Privacy Policy
1. Who we are
Pollyana Academy Ltd ("Pollyana Academy", "we", "us") provides two services: The Summer Thinking Space, a live one-to-one maths programme delivered by Pollyana Banerji Patel; and Held to Think, an online maths companion that a child works on with a parent alongside. We are the data controller for the personal information described here.
2. Who this policy is for
Our services are bought and managed by a parent or legal guardian, who must be aged 18 or over and have authority to act for the child. The child works on Held to Think but does not hold an account. We design for children's privacy in line with the ICO Children's Code.
3. The information we collect
- Parent account: name, contact details, age and authority confirmation, and billing information.
- Child profile: a first name or nickname, school year, stage and exam board.
- Intake: your goal for your child, preferred rhythm, and any accessibility or pacing preferences you choose to set.
- The details you type to help us: after you join, we ask you to tell us the details that will help us tailor the course content to your child, in a few short prompts, in your own words. There is no file to upload. We ask you to keep to learning information and to leave out medical, health or third-party details.
- Your child's work: the answers and steps your child types into Held to Think, and a record of what they met and steadied.
We do not ask you for special-category information, such as details about a child's health, SEN or diagnosis. Because the boxes are free text, if you do choose to share something of that kind, we treat it with the strongest care and only with your explicit consent.
4. Why we use it, and our lawful basis
We use this information to set up the account, shape and deliver the programme, keep your child safe, take payment, and support you. Our intended lawful basis is your explicit consent as the parent or guardian, with an appropriate condition for any special-category data, set purpose by purpose.
5. How long we keep it, and how we delete it
We keep your child's data only for as long as we need it to deliver the service, and no longer than one school year. At the end of that period our system deletes it automatically. Deletion removes the data from our active systems, and from our backups and logs as they cycle, so it cannot be restored. You can also ask us to delete your child's data sooner at any time, which we action promptly (see Your rights).
6. What we do not do
We do not sell, share or use your family's data for advertising. We do not use your family's data to train or improve our product by default; any such use would require your separate, explicit consent. We do not profile children for marketing. We do not capture your child's voice or video. We do not diagnose, and we do not give medical, therapeutic or emergency advice.
7. Who can see it
Your child's information is seen only by you, by your child (their own work), and by Pollyana and a small number of approved reviewers for quality and safety. Pollyana may access your child's material to teach it live with your child; this access is recorded. We do not give access to any other third parties, beyond the trusted service providers that help us run the platform securely under contract.
8. Keeping children safe
If anything you share, or anything in your child's work, suggests a risk of harm, we pause normal processing and a member of our team reviews it personally. We will be in touch calmly, and we do not provide emergency advice through the product. Safeguarding decisions are made by our Designated Safeguarding Lead.
9. Your rights
You can ask to see, correct, export or delete your child's data at any time. When you ask us to delete, we delete fully, including from backups and logs. You can also withdraw consent. To exercise any of these, contact p.banerji@pollyana-academy.com. You have the right to complain to the Information Commissioner's Office.
10. Security and where your data is held
We protect your data with encryption in transit and at rest, least-privilege access, and access logging. We hold data in the United Kingdom; any processing outside the UK would be identified and protected appropriately.
11. Cookies and this website
This website is deliberately simple. It does not use advertising cookies, tracking cookies or third-party analytics, and it does not build a profile of you. Any cookies we may use are strictly necessary to make the site work. If we ever introduce analytics or other non-essential cookies, we will ask for your consent first and update this policy.
12. Payments
Payments are handled by a trusted payment provider. Card details are processed by that provider and are not stored by us. The seller of record is shown at checkout.
13. Our Data Protection Impact Assessment
Because Held to Think is used by children, we have carried out a Data Protection Impact Assessment (DPIA): a careful, structured review of how we use personal information and how we protect it. We follow the Information Commissioner's Office seven-step process. This is a plain-language summary. The full assessment is a working document that we keep under review, and we do not publish the parts that describe our security in detail, so that the detail cannot be misused.
What we looked at. How we collect, use, store and delete the information above; who can see it; how long we keep it; and the fact that a child uses the service. We treat children as needing extra protection, and we treat anything sensitive a parent might type with the strongest care, even though we do not ask for it.
The risks we considered. That a child could be identified from small details; that a parent might volunteer sensitive information in a free-text box; that one family's information must never reach another; that any sign a child may be at risk must be handled thoughtfully; that data must be kept secure; and that the learning content a child sees must be safe, accurate and age-appropriate.
How we reduce them. We collect the minimum we need and encourage nicknames rather than full names. There is no file to upload. We host and hold data in the United Kingdom, encrypt it, and limit who can see it. A person reviews and approves the learning content before a child ever sees it. A person, our Designated Safeguarding Lead, reviews any safeguarding concern; the product never tries to handle it automatically and never gives emergency advice. We keep data only for as long as it is needed and then delete it, and you can see, correct, export or delete it at any time.
Our conclusion. After these measures, we assess the remaining risk to a child or family as low. We keep the assessment under review and will repeat it if we change how the service works. No child uses Held to Think, and no payment is taken, until this work is complete and signed off.
If you would like to understand more about how we protect your family's information, please contact us at p.banerji@pollyana-academy.com.
14. Changes to this policy
We will update this policy as the service develops. The current version and date are shown at the top.
15. Contact
Pollyana Academy Ltd, 124 City Road, London EC1V 2NX. Email: p.banerji@pollyana-academy.com.