Privacy notice

Global Online Academy of Leadership (“GOAL”, “we”) provides an online school for children from Kindergarten to Year 6. We are the data controller for the personal data described in this notice.

Questions about this notice, or about anything we hold on your family, go to privacy@goal.education.

About the adult holding the account:

• Name, email address, relationship to the children, time zone and locale.
• Your family name and market, which set your currency and your live teaching block.
• Billing records — invoices, payments and their status. Card details are handled by our payment provider and never reach our systems.
• Messages you send to staff through the platform.
• Your consent choices, and the history of changing them.

About each child:

• Name, preferred name, date of birth and year band.
• Any support needs or additional information you choose to tell us so that we can teach them well.
• Their timetable, attendance, submitted work, teacher feedback, portfolio and reflections; marks recorded by teachers.
• From you as a parent: the one-line Parent Journal each evening, Home Extension confirmations, your parent meeting request and your signed Commitment Agreement.
• Leadership observations written by their teachers, and reflections the child writes themselves.
• Sign-in credentials, from Year 3, where the child has their own account.
• Recordings of live sessions in which they appear, where you have consented to that.

We do not collect behavioural advertising data, we do not track families across other websites, and we do not build profiles for any purpose other than teaching the child.

We rely on the performance of our contract with you for the things that are simply the service — teaching, timetabling, marking, reporting and billing. We rely on legitimate interests for keeping the platform secure and for the access log. We rely on your consent for the things listed in section 5, each separately, and on legal obligation where safeguarding or accounting law requires it.

We do not use any family’s data to train machine learning models, and we do not sell it, ever, to anyone.

Everything we hold about a child is held because it is needed to teach them. Children under 13 do not hold their own accounts — from Year 3 a child has their own sign-in under their parent’s family account, and the parent sees everything the child sees.

A child is never shown a mark, at any age, on any screen. Marks exist in the record for teachers and parents; they are withheld from the child’s own view by the system rather than by a setting somebody could change.

Children are not marketed to. Marketing email is a separate consent, held by the adult on the account, and no marketing of any kind is sent to a child’s account.

We do not use a single tick box for consent. Six purposes are recorded separately, each one granted and withdrawn on its own, with the full history kept so that we can show what was permitted on any given day:

• Data processing — the base agreement that lets us run the service.
• Session recording — whether your child may appear in a recorded live session.
• Work shown in class — whether their work may be shown to their group.
• Materials and media — whether their work or image may appear in GOAL materials.
• Community circles — whether your family may take part in community spaces.
• Marketing email — entirely separate from service email, and off unless you turn it on.

You change any of these from your account at any time, and withdrawing one does not affect the others or your child’s place.

Access is enforced in the database itself, on every table, on every request. It is not a matter of which screen a person is shown.

• A parent sees their own children, and everything about them.
• A teacher sees the children they teach, and only those children.
• A child from Year 3 sees their own record. Marks are a teacher’s working record and are not shown to families.
• Administrative and safeguarding staff see what their role requires, and each access is logged.
• No member of staff can exchange a private message with a child: every message involving a child is visible to that child’s parent, as a constraint in the schema rather than a policy.

Every access to a child’s record is written to an access log, so that we can reconstruct after the fact who saw what and when. You may ask us for the log relating to your own children.

We use a small number of processors to run the service: a cloud hosting provider, a database and authentication provider, a video conferencing provider for live sessions, an email delivery provider, and a payment provider. Each is bound by a data processing agreement and may use the data only to provide their service to us.

We share data outside that list only where the law requires it, or where we have a safeguarding duty to do so.

Family and child data is held in a managed Postgres database hosted in Singapore, and the application is served from the same region. Transfers out of the UK and EEA are covered by the UK International Data Transfer Addendum and Standard Contractual Clauses with the relevant processors.

We apply UK data protection standards to every family, whichever country they live in, rather than applying the minimum each jurisdiction allows.

• Academic records, reports and portfolios: for the duration of enrolment and then for six years, so that a family can obtain evidence of their child’s education after leaving.
• Billing records: six years, as accounting law requires.
• Live session recordings: one term, unless you ask us to delete a particular recording sooner.
• Messages: for the duration of enrolment and then two years.
• Access logs: two years.
• Free demo accounts that never become enrolments: deleted twelve months after the demo ends.

You may ask us to give you a copy of everything we hold about your family, to correct anything wrong, to delete what we are not required to keep, to restrict or object to a particular use, or to hand your data to another provider in a portable form. Where we rely on consent, you may withdraw it at any time.

Write to privacy@goal.education and we will respond within one month. If we get it wrong, you may complain to the Information Commissioner’s Office at ico.org.uk.

• Row-level security on every table: a request that should return nothing returns nothing, whoever makes it and however it is made.
• Encryption in transit and at rest.
• Role-based access, with staff access to a child’s record logged.
• Passwords stored only as hashes; we cannot read yours.
• Regular review of who holds administrative access.

If we change this notice in a way that affects you, we will tell you by email before it takes effect rather than quietly updating the date at the top.

For anything in this notice: privacy@goal.education. Our terms set out the rest of the agreement.