Privacy notice

Who we are, and our role

Coding Pathway is operated by Coding Pathway Ltd, a company registered in England and Wales (company number 17313032); our registered office is given in our terms. We process personal data under the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025).

When the platform is used by a school, the school is the data controller for its pupils' and staff's data, and Coding Pathway is the data processor, acting on the school's instructions under a Data Processing Agreement. For people who use the free learner pathway independently, we act as controller for their account.

What we collect

• Account information for sign-in: name, email address, and sign-in provider.
• Role and access information: whether a user is a student, teacher, or admin.
• School, class, assignment, authored content, and learning progress data.
• Student work: code and text submissions, and teacher feedback on it.
• Operational records: service logs, error records, and key audit events.

We do not require special-category data, and we do not use the service for advertising or unrelated profiling.

Our lawful basis

• For school use, processing is carried out on the school's instructions; the school's lawful basis is typically public task or legitimate interests for delivering education.
• For independent learners, our basis is performance of a contract (providing the account you asked for) and legitimate interests in running and securing the service.

Where your data is processed

All stored personal data — accounts, learning records, student work and email — is hosted in the European Economic Area (AWS, Stockholm). UK-to-EEA transfers rely on the UK's adequacy regulations.

The only sub-processor to which we send personal data outside the UK/EEA is the optional AI provider (OpenAI, US), engaged under a signed agreement applying the UK Addendum to the EU Standard Contractual Clauses. A school can switch AI off entirely. Sign-in uses your school's or your own identity provider (Google or Microsoft), which verifies you and returns basic profile details to us. Payment processing (schools only — no student data) uses Stripe via its EU/UK entities. See our security overview and sub-processor list.

Artificial intelligence

There is no student-facing AI. AI is used only as a staff-facing aid for teachers (drafting and tidying content and feedback), and a teacher reviews every output before any student sees it.

When AI is used, what is sent to the provider is task content and the student's own work (code/text) — never names, emails, or account identifiers. The provider does not use the data to train its models.

Cookies

We use essential cookies only — for secure sign-in and access. We do not use advertising cookies, and we do not use cookies to track you across other websites. See the Cookies page.

How long we keep information

We keep personal data only as long as needed to deliver the service. For school-managed accounts, data is kept while the school relationship is active; on a school's offboarding we delete or return their data at the school's choice. A full retention schedule is available to schools on request.

Some operational records and backups may persist for a limited period after account changes or deletion.

Your rights

Under UK data protection law you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability. To exercise a right, contact privacy@codingpathway.co.uk. If you use the platform through a school, please contact your school first, as they are the controller; we will assist them in responding.

We respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

How we protect information

Encryption in transit and at rest, single sign-on (no stored passwords for SSO users), role-based access, audit logging, and browser-sandboxed code execution. More detail is on our security page.

Children and school users

Coding Pathway is built for education, including school-managed use by pupils. We follow data-minimisation and privacy-protective defaults in line with the ICO's Age Appropriate Design Code, and schools decide how the service is used with their learners.

Changes & contact

We may update this notice; material changes will be reflected here with a new date. Privacy questions and rights requests: privacy@codingpathway.co.uk. School and DPO enquiries: schools@codingpathway.co.uk.