Data Protection Policy

We only process personal information where we have a lawful basis.

We process personal information fairly and do not use it in ways that would be unexpected.

We are clear about how we use personal information through privacy notices and policies.

We only use personal information for the purposes for which it was collected.

We only collect the minimum information necessary. If Larry doesn't need the information, Larry shouldn't ask for it.

We keep personal information accurate and up to date.

We do not retain personal information for longer than is necessary. See our Data Retention & Deletion Policy.

We apply appropriate technical and organisational security measures.

We take responsibility for our data protection practices and maintain documentation.

We embed privacy into product design from the beginning, not as an afterthought.

Children's information is treated with particular care. We apply the UK Age Appropriate Design Code (Children's Code).

We respect and facilitate individuals' rights under UK GDPR.

We ensure processors are bound by appropriate data processing agreements.

We have procedures for identifying, reporting and responding to data protection incidents. See our Data Breach & Incident Response information.