelligible, easily accessible, and in clear and plain language so that you can easily understand it.

9.2 Whenever we collect Personal Data directly from you, we will provide you with all the information required by the UK GDPR including the identity of the DPO, and how and why we will use, process, disclose, protect and retain that Personal Data through a Privacy Notice which must be presented when you first provide the Personal Data.

9.3 When Personal Data is collected indirectly (for example, from a third party or publicly available source), we must provide you with all the information required by the UK GDPR as soon as possible after collecting or receiving the data. We will check that the Personal Data was collected by the third party in accordance with the UK GDPR and on a basis which contemplates our proposed processing of that Personal Data.

10. Purpose limitation

10.1 Personal Data is collected only for specified, explicit, and legitimate purposes. It must not be further processed in any manner incompatible with those purposes.

10.2 We will not use Personal Data for new, different, or incompatible purposes from those disclosed when it was first obtained unless we have informed you of the new purposes and you have consented where necessary.

10.3 If we want to use Personal Data for a new or different purpose from that for which it was obtained, we will make sure that it is in compliance with both the law and this Privacy Policy.

11. Future Use of Anonymised and Aggregated Data

11.1 We may use anonymised and aggregated data for purposes such as analytics, research, statistical reporting, and product or service development. This data will never be used in a way that could identify you as an individual.

11.2 If, in the future, we wish to use your personal data for any new purpose that is not compatible with the original purpose for which it was collected, we will notify you and explain the legal basis for the new processing. We will only proceed with your consent where required by law.

12. Data minimisation

12.1 Personal Data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

12.2 We only collect Personal Data that is required and do not collect excessive data. We ensure that any Personal Data collected is adequate and relevant for the intended purposes.

12.3 We ensure that when Personal Data is no longer needed for specified purposes, it is deleted or anonymised in accordance with the Company’s data retention guidelines.

13. Accuracy

13.1 Personal Data must be accurate and, where necessary, kept up to date. It must be corrected or deleted without delay when inaccurate.

13.2 We ensure that the Personal Data we use and hold is accurate, complete, kept up to date and relevant to the purpose for which we collected it. We check the accuracy of any Personal Data at the point of collection and at regular intervals afterwards. We take all reasonable steps to destroy or amend inaccurate or out-of-date Personal Data.

14. Storage limitation

14.1 Personal Data is not kept in an identifiable form for longer than is necessary for the purposes for which the data is processed.

14.2 The Company will maintain retention policies and procedures to ensure Personal Data is deleted after an appropriate time, unless a law requires that data to be kept for a minimum time.

14.3 We do not keep Personal Data in a form which permits the identification of the Data Subject for longer than needed for the legitimate business purpose or purposes for which we originally collected it, including for the purpose of satisfying any legal, accounting, or reporting requirements.

14.4 We take all reasonable steps to destroy or erase from our systems all Personal Data that we no longer require in accordance with all the Company’s applicable records retention schedules and policies. This includes requiring third parties to delete that data where applicable.

14.5 We ensure that you are provided with information about the period for which data is stored.

15. Security integrity and confidentiality

15.1 Personal Data is secured by appropriate technical and organisational measures against unauthorised or unlawful Processing, and against accidental loss, destruction or damage.

15.2 We develop, implement, and maintain safeguards appropriate to our size, scope, and business, our available resources, the amount of Personal Data that we own or maintain on behalf of others, and identified risks (including use of encryption and Pseudonymisation where applicable).

15.3 We regularly evaluate and test the effectiveness of those safeguards to ensure security of our processing of Personal Data. We are responsible for protecting the Personal Data we hold. We implement reasonable and appropriate security measures against unlawful or unauthorised processing of Personal Data and against the accidental loss of, or damage to, Personal Data.

15.4 We follow all procedures and technologies we put in place to maintain the security of all Personal Data from the point of collection to the point of destruction. We only transfer Personal Data to thirdparty service providers who agree to comply with the required policies and procedures and who agree to put adequate measures in place, as requested.

15.5 We maintain data security by protecting the confidentiality, integrity and availability of the Personal Data, defined as follows:

(a) Confidentiality: only people who have a need to know and are authorised to use the Personal Data can access it;

(b) Integrity: Personal Data is accurate and suitable for the purpose for which it is processed; and

15.6 We comply with and do not attempt to circumvent the administrative, physical, and technical safeguards we implement and maintain in accordance with the UK GDPR and relevant standards to protect Personal Data.

16. Reporting a Personal Data Breach

16.1 The UK GDPR requires us to notify any Personal Data Breach to the Information Commissioner and, in certain instances, to you, the Data Subject.

16.2 We have put in place procedures to deal with any suspected Personal Data Breach and will notify you or any applicable regulator where we are legally required to do so.

17. Transfer limitation

17.1 The UK GDPR restricts data transfers to countries outside the UK to ensure that the level of data protection afforded to individuals by the UK GDPR is not undermined.

17.2 We comply with the Company’s guidelines on cross-border data transfers.

17.3 We only transfer Personal Data outside the UK if one of the following conditions applies:

(a) the UK has issued regulations confirming that the country to which we transfer the Personal Data ensures an adequate level of protection for the Data Subject’s rights and freedoms;

(b) appropriate safeguards are in place such as binding corporate rules, standard contractual clauses approved for use in the UK, an approved code of conduct or a certification mechanism, a copy of which can be obtained from the DPO;

(c) the Data Subject has provided Explicit Consent to the proposed transfer after being informed of any potential risks; or

(d) the transfer is necessary for one of the other reasons set out in the UK GDPR including:

(i) the performance of a contract between the Data Subject and us;

(ii) reasons of public interest;

(iii) to establish, exercise or defend legal claims; and

(iv) in some limited cases, for our legitimate interest.

