Privacy Policy

Version 2026-10-placeholder · Last updated [date]

Placeholder. This is generic placeholder text, not legal advice. It must be replaced with wording approved by a solicitor before Free To Fly is offered to the public. Items in [square brackets] need filling in.

1. Who we are

Free To Fly is provided by [company name] ("we", "us"), [address]. You can contact us about privacy at [privacy contact email].

2. Whose information this covers

People who request access through our online form.
Staff users of schools and organisations that use Free To Fly.
Children and young people whose information schools record in Free To Fly. For this information the school is the data controller and we act as its data processor.

3. What we collect

Access requests: name, email address, school or organisation, role, and a record of what you agreed to and when.
Staff accounts: name, email address, school, role and access level, and login and security records.
Information schools enter about children, such as assessments and plans. [List categories, including any special category data.]

4. Why we use it and our lawful basis

To deal with your request for access and to set up and run a trial: [lawful basis, e.g. legitimate interests / steps before a contract].
To provide the Service to schools under our contract with them: [lawful basis].
To keep the Service secure, including login verification codes: [lawful basis].

5. Who we share it with

We use carefully chosen suppliers to run the Service, including hosting and email delivery providers. [List suppliers and where they process data.]

[International transfers: describe any processing outside the UK, for example by an email delivery provider, and the safeguards in place.]

6. How long we keep it

Access requests that are never confirmed are deleted after 7 days; declined requests 30 days after the decision.
Demo schools, and all information and accounts in them, are deleted after the trial and read-only period ends.
[Retention for customer schools' data - to be completed.]

7. Your rights

You have rights to access, correct and delete your personal information, to object to or restrict how we use it, and to data portability. Requests about children's information should usually go to the child's school. You can also complain to the Information Commissioner's Office (ico.org.uk).

8. Changes

We may update this policy. If we make significant changes we will ask users to read the new version.