Privacy notice

Who we are, and our role

Coding Pathway is operated by Coding Pathway Ltd, a company registered in England and Wales (company number 17313032); our registered office is given in our terms. We process personal data under the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025).

When the platform is used by a school, the school is the data controller for its students' and staff's data, and Coding Pathway is the data processor, acting on the school's instructions under a Data Processing Agreement. For people who use the free learner pathway independently, we act as controller for their account.

What we collect

• Account information for sign-in: name, email address, and sign-in provider.
• Role and access information: whether a user is a student, teacher, or admin.
• School, class, assignment, authored content, and learning progress data.
• Student work: code and text submissions, private copies of Worksheets started independently, and teacher feedback on school-set work.
• Operational records: service logs, error records, and key audit events.

We do not require special-category data, and we do not use the service for advertising or unrelated profiling.

Temporary teacher demos

To improve the demo, we record which demo pages and tour stages are explored, approximate active time, completed actions and technical issue counts against a random demo reference. Instance detail is available only to platform administrators and becomes eligible for deletion after 30 days. These observations contain no answers, code, prompts, names or email addresses. Aggregate counts are kept separately. We do not record your screen or keystrokes.

A teacher demo uses fictional classes and students. You can browse without an account. We process the work you enter to run your demo, and use a temporary access cookie to keep it separate from other visitors and your ordinary account. Do not enter real student details or confidential school data.

Using AI in the demo requires Google or Microsoft sign-in. The text you enter and relevant demo work may then be sent to OpenAI in the US to draft suggestions for you to review, including automatic draft marking where enabled. We retain a protected identifier derived from your verified sign-in account, with usage counts, to enforce demo allowances across repeat visits.

If you choose to set up your real school, normal sign-up opens separately. We count demo starts, visits to marking, AI use and school-setup clicks. With the sign-in you confirm for school setup, we use a separate protected reference to count whether a school is created within seven days of your first setup click. That reference becomes eligible for removal after seven days; we keep the counts, not your email, school identity or demo answers, in the conversion report. You can continue to school setup without demo attribution.

Ending a demo or reaching its time limit revokes access. Our cleanup process then erases its fictional school and demo work from the application. This does not erase your ordinary account, files you downloaded, backups or records held by the AI provider. Content-free start-attempt records become eligible for cleanup after 24 hours; allowance and security records remain separate from demo work. Contact us directly about privacy or rights requests relating to a demo.

Student iPad and iPhone app

The student app uses the same account and learning records as the website. We store a device-session record (device name, platform, app version and a random installation identifier) to manage sign-in and let an administrator sign out a device. Sign-in tokens are stored securely on the device; opened lessons and code drafts may be cached there and are cleared when you sign out. App updates are delivered through Expo's update service; student answers and marks are not sent to that service. App push notifications are not enabled in the initial live pilot.

Our lawful basis

• For school use, processing is carried out on the school's instructions; the school's lawful basis is typically public task or legitimate interests for delivering education.
• For independent learners, our basis is performance of a contract (providing the account you asked for) and legitimate interests in running and securing the service.

Where your data is processed

All stored personal data (accounts, learning records, student work and email) is hosted in the European Economic Area (AWS, Stockholm). UK-to-EEA transfers rely on the UK's adequacy regulations.

The only sub-processor to which we send personal data outside the UK/EEA is the optional AI provider (OpenAI, US), engaged under a signed agreement applying the UK Addendum to the EU Standard Contractual Clauses. A school can switch AI off entirely. Sign-in uses your school's or your own identity provider (Google or Microsoft), which verifies you and returns basic profile details to us. Payment processing (schools only, no student data) uses Stripe via its EU/UK entities. See our security overview and sub-processor list.

Artificial intelligence

There is no student-facing AI. AI is used only as a staff-facing aid for teachers (drafting and tidying content and feedback), and a teacher reviews every output before any student sees it.

When AI is used, what is sent to the provider is task content and the student's own work (code/text), and never names, emails, or account identifiers. The provider does not use the data to train its models.

Cookies

We use essential cookies only, for secure sign-in and access. We do not use advertising cookies, and we do not use cookies to track you across other websites. See the Cookies page.

How long we keep information

We keep personal data only as long as needed to deliver the service. For school-managed accounts, data is kept while the school relationship is active; on a school's offboarding we delete or return their data at the school's choice. A full retention schedule is available to schools on request.

Worksheets started independently are saved privately to the learner's account so they can return to their work. They are not added to a school's class progress or teacher review records.

Some operational records and backups may persist for a limited period after account changes or deletion.

Your rights

Under UK data protection law you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability. To exercise a right, contact privacy@codingpathway.co.uk. If you use the platform through a school, please contact your school first, as they are the controller; we will assist them in responding.

We respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

How we protect information

Encryption in transit and at rest, single sign-on (no stored passwords for SSO users), role-based access, audit logging, and browser-sandboxed code execution. More detail is on our security page.

Children and school users

Coding Pathway is built for education, including school-managed use by students. We follow data-minimisation and privacy-protective defaults in line with the ICO's Age Appropriate Design Code, and schools decide how the service is used with their learners.

Changes & contact

We may update this notice; material changes will be reflected here with a new date. Privacy questions and rights requests: privacy@codingpathway.co.uk. School and DPO enquiries: schools@codingpathway.co.uk.