Privacy Notice

Last updated: 22 July 2026

This privacy notice is for Chalk Learning CIC ("Chalk", "we", "us", "our"). We are a community interest company registered in Scotland with the registration number SC890420 and registered office at 3 Hill Street, Edinburgh, Scotland, EH2 3JP.

Introduction

We provide an online platform that is for use by teachers, educators and others to generate visual learning materials. The platform is known as Chalk Access. This Privacy Notice explains the personal data we collect, how we use it and how we keep it secure.

When using personal data for our testing purposes, allowing schools to have their teachers volunteer to test Chalk Access with their personal data, we act as the controller.

When Chalk Access or any other Chalk owned products is purchased as a service on behalf of a school or educator, or when it is being funded by another organisation we will be their data processor.

We are registered with the Information Commissioner's Office (ICO) with registration code: ZC205241.

We will only use personal data in accordance with this Privacy Notice. We comply with current data protection law and have built necessary safeguards to ensure all personal data is kept safe within the Chalk platforms.

If users have any questions or concerns relating to this Privacy Notice, they are encouraged to get in touch at [email protected].

Chalk use in Schools

When a Chalk based platform is purchased as a service by a client (a school or educational body etc.), where we are acting as a data processor on their behalf, we collect the following information from the people who use the platform:

• First name, last name, email address, job title, school name (either collected directly from the User or from the client)
• Opinions, ideas and concerns raised about the Chalk platform (collected directly from the User)
• Level of engagement with Chalk, quality of prompt, security flags raised by OpenAI's Omni moderation tool (collected within the platform)

Where there may be pupil or learner personal data held in a Chalk platform, it is to help teachers:

• Track a child's progress
• Build bespoke educational tools based on specific needs a child may have, and
• To measure the academic attainment against any bespoke educational tools created by the user

We collect children's:

• First name, last name, teacher name, school name, class name and year (collected from the school or the teacher)
• Suggestion a child may be considered as having Special Educational Needs and Disabilities (SEND) / Additional Support Needs (ASN) or another type of learning style based on the bespoke educational tool aligned to the child

Uses of personal data in Chalk Access

Where a school or local authority uses Chalk Access to support Additional Support Needs (ASN) provision, we process personal data about pupils on the controller's behalf. This will include:

• Pupil name (or a pseudonym/alias set by the school), year group and class
• ASN need categories and free-text descriptions of a pupil's support needs. This is classified as special category personal data concerning health under the UK General Data Protection Regulation (GDPR)
• Support arrangements such as support ratios (for example 1:1, 2:1 or shared) and the staff qualifications a pupil requires
• Looked After Child (LAC) status, which is safeguarding-relevant information
• Strategy feedback recorded by teachers (for example whether a strategy is working, being tried, or not working)

This data is entered by authorised school staff and, where a school chooses, imported through read-only integrations with school information systems (SEEMiS via Groupcall, or Wonde) and with Trellis (Child's Plan data).

We import only the minimum fields needed for teaching and learning; we do not import detailed medical case records or child-protection case notes. We use this pupil data only to:

• Help teachers find and align appropriate ASN strategies
• Log how a pupil is being supported with Chalk Access
• To give ASN coordinators an overview of provision, and
• To help schools allocate support staff.

AI is used only as decision-support. Where pupil context informs an AI request, it is pseudonymised and sent only to our AI provider Anthropic (Claude). No directly identifying pupil data is sent to any AI provider, and pupil data is not used to train AI models.

Please see your school or local authority's privacy information to confirm their lawful basis as the data controller for their pupil data which will typically be Article 6(1)(e) (public task) and, for special category data such as ASN/health data, Article 9(2)(g) (substantial public interest). We act as processor on their behalf under a written Data Processing Agreement and process this data only on the controller's documented instructions.

We also rely on the school / educational body's (our client's) lawful basis for the use of teacher personal data. Please see your school or local authority's privacy information to confirm their lawful basis which will typically be, use of personal data for a task in the public interest (UK GDPR Article 6.1(e)) and, for special categories of personal data e.g. SEND/ASN data, use of personal data for substantial public interest (UK GDPR Article 9.2(g)).

