Privacy Policy

Summary

• We process the minimum personal data needed to operate the service.
• For data entered into the platform by a school, the school is the controller and CoverMyClass is the processor. We act on the school's instructions under a written Data Processing Agreement.
• Platform data is hosted in the United Kingdom.
• We do not sell personal data. We do not use school or pupil data to train third-party AI models.
• Each school workspace is logically isolated and access is role-based and audited.
• You can contact us about data matters at privacy@covermyclass.com at any time.

1. Who we are

This policy is issued by CoverMyClass Ltd, a company registered in England and Wales. Our registered contact for data protection matters is privacy@covermyclass.com.

UK GDPR does not require us, as an SME, to appoint a statutory Data Protection Officer. We have nonetheless designated an internal lead for data protection and you can reach them at the address above. References in this policy to "we", "us", and "our" mean CoverMyClass Ltd.

2. What this policy covers

This policy applies to: (a) personal data we collect about visitors to covermyclass.com; (b) personal data we collect about school staff who use the CoverMyClass platform (for example, an account name and work email); and (c) personal data entered into the platform by a school in the course of normal use, including any limited information about pupils that a school user records in a cover briefing.

Where this policy refers to the service or the platform, it means the CoverMyClass software product. Where it refers to the website, it means our marketing pages at covermyclass.com.

3. Our role: controller and processor

The distinction between controller and processor under UK GDPR matters because it determines who is responsible for what. We apply it as follows:

• Website visitors and prospective customers. CoverMyClass is the controller of personal data submitted via our website forms (for example, when someone books a demo), and of any related correspondence. This section of the policy describes that processing.
• Platform users and school-entered content. The school is the controller of personal data within its workspace. This includes staff account data and any pupil information a school user enters into a lesson brief, seating note, or behaviour flag. CoverMyClass is a processor, acting only on the school's documented instructions under a written Data Processing Agreement.

The DPA forms part of our service agreement. It is provided to schools during procurement and is available on request from privacy@covermyclass.com.

4. What personal data we collect

4.1 Visitors to our website

When you contact us via a website form, we collect what you provide: your name, work email address, school or organisation, role, and any message content. We also collect limited technical information automatically (see Cookies and analytics).

4.2 School staff using the platform

To operate an account we collect: your name, work email address, the school you act for, and your role. For school verification we may use your school's URN or DfE establishment number, which is public information. Authentication and access logs are retained for security and audit purposes.

4.3 School-entered operational content

The platform is designed for school-entered operational content: lesson plans, learning intentions, seating notes, behaviour flags, SEND adjustments, and similar handover information. The product is not designed to be, and should not be used as, a pupil information system.

In the ordinary course of recording a cover brief, a school user may include limited personal data about pupils — for example, a forename, a year group, or a brief SEND adjustment note. We do not solicit, require, or encourage the entry of pupil personal data beyond what is operationally necessary. Our templates and prompts are designed to minimise it. Where such data is entered, the school remains the controller and is responsible for the lawful basis for that processing. We process it solely on the school's behalf under the DPA.

4.4 Special category and safeguarding data

We do not require the entry of special category personal data (as defined in Article 9 UK GDPR) such as ethnicity, religion, or health data. Schools are asked not to enter such data into the platform unless strictly necessary; where they do, they remain the controller and must ensure an appropriate Article 9 condition applies. Safeguarding information that requires confidentiality should be handled through the school's safeguarding systems, not the cover platform.

5. Lawful basis for processing

Our lawful bases under Article 6 UK GDPR are as follows:

• Contract — to provide the service to schools that have engaged us, and to communicate with prospective customers who have asked us to.
• Legitimate interest — to operate, secure, and improve the service; to respond to enquiries; and to maintain audit logs. We balance these interests against your rights and do not rely on legitimate interest where your interests override ours.
• Legal obligation — to comply with tax, accounting, and other legal requirements.
• Consent — for any marketing communications, where we have asked for and obtained your consent. You can withdraw consent at any time.

For school-entered data, the school identifies its own lawful basis as controller. Typical bases for state-funded schools handling pupil information include the performance of a task in the public interest (Article 6(1)(e)) and a relevant safeguarding condition under the Data Protection Act 2018.

6. How we use personal data

We use personal data to: provide the service; authenticate users and protect accounts; respond to enquiries and demos; send service-related communications; meet legal, tax, and audit obligations; investigate security incidents; and, where you have consented, send relevant updates about the product.

We do not use personal data for automated decision-making that produces legal or similarly significant effects. We do not use school-entered content, including any pupil information, to train third-party AI models.

