Privacy Policy

Last updated 27 June 2026

This policy explains how Polymorphic Studios Ltd (trading as “Software for Schools”, “we”, “us”) collects and uses personal data through our website and our products. We are committed to protecting your privacy and handling personal data — including children's data — responsibly and in line with UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Software for Schools is a trading name of Polymorphic Studios Ltd, a company registered in England & Wales (company no. 09041072), registered office 237 Westcombe Hill, London, SE3 7DW. We are registered with the Information Commissioner's Office (ICO), registration number ZC183757.

For any privacy question or to exercise your rights, contact us at [email protected].

Our two roles

We act in two different capacities depending on the data:

• As a “controller” for the personal data you give us directly through this website — for example, when you submit our contact or demo-request form. This policy primarily covers that data.
• As a “processor” for the personal data that schools enter into our products (including data about children). In that case, the school is the controller and decides how the data is used; we process it only on the school's documented instructions under a written data processing agreement. If you are a parent, child or member of school staff with a question about data held in our products, please contact your school in the first instance.

Information we collect through this website

When you complete our contact or demo-request form, we collect the information you provide:

• Your name
• Your role
• Your school or organisation
• Your email address
• Your telephone number (if provided)
• The contents of your message

We do not use non-essential cookies or third-party analytics on this website. We use only strictly necessary cookies required for the site to function securely (for example, to maintain your session and protect forms against cross-site request forgery).

Technical information collected automatically

When you use our website, our hosting providers may automatically collect limited technical information — such as your IP address, browser type and server logs. We use this information for security, fraud prevention, diagnostics, and to keep the website running reliably.

How we use this information and our lawful basis

We use the information you submit to respond to your enquiry, arrange demonstrations, and discuss whether our products are suitable for your school. Our lawful basis is our legitimate interests in responding to enquiries about our products and, where relevant, taking steps at your request prior to entering into a contract. We will not use your details for unrelated marketing without your consent.

We do not use personal data collected through our website or products to train or improve artificial intelligence or machine learning models.

Who we share information with

We never sell your personal data. We share it only with trusted service providers who help us operate, and only to the extent necessary. These currently include:

• Postmark (ActiveCampaign, LLC) — transactional email, used to send and receive enquiry messages
• Laravel Cloud (running on Amazon Web Services, London region) — application, database and file hosting
• Cloudflare — DNS, content delivery and network security for our website

These providers act as our processors under contract. A current list of our product sub-processors is available on request.

We may also process or disclose personal data where necessary to comply with our legal obligations, to establish, exercise or defend legal claims, or to protect our legal rights.

International transfers

Where any of our providers process data outside the UK, we ensure an appropriate safeguard is in place — such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement / Standard Contractual Clauses.

How long we keep it

We keep enquiry correspondence only for as long as needed to deal with your enquiry and any resulting relationship, and then for up to 24 months after our last meaningful contact, after which it is deleted — unless a longer retention period is required by law or because a customer relationship continues. Personal data we process on behalf of schools is retained in accordance with the school's instructions and our agreement with them.

Children's data

Our products are used by school staff to support the children they teach, and may include data about those children. We do not market to children, and children do not log in to our products. When we process children's data, we do so only as a processor acting on a school's documented instructions and applying appropriate technical and organisational safeguards. The relevant school is the controller for that data and is responsible for the lawful basis and any necessary consents.

How we protect your data

We apply appropriate technical and organisational measures to keep personal data secure, including encryption in transit, access controls, role-based permissions scoped to each school, and support for two-factor authentication on staff accounts.

Your rights

Under UK data protection law you have rights over your personal data, including the right to access it, to have inaccurate data corrected, to have it erased, to restrict or object to its processing, and to data portability. To exercise any of these rights for data we hold as a controller, contact us at [email protected]. We will normally respond to requests relating to personal data that we control within one month, although UK data protection law permits a longer period in certain circumstances. For data held within a school's account, please contact the school, as they are the controller.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk — though we would appreciate the chance to address your concerns first.

Changes to this policy

We may update this policy from time to time. The “last updated” date above shows when it was last revised. Material changes will be reflected here.

Contact

Polymorphic Studios Ltd [email protected]