Where we are collecting feedback through surveys, questionnaires, invitations to interact with us, and to report on the effectiveness of the Chalk platform being used we rely on our legitimate interest as a data controller for this use of personal data and will always be voluntary for the person who is providing the feedback.

Using Chalk Access for our research & development

We sometimes approach schools who give their teachers and teaching staff the opportunity to use a Chalk platform voluntarily. This means we collect personal data directly from people who would like to try a Chalk platform, also known as "Users". We are the controller for User personal data. We collect:

• First name, last name, email address, job title, school name (collected directly from the User)
• Interview and/or survey answers and any digital communications (such as emails or direct messages with the Chalk team) (collected directly from the User)
• Opinions, ideas and concerns raised about the Chalk platform (collected directly from the User)
• Level of engagement with the Chalk platform, quality of prompt, security flags raised by OpenAI's Omni moderation tool (collected within the platform)

We ensure that Users understand they are able to use the Chalk platform on the basis of providing us feedback by asking them to agree to using a Chalk platform on the basis of providing us feedback for our own research and development of the platform.

The lawful basis we rely on for the use of User's personal data when testing, and to conduct research on all uses and effectiveness of our Chalk platforms is our legitimate interest as a data controller (UK GDPR 6.1(f)). Where possible we reduce, pseudonymise and anonymise personal data where we can.

Website visitors

When you visit our website, we will collect the following information about you:

Like all organisations we are able to see details of the user's web browser, operating system, and geographical region, among other details. We do so based on our legitimate interest as a data controller.

We use tracking pixels and analytics tools (including Facebook Pixel) to understand how users interact with our website, measure the effectiveness of our advertising campaigns, and improve our marketing efforts. We do this based on consent you have provided us within the Cookie banner.

Please also refer to our Cookies information below.

Use of Generative AI Services within Chalk

Our platform uses third-party generative artificial intelligence services to create educational content. If you use Chalk's AI-powered features, your inputs may be processed by:

• OpenAI (ChatGPT/GPT models) - Privacy Policy
• Anthropic (Claude) - Privacy Policy
• Google AI (Gemini) - Privacy Policy
• Groq - Privacy Policy
• Black Forest Labs (Flux) - Privacy Policy

We have opted out of having user data used for training these AI models. Only pseudonymised pupil personal data is sent to Anthropic (Claude). No directly identifying pupil data is sent to any AI provider.

Marketing and Outreach

To work towards our goals, we reach out to organisations and public bodies. We do this only where we see necessary and have balanced our needs with the interests of those receiving the direct communications. This is on the basis of our legitimate interests as the controller.

We may contact those we believe have closely aligned aims, and schools and other educational establishments where we believe we can support their learners and help toward their educational goals. This is on the basis of our legitimate interests as the controller.

Our database is reviewed regularly, and contacts are removed where necessary. We also respect the rights of our contacts to withdraw their details in accordance with our data storage processes. We do this on the basis of our legitimate interests as a data controller for the marketing we do.

For other marketing activities we gather consent from the contact where there has not been a purchase and we are not in the negotiations of a sale with you.

Recruitment

Where you are a job applicant, we use your personal data in the recruitment process for employment or work experience in the following ways:

• To reply to you about the position you have applied for or inquired about
• To approach you as a good fit for employment or work experience
• To check you are the right candidate for the role
• To move your application forward including making changes in applicant tracking systems or dedicated recruitment-based software and websites
• To receive a reference from a sectoral relevant individual where they have gained permission from you to be introduced to us
• To send you notifications for other job, work experience or maybe internship vacancies
• To inform you about the status of your application
• To gain your permission to retain your personal data for longer than statutory requirements where you have not been successful, but we would like the opportunity to invite you to apply again in the future or notify you about upcoming roles that might be suitable

Please be reassured that we limit access to your recruitment personal data to those who have a genuine need to access it:

• the recruiting manager for the role in question
• interviewers/assessment reviewers for the role in question
• the director of the team where the role in question sits
• the director of finance and resources who has final authority for appointment (note that there may be overlap between the people in those positions)

We maintain a reserve list of candidates who met our requirements but were not successful in securing the specific post they applied for. We'll ask for your permission to be added to this list. We will refer to the list when other roles are advertised and will contact you if you match the role. We will ask for your permission before putting you forward for the role.