7. Sharing and subprocessors

We engage a small number of carefully selected third-party service providers ("subprocessors") to operate the platform — for example, UK-region cloud hosting, transactional email delivery, error monitoring, and (where applicable) payment processing. We do not share personal data with subprocessors except as needed to deliver the service, and we require all subprocessors to provide contractual protections equivalent to those we provide to schools.

We will publish, and keep current, a list of platform subprocessors on or before the platform's general availability to schools. The list is available on request now from privacy@covermyclass.com. We will give schools reasonable advance notice of any material change to that list, and an opportunity to object.

We do not sell personal data. We do not share personal data with third parties for their own marketing purposes. We may disclose personal data where required by law, by a court order, or to protect the rights, property, or safety of CoverMyClass, our users, or others.

8. International data transfers

Platform data is stored in the United Kingdom. Where any subprocessor processes personal data outside the UK or the European Economic Area, we will rely on an appropriate transfer mechanism under UK GDPR (for example, an adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses) and we will document the transfer in our subprocessor list.

9. Data retention

We retain personal data only for as long as needed for the purposes set out in this policy.

• Website enquiries are retained for up to 24 months after last contact, then deleted or anonymised.
• Platform account data and school-entered content is retained for the term of the school's service agreement. On termination, we delete or return the data within 30 days, subject to any backup retention period specified in the DPA.
• Authentication and audit logs are retained for up to 12 months for security purposes.
• Financial and tax records are retained for at least six years, as required by UK law.

Individual users may request earlier deletion of their personal data. See Your rights.

10. Security

We take appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS) and at rest.
• Role-based access controls within each school workspace, with logical isolation between workspaces.
• Authentication safeguards including support for multi-factor authentication.
• Audit logging of administrative and sensitive actions.
• Routine backups, with restoration tested periodically.
• Vendor due diligence on subprocessors and contractual data protection commitments.
• Staff training on data protection and security responsibilities.

No system is perfectly secure. We will not claim invulnerability. Where a personal data breach occurs that is likely to result in a risk to individuals' rights and freedoms, we will notify affected schools without undue delay and, where required, the Information Commissioner's Office within 72 hours of becoming aware, in line with Articles 33 and 34 UK GDPR.

11. Your rights

Where we are the controller (see section 3), you have the following rights under UK GDPR:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete personal data in defined circumstances.
• Restriction — ask us to limit how we process your data while a question is resolved.
• Portability — ask us to provide your data in a portable format.
• Objection — object to processing based on legitimate interest, including direct marketing.
• Withdrawal of consent — withdraw consent at any time where consent is the lawful basis.
• Complaint — lodge a complaint with the UK Information Commissioner's Office (see section 14).

To exercise any of these rights, email privacy@covermyclass.com. We will respond within one month, in line with Article 12. There is no charge for a reasonable request.

If the personal data in question was entered into the platform by your school, your school is the controller and you should raise the request through your school. We will support the school in responding.

12. Cookies and analytics

The website uses a small number of strictly necessary cookies (for example, to remember whether you have closed a banner). We do not use third-party advertising or cross-site tracking cookies.

Where we use analytics on the website, we do so in a privacy-respecting manner: aggregated, with IP addresses truncated, and without setting persistent identifiers across sites. If we introduce analytics that require consent under PECR or UK GDPR, we will request that consent first via a cookie banner.

13. Children's data

The platform is designed for use by school staff (adults). Pupils do not log in. Pupils are not the intended audience for, and should not directly use, the service. Where pupil information appears within school-entered content (see section 4.3), the school controls it and we process it only on the school's instructions.

We align our practices to Keeping Children Safe in Education (KCSIE) and the ICO's Children's Code where applicable to incidental pupil information.

14. Changes to this policy

We may update this policy from time to time — for example, when we add a feature, change a subprocessor, or refine our practices. We will publish the updated version here and update the version number and effective date at the top. Where a change materially affects how we process personal data, we will give schools reasonable advance notice through normal communication channels.

A change history is maintained internally and is available on request.

15. Complaints and the ICO

If you have a concern about how CoverMyClass handles personal data, please contact us first at privacy@covermyclass.com. We will investigate and respond.

You also have the right to lodge a complaint with the UK Information Commissioner's Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113

CoverMyClass Ltd will register with the Information Commissioner's Office and pay the applicable data protection fee before processing any school data in production. Our ICO registration number will be added here once issued.

16. Contact

For any question about this policy, or to request our Data Processing Agreement, subprocessor list, or other procurement documentation, please contact:

Data protection contact
CoverMyClass Ltd
privacy@covermyclass.com

For general enquiries, please use the contact form.