Prac2XL is the data controller for the personal data processed through the Platform.
| Data | Purpose | Lawful Basis |
|---|---|---|
| Full name | Account identification | Contract |
| Email address | Authentication (magic link), communication | Contract |
| Password (hashed) | Account security | Contract |
| Data | Purpose | Lawful Basis |
|---|---|---|
| First name | Personalisation, display within Platform | |
| Last name | Account identification, parent dashboard | |
| Date of birth | Age verification, age-appropriate content | |
| School year group | Curriculum alignment, age-appropriate content | |
| Country | Curriculum relevance | |
| Username & password (hashed) | Child login access |
| Data | Purpose | Lawful Basis |
|---|---|---|
| Questions attempted & answers | Adaptive learning, progress tracking | Legitimate interest |
| Scores and accuracy rates | Performance analytics for parents | Legitimate interest |
| Time spent on sessions | Learning efficiency analysis | Legitimate interest |
| Mastery stage progression | Adaptive difficulty, curriculum coverage | Legitimate interest |
| Skill strengths & weaknesses | Smart Practice algorithm | Legitimate interest |
| PracPoints earned & spent | Motivational features | Legitimate interest |
| Data | Purpose | Lawful Basis |
|---|---|---|
| IP address | Security, fraud prevention | Legitimate interest |
| Browser type & version | Technical compatibility | Legitimate interest |
| Device type | Responsive design optimisation | Legitimate interest |
| Session timestamps | Usage analytics, security | Legitimate interest |
We use data to generate age-appropriate and ability-appropriate questions across all subjects offered, track progress and mastery across curriculum topics, adapt difficulty based on performance, provide hints and learning support, display performance analytics to parents, operate the PracPoints motivational system, and process error reports submitted through the Platform.
We use aggregated, anonymised data to improve question quality and variety, identify common areas where children struggle, enhance our adaptive algorithms, and monitor Platform performance and reliability.
We use parent email addresses to send authentication magic links, important service announcements, subscription and billing communications, and optional progress summaries (which parents can opt out of).
We use data to prevent unauthorised access, detect and address abuse of the Platform, and comply with legal obligations.
We recognise the special importance of protecting children's personal data. In accordance with the ICO Children's Code, we apply the following principles:
6.1. Because our users include children under 13, we require verified parental consent before processing any child's personal data.
6.2. Consent is obtained during the child profile creation process, where the parent must actively confirm that they are the child's parent or legal guardian, they have read and understood this Privacy Policy, and they consent to the processing of their child's data as described.
6.3. Parents can withdraw consent at any time by deleting their child's profile or contacting us at privacy@prac2xl.com. Withdrawal of consent will result in the deletion of the child's data.
6.4. The current consent version is recorded so that if material changes are made to this Policy, we can notify parents and, where necessary, obtain renewed consent.
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Vercel | Hosting & deployment | All Platform data (in transit) | Global CDN, primary EU |
| Neon | Database hosting | All stored data | EU |
| Stripe | Payment processing | Parent name, email, payment | EU/US (adequate safeguards) |
| SMTP2GO | Email delivery | Parent email addresses | NZ/EU (adequate safeguards) |
We may disclose data if required by law, by a court order, or by a regulatory authority, or if we believe in good faith that disclosure is necessary to protect the safety of a child.
| Data Type | Retention Period | Reason |
|---|---|---|
| Parent account data | Account duration + 30 days | Service operation, billing |
| Child profile data | Profile duration + 30 days | Service operation |
| Practice & performance data | Profile duration + 30 days | Progress tracking |
| Payment records | 6 years after last transaction | UK tax obligations |
| Error reports | 12 months after resolution | Quality improvement |
| Technical logs | 90 days | Security & debugging |
When data reaches the end of its retention period, it is securely deleted or irreversibly anonymised.
We implement appropriate technical and organisational measures to protect personal data, including:
No system is completely secure. If we become aware of a data breach that is likely to affect your rights, we will notify you and the ICO in accordance with our legal obligations.
Our primary data processing occurs within the EEA and the UK. Where data is processed outside these regions, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO, adequacy decisions by the UK Government, or binding corporate rules of the data processor.
Under the UK GDPR, you have the following rights:
To exercise any of these rights, contact us at privacy@prac2xl.com. We will respond within one month.
12.1. The Platform uses only essential cookies required for the Service to function, including authentication session cookies and security cookies (CSRF protection).
12.3. Because we only use strictly necessary cookies, we do not require cookie consent under PECR.
13.1. We collect usage data (questions answered, time spent, features used) to improve the Platform. This data is analysed in aggregate and is not used to identify individual children outside the Platform.
13.2. We do not use Google Analytics, Facebook Pixel, or any third-party analytics tools that track users across the internet.
13.3. All analytics are first-party, processed on our own infrastructure, and used solely to improve the educational experience.
The Platform may contain links to external websites. We are not responsible for the privacy practices of other websites. We encourage parents to review the privacy policies of any external sites before sharing personal information.
15.1. We may update this Privacy Policy from time to time. Material changes will be communicated to parents via email and through the Platform.
15.2. Where changes affect the processing of children's data, we may require renewed parental consent.
15.3. The "Last updated" date at the top of this page indicates the most recent revision.
15.4. We recommend reviewing this Policy periodically to stay informed about how we protect your data.
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
We would appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to us first at privacy@prac2xl.com.