Privacy Policy

Your privacy is our priority

Last Updated: 14 October 2026
HomePrivacy Policy

Key Points

  • We are fully compliant with UK GDPR and registered with the ICO
  • We only collect data necessary for educational services
  • Your data is stored securely in EU data centers
  • You have full control over your personal data
  • We never sell your data to third parties

1. Who We Are

Ganes Academy Ltd ("we", "us") is the data controller for the personal information you provide via ganesacademy.com.

ICO Registration Number: ZB939229

2. What Data We Collect

Account Data

Name, email address, school year and subjects of interest

Attendance & Performance Data

Attendance logs, school scores and grades

Homework Records

Uploaded files, scores, feedback and related analytics

Technical Data

IP address, browser type, device identifiers and log info

Audit Logs

Comprehensive records of who accessed data, when, and why

Communication Logs

Emails and SMS messages sent through our platform

Enquiry Form Data

When you submit an enquiry via our contact form, we collect your name, email, phone (optional), child's year group, and message. We use this to match your child with a suitable group or session and to respond to you. Legal basis: legitimate interest in responding to your enquiry (Article 6(1)(f)). Retention: 12 months from submission, then automatically deleted. You can request deletion at any time by emailing info@ganesacademy.com.

4. How We Use Your Data

  • To provide and personalise learning resources
  • To record homework scores, attendance and track progress
  • To monitor Platform performance and detect misuse

5. Data Retention

We retain your data according to the following schedule:

Active students
Duration of educational services
Inactive students
7 years after last service
Financial records
7 years for tax purposes
Communication logs
2 years
Enquiry form submissions
12 months
Audit logs
2 years with auto-archiving
Alumni program
Indefinite with consent
Automated deletion: Data is automatically deleted after retention periods expire. Upon request we will delete personal data without undue delay (typically within 30 days), subject to any legal retention requirements.

6. Disclosure to Third Parties & Processors

Your data is stored in Google Firebase (EU region europe-west2). Firebase acts as our data processor under Google's Data Processing Agreement. GitHub is used solely for private source-code hosting and does not process personal data. If you accept cookies on this site, Google (Google Analytics and Google Ads) and Meta (the Meta pixel) also receive website usage and advertising data, as set out in section 7. Google processes it under its Ads Data Processing Terms; both may process it outside the UK under appropriate safeguards.

Enquiry Processing Tools

We use automated software to categorise enquiries by subject and year group so our team can respond faster. Only your message text and year group are processed. Data is not retained by the tool after categorisation and is not used for any other purpose. Processing takes place in the US under Standard Contractual Clauses.

7. Cookies & Tracking

Essential storage keeps you signed in to your account and remembers your cookie choice. It is always on. Everything else is off until you choose: the banner offers Accept all, Reject non-essential, or a choice of Analytics and Advertising separately, both unticked.

  • Analytics, Google Analytics (cookies named _ga and _ga_ followed by our id): which pages are visited, your device and browser, your approximate area (town or city) and which link or advert brought you. Kept in your browser for up to 2 years; Google keeps the reports for no more than 14 months.
  • Advertising, Google Ads (cookies such as _gcl_au): records which of our adverts brought you here and whether you then sent an enquiry or called the number shown on the site (visitors from an advert see a Google forwarding number, and calls over 30 seconds are counted). Kept for up to 90 days.
  • Advertising, Meta pixel (cookie _fbp): the same for adverts on Facebook and Instagram. It does not load at all unless you accept advertising cookies. Kept for up to 90 days.
  • Matching an enquiry to an advert: if you have accepted advertising cookies and send an enquiry, your email address and phone number are scrambled (hashed) in your browser and sent to Google and Meta, only so they can tell us which advert led to the enquiry. If you have not accepted, nothing is sent.

Before you choose, Google's tag loads but sets no cookies; it sends only signals without cookies or identifiers (for example, that a page was viewed), which Google uses to estimate our advert results. The basis for all non-essential cookies is your consent. Google explains how it uses this data at How Google uses information from sites that use its services, and Meta at Meta's Privacy Policy.

This deletes the analytics and advertising cookies and shows the choice again.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Access

Obtain a copy of all personal data we hold about you in both PDF and JSON formats

Right to Rectification

Request correction of inaccurate personal data

Right to Erasure

Request deletion of your personal data with automatic cascading deletion

Right to Restriction

Limit how we process your personal data

Right to Data Portability

Receive your data in a machine-readable format

Right to Object

Object to processing based on legitimate interests

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption in transit and at rest
  • Regular security audits and penetration testing
  • Access controls and authentication
  • Comprehensive audit logging
  • Incident response procedures

10. Contact Us

For any privacy-related questions or to exercise your rights, please contact:

Data Protection Officer

Ganes Academy Ltd

84 Albert Hall Mansions

Kensington Gore, London, SW7 2AQ

Email: privacy@ganesacademy.com