Bedrock Learning Privacy Policy

Last Reviewed: 26/10/2026

Being an online organisation and with digital technology at the heart of everything we do, online safety for our customers is paramount, especially as the majority of our users are students of primary and secondary school age. This privacy statement explains what personal data Bedrock Learning collects from you, through our interactions with you and through our products, and how we use that data. Bedrock Learning Ltd complies with the General Data Protection Regulation (GDPR) and is registered with the Information Commissioner’s Office.

Any questions about our privacy policy or the way we use data should be directed to DPO@bedrocklearning.org or our postal address Bedrock Learning, Kiln House, Pottergate, Norwich, NR2 1BZ.

Our Data Protection Officer is Kit Tse. He can be contacted using the email address above.

Contents

• Product data collection and use
• How to update your information
• Legal bases for processing and marketing use of data
• Marketing and analytics
• Data we receive from third parties
• Our role as a data controller and a processor
• Subject Access Requests
• How long will we keep information about you?
• Who has access to my/my learners’ data?
• Cookies
• Bedrock Learning working practices
• Data breaches

1. Product data collection and use

By accepting your invoice, you will be subject to Bedrock Learning terms and conditions; teachers acknowledge that they are primarily responsible for providing consent from the applicable parent/guardian and will ensure that all information is accurate and correct in relation to obtaining such consent.

Bedrock Learning provides a personalised experience for its users. Account information for our e-learning products including teachers and students are password protected so that only the user and account administrators have access to this personal information. By requiring users to log in, Bedrock Learning students can access the relevant content and their progress can be monitored.

We recommend that you do not divulge your password to anyone. Bedrock Learning will never ask you for your password in an unsolicited phone call or in an unsolicited email. If you have finished using the resource, we recommend that you sign out.

Learners’ user accounts do not include any information that identifies them with their educational institution. Students’ email addresses are not displayed on the site.

Bedrock Learning collects the following data and stores it securely:

Teachers

Bedrock Learning creates teacher accounts which allow teachers to manage their own classes and monitor progress with added security. We ask teachers for their title, first name, last name, organisation and email address. We use this information to monitor and analyse user needs. We will also use this personal data for the purposes of administration and operation of the service.

Learners

When creating a new student account, we require a first name, last name, UPN, date of birth and class name. You can provide learners’ school email addresses for password retrieval purposes, but this is not essential for student account creation. Schools may also provide us with information including Unique Pupil Numbers, gender, ethnicity, first language, SEND status and reading age. We also keep records of the marks learners score in the various learning exercises. We use this information to monitor progress and analyse learning needs. We will also use this personal data for the purposes of administration and operation of the service. We will disclose learning scores to parents/guardians, teachers and schools as part of the service. We aggregate the marks scored by learners for the purpose of our internal statistical analysis and research. When this analysis is performed, it may be used for marketing purposes. In this case, all data is anonymised.

2. How to update your information

You can update your account information by calling the team on +44 (0) 203 325 9345 or by emailing DPO@bedrocklearning.org. In any case, we will confirm your identity via email before we make any changes.

Teachers

Personal information which you supply to us will only ever be used in the following ways:

• To update you on learner progress
• To update you on product developments relevant to your usage of Bedrock Learning
• To troubleshoot any technical issues
• To send you teaching and learning updates
• To monitor and analyse user needs
• For the purposes of administration and operation of the service

Learners

Personal information which is supplied to us will only ever be used in the following ways:

• To track learner progress
• To troubleshoot any technical issues
• To generate conclusions about the impact of the programme. (When producing large-scale analytics, all data is anonymised. Any conclusions drawn from these analyses will only be used to develop the product and for marketing purposes, thus the impact on the individual will be limited.)

We may disclose learner marks to parents/guardians, teachers and schools as part of the service.

We aggregate the marks scored by learners for the purpose of our internal statistical analysis and research. This data is anonymised.

Parents

Personal information supplied to us will only ever be used in the following ways:

• To update you on learner progress
• To update you on product developments relevant to your usage of Bedrock Learning
• To troubleshoot any technical issues
• To monitor and analyse user needs
• For the purposes of administration and operation of the service

3.a. Legal bases for processing and marketing use of data

Bedrock Learning relies on two main legal bases when processing personal data:

1. Performance of our contract with you – we need certain information to provide services under our User Terms. This includes enabling access to Bedrock Learning resources, fulfilling product orders, managing technical support, billing, and engaging essential third-party providers if and where necessary.
2. Legitimate interests – in other cases, we process data because it is necessary for our business interests and balanced against your rights. These include:
   • marketing and business intelligence, including marketing emails to work email addresses and using work contact details we receive from third parties (see section 3C);
   • certain sales functions;
   • analytics and product personalisation;
   • non-essential third-party service providers.

