School Privacy Notice

CLEAR FEAR FOR SCHOOLS

Last Updated: April 2025

The Company

We are stem4, a private limited company by guarantee and a registered charity in England and Wales (collectively referred to as “stem4”, “we”, “us” or “our” in this privacy notice). 

Our registered office address is Connect House, 133 – 137 Alexandra Road, Wimbledon, SW19 7JY. We are the controller of your personal data and are responsible for it.

Privacy Notice

This privacy notice is provided to you (“you” or the “user”) as part of your school’s participation in stem4’s Clear Fear product for schools (the “CF product”). 

This privacy notice will inform you as a member of staff at a school using the CF product about how and why your personal data is used by us in connection with the CF product, how we look after your personal data, and what privacy rights you have in respect of your personal data under data protection law. 

We take our data protection and privacy responsibilities seriously and we are committed to protecting your personal data. 

Why do we collect your personal data?

Personal data refers to any information that relates to an identified or identifiable individual.

As a member of staff at a school using the CF product, we collect and use your personal data so that we can provide our services and resources as part of your school’s use of the CF product. We will use any personal data that you provide to us solely for the purposes of providing you with these resources and services as part of the CF product, and allowing you to access the CF product. 

What personal data do we collect? 

When a school registers for the CF Product, the school is identified as a licensee and its name will be assigned to its private dashboard. This is done in a secure document that is separate to the dashboard and there is no reference to the school on the dashboard itself. We also require the names and contact details of certain members of staff at the school with whom we are in contact. 

During the registration process for the CF product, we will collect the following types of personal data about you:

  • school admin users: first and last name, school email address and phone number. 

When associated with a school account for the CF product, the name of the school which school admin and teachers attend will also be recorded.

If the school does not provide all the information we require to complete the account setup process, we will not be able to provide the school, school admin users or school teachers with membership or access to the CF product, including the school’s dashboard. 

We may also collect personal data from school admin users and/or teachers through feedback questionnaires. This feedback will be collected using online feedback questionnaires on Google Forms. In addition, we may conduct virtual or in-person review sessions with participating school teachers. Notes taken by us during these review sessions will be retained by us and kept confidential. Any personal data in these notes or feedback will only be made public in relevant publicity and marketing materials with the relevant school admin user or teacher’s explicit consent. 

How do we collect your personal data?

We collect personal data about you through the account creation process when your school purchases a subscription for the CF product.

We may also collect your personal data through feedback questionnaires and virtual or in-person review sessions, as described in the section above entitled “What personal data do we collect?”.

How do we use your personal data?

In summary, we use your personal data to:  

  • register the school’s CF product;
  • provide you with the resources and services that are part of the CF Product, including access to the school’s specific dashboard;
  • carry out troubleshooting and provide technical support in relation to the CF Product; and
  • manage our relationship with registered schools and their subscriptions.

When we process your personal data, data protection law requires us to identify a legal basis for processing your personal data. The legal basis that we rely on to process your personal data can be different depending on the circumstances in which we process it. Most commonly, we will rely on the following legal bases when processing your personal data:

  • where we need to perform a contract with you;
  • where the processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (e.g. for the purposes listed above);
  • where you have provided your consent to the processing (e.g. where a teacher consents to us publishing any of the personal data obtained from them in a feedback questionnaire or as part of an in-person review sessions); and
  • where we need to comply with a legal obligation (e.g. where we are required to disclose your personal data to a court or regulatory authority). 

We may:

  • monitor, analyse, and compile statistical and performance information based on and/or related to your or your school’s use of the CF Product in an aggregated and anonymised format. Such aggregated and anonymised data does not contain your personal data, as you cannot be directly or indirectly identified from it. 

Who has access to your data? 

Specific members of staff at each licensee school will be granted access to their school’s dashboard only. Access will be determined by each participating school rather than stem4. 

The technical support team at stem4 and our app developer HMA Designed Solutions Ltd may have access to your personal and usage data if required for the purposes of account management, monitoring the performance of the CF Product, customer service and to perform technical system support. 

Additionally, we may share your information with others in certain situations, including:

  • courts (e.g. pursuant to a court order) or regulatory / governmental authorities;
  • professional advisors and agents;
  • other organisations that provide services to us. We use Google for our email and document storage within stem4; we have an external IT support company who may access your personal and usage data for technical support reasons and we have a web development and hosting service who process your usage data on our behalf. Additionally, we hold your contact details on our cloud based client relation management (CRM) system (which is provided by our external cloud services provider). The processing of your data by these service providers is subject to a data processing contract, with appropriate protections in place as required by data protection law. This helps ensure that your school’s data is handled in accordance with data protection laws.

How long do we keep your personal data? 

We will store your personal data for as long as is reasonably necessary for the purposes for which it was collected. Where your information is no longer needed, we will ensure that it is deleted or destroyed in a secure manner. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances we may need to store your personal data for longer periods of time, for instance where we are required to do so in accordance with legal or regulatory requirements. We retain such information for a period of 7 years.

In specific circumstances we may also store your personal data for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

Transferring your data outside of the UK

In order for us to provide the CF Product, your data may be transferred to our cloud-based service providers (e.g., Google) where they have servers outside the UK. Where we do need to transfer or process your personal data outside the UK, we will ensure that we do so in accordance with UK data protection law, including measures such as: (i) ensuring that your personal data is transferred to a country that offers adequate levels of protection for that data, or (ii) by using standard contractual clauses approved by the UK Information Commissioner’s Office (“ICO”). Our agreements with these service providers include appropriate measures to ensure that your personal data remains protected and secure when it is transferred outside the UK.

Your rights 

Under certain circumstances, you have rights under the UK GDPR in relation to your personal data. 

The rights that are relevant to our processing of personal data are:

  • Right of access: you have the right to obtain access to your personal data (including a copy of it) and information regarding how your personal data is being used.
  • Right to restriction of processing: you can restrict our processing of your personal data.
  • Right to rectification: you can ask us to rectify any inaccurate or incomplete information about you that we process.
  • Right to be forgotten: you can ask for the personal data we process about you to be erased from our records.
  • Right of portability: you have the right to have the personal data we process about you transferred to another organisation.
  • Right to object: you have the right to object to our processing of your personal data where we are relying on a legitimate interest in order to process it.
  • Right to withdraw your consent: you have the right to withdraw your consent (to the processing by us of your personal data) at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Where you request to access your privacy rights, we will aim to respond within one month. In certain circumstances it may take up to three months for us to action this request to exercise your legal rights, but we will let you know where this is the case. Please note that where you request to exercise your rights, we may need to ask you for ID to confirm your identity before we can action your request.

How can I exercise my privacy rights, or get information about how stem4 processes my personal data?

If you have any questions about this privacy notice, our privacy practices, or would like to exercise any of your privacy rights, please contact our Data Protection Lead at dpo@stem4.org.uk. 

You also have the right to lodge a complaint about our processing of your personal data with the ICO. The ICO can be contacted on the details provided below. However, we would appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Information Commissioner’s Office 

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

Website: www.ico.org.uk