Privacy policy

nAItives (“nAItives”, “we”, “us” or “our”) is committed to protecting personal data and respecting privacy. We design our website and platform with safety, privacy and data protection in mind, and we take particular care with information relating to children. This policy describes what we collect, why, how we look after it, and the rights available to you under UK data protection law.

Who we are

nAItives provides an AI literacy platform and related services for schools. For the purposes of UK data protection law — the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — nAItives is the data controller for personal data collected through our website and for data we use to run our business. Where we deliver platform services to a school, the school is the data controller and nAItives acts as a data processor (see “Our role” below).

If you need our full registered company details or the contact point for data protection matters, please use the details in the “Contact us” section.

Scope of this policy

This policy covers:

• visitors to our website at naitives.ai;
• people who contact us, book a demo, or recommend their school;
• school staff who administer or use the nAItives platform;
• pupils who use the platform, where a school has engaged us.

It does not cover third-party websites we link to, which have their own privacy policies.

Our role: controller and processor

We act in two distinct roles depending on the data involved:

• As a controller — when we decide how and why personal data is used. This applies to website enquiries, demo and recommendation requests, marketing communications you have agreed to receive, and the administration of our business.
• As a processor — when a school uses the nAItives platform with its pupils and staff. The school decides what data is processed and why; we process it on the school’s documented instructions under a written data processing agreement. Pupils, parents and carers should refer to their school’s own privacy notice for details of that processing.

Information we collect

Information you give us

When you book a demo, recommend your school, or otherwise contact us, we may collect your name, role, school or organisation, email address, and any information you choose to include in your message. Where relevant we may record the type of enquiry (for example, a demo request or a recommendation).

Information collected automatically

When you visit our website we may collect limited technical information such as your device type, browser, approximate location derived from your IP address, and how you interact with our pages. We use this to keep the site secure and to understand and improve how it is used.

Platform information

When a school uses the platform, we process the information needed to deliver the service — for example staff and pupil accounts, class or year-group information, learning activity and progress, and content created through learning tasks. The school determines the scope of this data. We design the platform so that pupil interactions can be moderated and so that schools retain oversight and control.

How we use information

We use personal data to:

• respond to enquiries, arrange demos and follow up on recommendations;
• provide, maintain, secure and improve our website and platform;
• communicate with schools about their use of the service;
• send information you have asked for or agreed to receive, such as the school leader’s guide;
• meet our legal, safeguarding and regulatory obligations;
• understand how our website and platform are used so we can improve them.

We do not sell personal data, and we do not use pupil data to advertise to children.

Lawful bases for processing

Under UK GDPR we rely on one or more of the following lawful bases:

• Legitimate interests — to respond to business enquiries, to operate and secure our website, and to improve our services, where this is not overridden by your rights.
• Consent — for optional marketing communications and certain cookies. You can withdraw consent at any time.
• Contract — to provide the platform and services agreed with a school.
• Legal obligation — where we must process data to comply with the law.

When we act as a processor for a school, the school is responsible for identifying the lawful basis for processing pupil and staff data.

Children's data

We take particular care with children’s personal data. Where pupils use the platform, this happens under the direction and authority of their school, which acts as the data controller and is responsible for the appropriate consents and notices. We follow the principles of the Information Commissioner’s Office (ICO) Age Appropriate Design Code (the “Children’s Code”) in how we design and operate the platform.

This means we aim to: collect only the data needed for learning; keep pupil interactions age-appropriate and capable of moderation; avoid using children’s data for marketing or profiling for commercial purposes; and give schools the controls they need to protect their pupils. Parents and carers who have questions about their child’s data should contact their school in the first instance.

Cookies and analytics

Our website uses a small number of cookies and similar technologies. Essential cookies are needed for the site to function. With your consent, we may also use analytics cookies to understand how the site is used so we can improve it. You can control non-essential cookies through your browser settings or any cookie controls we provide on the site. Where we use analytics, we configure it to limit the data collected.

Sharing and sub-processors

We share personal data only where necessary, and with appropriate safeguards in place. This may include:

• trusted service providers who help us run our website, platform and communications (for example hosting, email and analytics providers), acting as our sub-processors under contract;
• professional advisers such as legal and accounting providers, where required;
• authorities or other parties where we are legally required to do so, or to protect the safety of a child or other person.

Where a school is the controller, we maintain a list of sub-processors and make it available to the school under our data processing agreement.

International transfers

We aim to keep personal data within the UK or European Economic Area where practical. If personal data is transferred outside the UK, we put in place appropriate safeguards recognised under UK data protection law — such as an adequacy decision or the International Data Transfer Agreement (or equivalent standard contractual clauses) — so that your data remains protected.

Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law. Enquiry and demo information is kept for as long as needed to deal with your request and for a reasonable period afterwards. Platform data is retained in line with our agreement with each school and is deleted or returned at the end of the engagement on the school’s instructions.

How we protect data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. These include access controls, encryption in transit, secure hosting, and limiting access to data on a need-to-know basis. We review our security practices regularly. No system can be guaranteed completely secure, but we work to protect data in line with good industry practice and our legal obligations.

Your rights

Subject to certain conditions, you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete data in certain circumstances;
• restrict or object to certain processing;
• request a copy of certain data in a portable format;
• withdraw consent where we rely on it.

To exercise any of these rights, please contact us using the details below. If your request relates to pupil or staff data processed on behalf of a school, we will direct it to the school as the controller. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we would welcome the chance to address your concerns first.

Changes to this policy

We may update this policy from time to time to reflect changes in our services, technology or the law. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you or the relevant school.

Contact us

If you have any questions about this policy or how we handle personal data, please contact us at hello@naitives.ai. We will do our best to respond promptly and to put things right where needed.