We regularly test our legitimate interests by:

• identifying our business interest;
• checking necessity of the processing;
• balancing our interests against your rights.

Marketing emails to work addresses

Under the Privacy and Electronic Communications Regulations (PECR), work email addresses at schools and other organisations belong to "corporate subscribers", so we don't need your prior consent to send you relevant marketing at your work address. We rely on legitimate interests, having checked that our emails are relevant to your role and balanced this against your privacy rights. Every marketing email includes a clear option to unsubscribe, and you can object at any time.

On occasion, we rely on explicit consent, for example:

• sending marketing messages to personal (non-work) email addresses or by SMS;
• sharing your professional experience in case studies;
• using cookies for online advertising.

We always ensure our processing is necessary and proportionate.

3.b. Marketing and analytics

We may use your data to:

• tell you about Bedrock Learning products and services we believe will be relevant (unless you opt out);
• improve and personalise your experience using analytics;
• invite you to surveys, research, or case studies (always voluntary);
• offer free trials, demos, or previews of new resources;
• contact you about subscription extensions or related modules;
• run competitions or promotions.

We may contact you through in-product messages, live chat, telephone, SMS, email, post, or social media.

We may also show you relevant advertising on trusted third-party platforms (e.g. LinkedIn, Google, Facebook, Instagram). This is done by creating anonymised, targeted audiences. You can opt out via those platforms’ settings or by contacting us directly.

You have the right to object to us using your personal data for marketing at any time. If you do, we will stop. It is free and you do not need to give a reason. You can manage your marketing preferences at any time by:

• clicking “unsubscribe” in any of our emails,
• emailing DPO@bedrocklearning.org,
• calling +44 (0) 203 325 9345.

Some service-related messages (e.g. billing or security alerts) cannot be opted out of.

We also use third-party analytics providers (such as Google Analytics) to understand how our products are used. Some emails may include tracking to help us measure effectiveness, but we do not track your behaviour on third-party websites after you leave ours.

We only work with trusted providers who comply with data protection law, and they cannot use your data for their own purposes.

3.c. Data we receive from third parties

We get some school staff work contact details (name, job title, school, work email) from specialist education data providers. We’ll tell you which provider supplied your details in our first email to you, or at any time if you ask. These providers collect and maintain information from sources including publicly available school directories, government records, professional websites and direct contact with schools. This means you may not have asked to hear from us directly.

We use this information to communicate with education professionals about Bedrock Learning products, services and resources relevant to their professional responsibilities. We rely on our legitimate interests as the lawful basis for this processing, as explained in section 3A. Our first email to you will also tell you that we hold your details and where to find this policy and will be sent in any case within one month of receiving them. You can object or unsubscribe at any time (see section 3B).

4. Our role as a data controller and a processor

Bedrock Learning acts in two capacities:

• As a data controller when processing data for our own purposes (e.g. marketing, billing, providing subscribed services).
• As a data processor when processing data on behalf of schools (e.g. student learning records). In these cases, the school is the data controller and we act on their instructions. Please refer to your school’s privacy policy for further details.

5. Subject Access Requests

If you wish to make a request for ‘personal data’ under the GDPR guidelines, you can either email us at DPO@bedrocklearning.org or by contacting us via our postal address: SAR, Bedrock Learning Ltd, Kiln House, Pottergate, NR2 1BZ. If you make the request electronically, we will provide the data electronically. Please supply as much detail as possible in order that we provide the most relevant information in relation to your request.

There is no fee to access your personal data and we will respond within one calendar month of receiving your request. If your request is complex or you make several requests, we may extend this by up to two further months; if so, we will tell you within the first month and explain why.

If you are unhappy with how we have handled your request or used your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

6. How long will we keep information about you?

Bedrock Learning stores data for its users. To ensure that Bedrock Learning does not hold user information in perpetuity, it has set criteria for the deletion of unused data.

User accounts

Bedrock Learning holds data for teacher and learner accounts. If these accounts are left inactive for two years, they will be deleted. The definition of inactive is if the user has not logged in (via any route) for two years. Any empty classes and groups will be deleted after two years and any classes or groups that exist on an inactive account for two years will also be deleted.

Progress Tracker

Any saved score data will be deleted after 5 years on a rolling basis. Even if the learner is still active, we will only hold 5 years’ worth of results per child; if more is required, the export data feature should be used.

