Legal
How PrepPath collects, uses and protects personal information.
Effective date: 8 September 2026 | Version: Draft 1.0
PrepPath is an online learning service for parents and guardians supporting a child preparing for the Schools’ Entrance Assessment Group (SEAG) assessment in Northern Ireland.
JV Media, trading as PrepPath, is the data controller. Contact: hello@preppath.co.uk.
This notice covers adults who visit the website, create or manage an account, buy access, contact us, or supervise a learner. It also covers learner activity recorded under a parent-controlled account. We do not intend children to create accounts, make purchases or contact us directly.
| Category | Examples |
|---|---|
| Account information | Parent or guardian name, email address, account settings and password hash. We do not store your readable password. |
| Purchase records | Product, price, date, payment status, refunds and payment-provider reference. Full card details should be handled by the payment provider, not PrepPath. |
| Learning activity | Answers, scores, progress, timestamps and practice history associated with the parent-controlled account. |
| AI tutor content | Questions or prompts entered into the tutor and its responses. Do not include names, health information, school details or other sensitive information. |
| Technical and security data | IP address, browser/device information, session identifier, error and security logs. |
| Messages | Support requests, feedback and other communications sent to us. |
| Purpose | UK GDPR basis |
|---|---|
| Provide the account, learning service, purchases and support | Contract: necessary to perform our contract with the adult account holder or take requested steps before a contract. |
| Keep the service secure; prevent misuse and fraud; diagnose faults | Legitimate interests: protecting PrepPath, its users and the reliability of the service. |
| Improve content and usability using minimised or aggregated information | Legitimate interests, balanced against user privacy. We will seek consent where the law requires it. |
| Keep accounting, tax and legal records; respond to lawful requests | Legal obligation and, where relevant, legitimate interests in establishing or defending legal claims. |
| Send optional marketing | Consent. You can withdraw consent at any time. |
| Use non-essential analytics or marketing cookies | Consent. These will remain off until you choose to allow them. |
The account holder must be at least 18. We do not ask for a child’s name, date of birth, school, postal address, email address or telephone number. Learning activity may nevertheless relate to a child, so the adult account holder must supervise use and should avoid entering information that identifies the child.
If we learn that a child has provided personal contact details or other information we do not need, we will take reasonable steps to remove it. A parent or guardian can contact us about access, correction or deletion.
Tutor prompts are sent to our AI service provider to generate a response. The tutor provides educational assistance only and can make mistakes. Do not enter names, contact details, health information, school information, passwords or other confidential information. We do not use tutor responses to make decisions with legal or similarly significant effects about a learner.
We disclose only what is reasonably necessary to service providers acting for us, and where required by law. Categories may include:
[INSERT ACTUAL PROVIDERS, HOSTING LOCATIONS AND LINKS TO THEIR PRIVACY INFORMATION.]
Some providers may process information outside the United Kingdom. Where this happens, we will use a lawful transfer mechanism and appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement/addendum, and assess relevant risks.
[CONFIRM WHICH PROVIDERS TRANSFER DATA ABROAD AND THE SAFEGUARDS USED.]
We keep information only for as long as necessary for the purposes described above, including security, dispute resolution, tax and accounting obligations. We then delete or anonymise it safely.
| Record | Proposed period — confirm before publication |
|---|---|
| Account and learner activity | While the account is active, then [12 MONTHS] after access ends, unless needed for a dispute or legal obligation. |
| Tutor prompts and responses | [30/90 DAYS OR OTHER CONFIGURED PERIOD]. |
| Support messages | [24 MONTHS] after the issue is closed. |
| Transaction and accounting records | For the applicable statutory accounting/tax period. |
| Security logs and session records | [30/90 DAYS], unless a security investigation requires longer. |
We use proportionate technical and organisational safeguards, including password hashing, encrypted connections, access controls, security monitoring and restricted provider access. No online system is completely secure. If a personal-data breach creates a risk, we will assess it and make notifications required by law.
Depending on the circumstances, you may have rights to be informed, access personal data, correct inaccurate data, erase data, restrict or object to processing, receive portable data, and withdraw consent. These rights can be limited by law. Contact hello@preppath.co.uk. We may need to verify your identity.
You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or telephone 0303 123 1113. We would appreciate the opportunity to address your concern first.
We may update this notice when our service or legal obligations change. We will post the new version with its effective date and give a more prominent notice where a change materially affects you.