If you are successfully recruited, we will upload your details to our digital systems. We will also share your data for statistical analysis (it will be anonymised first) if we are required to do so by law - for example, by court order, or to prevent fraud or other crime.

For the purposes of reporting on and improving the effectiveness and efficiency of our recruitment systems and processes, we may retain a handful of personal data points about you (the source of your application, the stage you reached in the process, and the overall reason you were rejected), however, none of these data points are personally traceable to you.

We process personal data throughout the recruitment application process based on different legal bases:

• Contract: Processing your data is necessary to move your application forward before signing a contract of work. This concerns employment or pre-employment checks.
• Legal: Complying with applicable law with regard to personal data necessary to satisfy our legal and regulatory obligations, including with regard to public health and workplace safety, entitlement to work and when applicable security checks.
• Legitimate Interest: Evaluating your application and to manage our relationship with you, to ensure that we recruit appropriate employees, and to evaluate and maintain the efficacy of our recruiting process more generally.

Keeping data secure

Our platform is hosted on Vercel and Supabase, and information is stored there. The services are ISO27001 or SOC 2 compliant. The personal data is encrypted.

This includes spreadsheets and word processing documents as well as processing via the services listed below. All systems are password protected and restricted to relevant users, and staff laptops are encrypted so that loss would not be expected to result in loss of user data. We operate in a generally paperless environment and do not print documents containing personally identifiable information.

Processors

To be notified of updates to the list of processors, users can register using the form at the bottom of the page.

Sharing Data

We will keep personal information confidential and do not sell or disclose information to advertisers or external parties, except where they are integral to the Chalk platform agreed in a contract or users have explicitly given us permission to do so.

There are some unlikely circumstances in which we would be required to share data outside of a contract or without requesting explicit permission from the user. These include if we believe in good faith that we are required to in order to comply with a regulator or court in order to comply with law, regulation, legal process and court order. We may also share information in order to enforce terms of the contract.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded by implementing at least one of the following safeguards:

• Transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK (the UK also recognises the European Commission list of adequate countries. For further details, see European Commission: Adequacy of the protection of Personal Data in non-EU countries)
• Specific contracts/agreements approved by the UK which give personal data the same protection it has in the UK. For further details, see UK International Data Transfer Agreements. We will also assess in-country standards as part of this process.

We may also share your personal data if we choose to sell, transfer, or merge parts of our business or our assets in the future. Or we may seek to acquire other businesses or merge with them. During any such process, we may share your data with other parties. We will only do this if they agree to keep your data safe and private. If a change such as this happens, then other parties may use your data in the same way as set out in this notice.

How long we keep your data

Data shall be reduced, redacted, de-identified and deleted at appropriate times so we retain the minimum amount of data possible. Personal data that we use for any purpose will not be kept for longer than is necessary for that purpose.

In some circumstances we will anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Notwithstanding the other provisions of this section, we will retain your personal data:

• To the extent that we are required to do so by law
• If we believe that the information may be relevant to any ongoing or prospective legal proceedings
• To establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk)
• If we believe we have an overriding legitimate interest in order to do this. This is particularly the case for the "right to erasure", where we maintain a minimal amount of information on our records.