Marketing contacts

We keep marketing contact details for up to 24 months after your last engagement. Where we have an ongoing customer or sales relationship with you or your school, we keep them for as long as that lasts, and for up to 24 months after.

7. Who has access to my/my learners’ data?

To ensure that the user receives the best customer care, members of Bedrock Learning staff have access to user data. However, only essential Bedrock employees have access to this information. Our third-party DevOps team also has access to this data. In correspondence with schools, we clearly request that all personal data is sent directly to the customer management team. If, for whatever reason, it is sent to another member of staff, they will immediately delete the file and inform the sender. Bedrock Learning Ltd will not be liable for the error.

Sharing Data

Bedrock Learning has a strict policy of not sharing any information about learners with anyone outside the organisation other than our DevOps team. Please note that the passwords can be controlled by the users themselves and may not be well-chosen, securely stored and may be shared by the whole school but we are not in control of that and strongly discourage such behaviours.

Bedrock Learning will not share learner data with other third parties unless explicit instruction is given by the school in question, for example, to integrate with a VLE provider. We will never sell user information.

Education data providers: we send the education data providers we work with school-level details (school name, postcode and school identifiers) so they can match them against their records. We don't send them personal data about our contacts for this purpose.

External Data Storage

Bedrock Learning stores data on our secure database servers. The servers are housed in secure data centres, trusted and used by many of the country’s leading organisations. Physical access to our servers is strictly limited to data centre staff, our own IT staff and accompanied external contractors when needed, in order to maintain the servers. Access to the servers in the data centre requires proof of identity (photo ID) and is controlled by magnetic card readers and keys to both the cages and individual cabinets that surround the server racks, all of which are monitored by the data centre security staff using CCTV. Remote access to the data is limited to the tools needed by the IT support staff to maintain and operate the servers and is restricted to known users (identified by usernames and secure keys) connecting from known locations (IP addresses). Bedrock Learning stores data on UK and EU servers only.

8. Cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a site.

We use cookies on Bedrock Learning to provide you with the best possible experience on our website and to identify critical details such as account, user and curriculum identification.

Additionally, we use cookies from Google Analytics to record your usage of the website anonymously. This helps us analyse data about webpage traffic and improve our service in order to tailor it to customer needs. We only use this information for statistical analysis purposes to influence our development plans.

Targeting cookies

We also use targeting cookies. Third party vendors including Google may use these types of cookies to deliver advertising that is relevant to your interests. These cookies can remember that your device has visited a site or service, and may also be able to track your device’s browsing activity on other sites or services other than Bedrock Learning.

This information may be shared with organisations outside of Bedrock Learning, such as advertisers and/or advertising networks to deliver the advertising, and to help measure the effectiveness of an advertising campaign or other business partners for the purpose of providing aggregate Service usage statistics and aggregate Service testing.

You can opt out of these kinds of cookies by adjusting your own ad settings (by visiting Google ad settings) or adjusting your own device settings.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

Before using our website, we ask you to give your consent to the use of cookies. At any point, you may withdraw this consent.

If you have any questions about the use of cookies, please do not hesitate to contact us.

9. Bedrock Learning working practices

As part of our commitment to transparency, we have detailed our working practices with regards to data management and protection.

Data Use

When working with personal data, Bedrock Learning Ltd employees should ensure the screens of their computers are always locked when left unattended.

Data will be password protected before being transferred electronically. When sending data externally to schools or parents, a secure file transfer will be used, which encrypts all data in transit. For the purposes of sending other, non-sensitive personal data, files will be password protected.

Employees should not save copies of personal data to their own computers. They will always access and update the central copy of any data.

Data Accuracy

Under law, we are obliged to take reasonable steps to ensure data is kept accurate and up to date. To ensure we fulfil this responsibility, we commit that:

Data will be held in as few places as necessary. Staff should not create any unnecessary additional data sets.

Staff should take every opportunity to ensure data is updated. For instance, by confirming a customer’s details when they call.

Bedrock Learning Ltd will make it easy for individuals to update the information we hold about them. Any customer can do this by contacting DPO@bedrocklearning.org

Data will be updated as soon as any inaccuracies are discovered.

10. Data breaches

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes.

In the unlikely event of a data breach, Bedrock Learning will follow a strict protocol:

Employees are trained to immediately recognise a data breach and understand that a data breach is not only about loss or theft of personal data. As soon as a data breach is identified, the employee will escalate the incident to our Data Protection Officer. We will evaluate the risk to the individual(s) concerned and the size of the breach. If it is deemed that there is a risk to individuals or if the breach affects a large number of users, we will notify the ICO within 24 hours.

We will notify affected individuals about any breach within 24 hours and this will be documented in company records.