18. Data Subject’s rights and requests

18.1 As a Data Subject, you have rights when it comes to how we handle your Personal Data. These include rights to:

(a) withdraw Consent to processing at any time;

(b) receive certain information about the Controller’s processing activities;

(d) prevent our use of your Personal Data for direct marketing purposes;

(e) ask us to erase Personal Data if it is no longer necessary in relation to the purposes for which it was collected or processed or to rectify inaccurate data or to complete incomplete data;

(f) restrict processing in specific circumstances;

(g) object to processing which has been justified on the basis of our legitimate interests or in the public interest;

(h) request a copy of an agreement under which Personal Data is transferred outside of the UK;

(i) object to decisions based solely on Automated Processing, including profiling (ADM);

(j) prevent processing that is likely to cause damage or distress to you or anyone else;

(k) be notified of a Personal Data Breach which is likely to result in a high risk to your rights and freedoms;

(l) make a complaint to us and subsequently to the supervisory authority; and

(m) in limited circumstances, receive or ask for their Personal Data to be transferred to a third party in a structured, commonly used and machine-readable format.

18.2 We will verify the identity of an individual requesting data under any of the rights listed above.

19. Accountability

19.1 We implement appropriate technical and organisational measures in an effective manner to ensure compliance with data protection principles. We are responsible for, and must be able to demonstrate, compliance with the data protection principles.

19.2 We have adequate resources and controls in place to ensure and to document UK GDPR compliance including:

(a) appointing a suitably qualified DPO and an executive accountable for data privacy;

(b) implementing Privacy by Design when Processing Personal Data and completing DPIAs where Processing presents a high risk to your rights and freedoms;

(d) regularly training Company Personnel on the UK GDPR, this Privacy Policy, and data protection matters, including, for example, a Data Subject’s rights, Consent, legal basis, DPIA and Personal Data Breaches; and

(e) regularly testing the privacy measures implemented and conducting periodic reviews and audits to assess compliance, including using the results of testing to demonstrate compliance improvement efforts.

20. Record keeping

20.1 The UK GDPR requires us to keep full and accurate records of all our data processing activities.

20.2 We keep and maintain accurate corporate records reflecting our Processing including records of Data Subjects’ Consents and procedures for obtaining Consents in accordance with the Company’s recordkeeping guidelines.

20.3 These records include, at a minimum:

(a) clear descriptions of:

(i) the Personal Data types;

(ii) the Data Subject types;

(iii) the Processing activities;

(iv) the Processing purposes;

(v) the third-party recipients of the Personal Data;

(vi) the Personal Data storage locations;

(vii) the Personal Data transfers;

(viii) the Personal Data’s retention period; and

(ix) the security measures in place.

20.4 To create the records, data maps are created and include the details set out above together with appropriate data flows, in accordance with the Company’s record-keeping guidelines.

21. Training and audit

21.1 We ensure all Company Personnel have undergone adequate training to enable them to comply with data privacy laws. We also regularly test our systems and processes to assess compliance.

21.2 We regularly review all the systems and processes to ensure they comply with this Privacy Policy and check that adequate governance controls and resources are in place to ensure proper use and protection of Personal Data.

22. Privacy by Design and Data Protection Impact Assessment (DPIA)

22.1 We implement Privacy by Design measures when processing Personal Data by implementing appropriate technical and organisational measures (like Pseudonymisation) in an effective manner, to ensure compliance with data privacy principles.

22.2 We assess what Privacy by Design measures can be implemented on all programmes, systems or processes that process Personal Data by taking into account the following:

(a) The nature, scope, context, and purposes of processing.

(b) The risks of varying likelihood and severity for your rights and freedoms posed by the processing.

22.3 We also conduct a DPIA in respect to high-risk processing including:

(a) Use of new technologies (programs, systems or processes, including the use of AI), or changing technologies (programs, systems or processes).

(b) Automated Processing, including profiling and ADM.

22.4 We comply with the Company’s guidelines on DPIA and Privacy by Design.

23. Automated Processing (including profiling) and Automated Decision-Making

23.1 Automated decision-making is only used where permitted by law and with appropriate safeguards.

23.2 Data subjects are informed of their rights regarding automated decisions and profiling.

24. Direct marketing

24.1 We are subject to certain rules and privacy laws when engaging in direct marketing to our service users (for example, when sending marketing emails).

24.2 The right to object to direct marketing will be explicitly offered to you in an intelligible manner so that it is clearly distinguishable from other information.

24.3 Your objection to direct marketing is always promptly honoured. If you opt out of marketing at any time, your details are suppressed as soon as possible. Suppression involves retaining just enough information to ensure that marketing preferences are respected in the future.

25. Sharing Personal Data

25.1 Generally, we are not allowed to share Personal Data with third parties unless certain safeguards and contractual arrangements have been put in place.

25.2 We only share the Personal Data we hold with third parties, such as our service providers, if:

(a) they have a need to know the information for the purposes of providing the contracted services;

(b) sharing the Personal Data complies with the Privacy Notice provided to you and, if required, your Consent has been obtained;

(c) the third party has agreed to comply with the required data security standards, policies and procedures, and put adequate security measures in place;

(d) the transfer complies with any applicable cross-border transfer restrictions; and

(e) A fully executed written contract that contains UK GDPR-compliant third-party clauses