When you submit a right to deletion request, we will delete you from any and all locations we hold your personal data where it would mean we may make contact with you again and we will retain your information if:

• It has been, or is being used within a complaints, disputes or grievance process by us and we may need to evidence this in the future to defend legal claims.
• We need to keep it to comply with a legal obligation.
• Erasing your data would prejudice scientific or historical research.
• There is information associated with your data which is of a safeguarding concern to yourself or others.
• Erasing will mean we lose our logs of when you made any data protection rights requests.
• Erasing will mean we are unable to understand if you have been a member in the past.

If you are a representative of a supplier to us, we retain your personal data for 7 years after your service has ended, although may be longer if there are legal circumstances which mean we need to keep your personal data for longer.

Unless you specifically tell us otherwise, or we receive a notification of your personal data being incorrect within a digital system, we will retain your personal data in all locations where it is held or until such a time it is no longer tenable to keep your personal data for any reason.

Where we are acting as a processor under a contract with a controller it is up to the controller to maintain a retention schedule and monitor deletion within their policies.

Rights of the Data Subject

To express any of your data protection rights you can send an email to: [email protected]

• Right of Access: You can request a copy of your personal data and details about how we use it
• Right to Rectification: You can ask us to fix or change your personal data if it is wrong or incomplete
• Right to Erasure: In some circumstances you can ask us to delete your personal data
• Right to Restriction: You can ask us to limit how we use your personal data if:
  • it is not correct
  • it has been used against the law, but you do not want us to delete it
  • we do not need it anymore, but you want us to keep it for legal reasons
  • if you have already asked us to stop using it but you are waiting for us to confirm
• Right to Object: You can ask to take back your consent for us to use your personal data at any time
• Automated Decision-Making Rights: You have the right not to have decisions made about you by a computer, if those decisions significantly affect you (e.g. legally)

You will not have to pay a fee to access your personal data (or to use any of the other rights). However, we might charge a fee if your request is unreasonable or too much. Also, we may refuse to comply with the request in such circumstances.

To make sure that we can account for the risks, we ask everyone who submits a rights request to verify their identity. We are allowed to do this in line with what the UK regulator, the ICO, says on their website. Further information about your rights is on the ICO website which can be accessed by clicking here.

How to Complain

Please submit any complaints you have about how we are handling your personal data or meeting your expectations around data protection laws to: [email protected]

If you are not happy with how we have handled your complaint, you can then complain to the Information Commissioner's Office. This is their information:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://ico.org.uk/concerns/

Cookies

Cookies are small text files that are placed onto a device when users first visit a website which monitors interactions with the site.

We use cookies to:

• Recognise you when you return.
• Keep you logged in.
• Embed content hosted by third parties.
• Provide a support chat service (coming soon).
• Improve your experience on our websites through monitoring content and feature usage.
• Track advertising effectiveness and user behaviour through Facebook Pixel and similar technologies.

There are four categories of cookies we set:

• Necessary cookies– these cookies are necessary for the website to function properly. Some of the following actions can be performed by using these cookies: keeping you logged in; serving video content we host on Vimeo; storing your cookie consent preferences.
• Performance cookies– these cookies are used to gather statistical information about the use of our websites, also called analytics cookies. We use this data for performance and website optimisation.
• Functional cookies– these cookies enable more functionality for our website visitors and can be set by our external service providers or our own website. The following functionalities may or may not be activated when you accept this category: support live chat; social media content feeds and sharing.
• Advertising cookies– these cookies are used to track user behaviour across websites for advertising purposes. We use Facebook Pixel and similar technologies to measure the effectiveness of our advertising campaigns, understand user interactions, and provide relevant advertising experiences.

The full list of cookies we use across our sites can be viewed via the cookie information panel on our website.

You can manage and delete cookies through your web browser. Each browser manages cookies differently, but you can learn more about cookie settings in the most common browsers using the links below:

• Chrome
• Firefox
• Safari for Mac
• Safari for iOS
• Edge
• Internet Explorer

Changes to this Policy

We will notify users when this Privacy notice changes and provide a jargon-free summary of the changes. In order to receive notification of changes users should register at the bottom of this page.

Queries

If you have any questions or queries about our data privacy, please get in touch at [email protected]