1. Who we are
PawSteps is provided by Pets on the Green Ltd (Company No. 16721467), Warlingham, Surrey. We are registered with the Information Commissioner’s Office (ICO) under reference C1918829. Our data protection contact is Ciera O’Rourke — orourkeciera@gmail.com.
2. What we collect
| Data | Why |
|---|---|
| Parent/teacher email & account details | To create and support your account and, for schools, manage the licence |
| Learner profile (first name/nickname, age band, avatar) | To show age-appropriate content and save progress |
| Learning activity (lessons, quizzes, time-on-task) | To show progress and generate reports/certificates you request |
| Wellbeing entries | Kept on your device by default — not sent to our servers |
| SEND/EHCP evidence (school use) | Only where a school enables it, to support statutory evidence |
No account is needed to browse core content. Children can use a nickname. We do not use children’s data for advertising or profiling for marketing.
3. Lawful bases
For family subscriptions we rely on contract (to provide the service) and consent for any optional wellbeing data we retain. For schools, the school is the data controller and we act on its instructions under a Data Processing Agreement; the school’s lawful basis (typically public task) applies.
4. Where your data lives
All personal data is hosted in United Kingdom data centres operated by Netlify (web hosting) and Supabase (database, EU/London region). We do not transfer personal data outside the UK without an appropriate legal safeguard. Data is encrypted in transit and at rest.
5. How long we keep it
| Data | Retention |
|---|---|
| Account & profile | For the life of the subscription, then deleted within 90 days of closure |
| Progress data | Retained while the account is active; exportable by you at any time |
| Wellbeing entries | Held on your device; you can clear them at any time |
| Billing records | Retained for 6 years to meet HMRC/company-law requirements |
6. Who we share with
We use a small number of vetted sub-processors (UK hosting, transactional email, payments) under data-protection contracts — listed in our Data Processing Agreement. We do not sell personal data. We disclose data only where required by law or to protect a child (see our Safeguarding Policy).
7. Your rights
You can request access, correction, deletion, restriction or portability of your data, and object to certain processing. Contact orourkeciera@gmail.com. You can also complain to the ICO (ico.org.uk).
8. Cookies & tracking
We use only essential cookies plus, with consent, privacy-respecting analytics. We do not run third-party advertising trackers on children’s pages. Full detail is in our https://pawsteps.co.uk/cookies.html.
9. Security & breaches
We apply role-based access, MFA for admin, encryption, backups and monitoring. If a breach affecting your data occurs we will act promptly and, where a school is the controller, notify it without undue delay to support its 72-hour ICO duty.