Next Gen Learning UK · for the headteacher, DPO and safeguarding lead

Data Protection Impact Assessment (DPIA) — summary & safeguarding

Written so a busy DPO can file it in ten minutes. Every statement describes the live product. Full policies: nextgenlearninguk.com/privacy-policy · /safeguarding · /terms

1. Who we are and what this is

Controller	Next Gen Learning UK Ltd · Company No. 17340185 · ICO Reg. ZC198966 · 32 Salisbury Street, London NW8 8QE
Service	Parent-paid home practice for Years 3–6: Verbal & Non-Verbal Reasoning, KS2 English and Maths, GL/CEM mock exams. Used at home, on the parent's device.
School's role	None. The school is not a controller or processor. No pupil data passes to or from the school. The school only signposts; families contract with us directly.

2. Accounts and identity

Who holds the account	The parent or carer. The parent registers with their own email; the child never needs an email address or password of their own.
Child identity	Children choose a game handle (e.g. StarComet42). Real names, photos, school name and date of birth are never requested. Year group only.
Parent controls	PIN-protected parent area; daily game-time limit (30/60/120 min — never applied to lessons or mocks); delete the child profile at any time.

3. What data we process and why

Parent	Email, name, payment via Stripe (we never see card numbers). Lawful basis: contract.
Child	Game handle, year group, answers, scores, time on task, streaks and rewards. Lawful basis: parental consent + contract with the parent (UK GDPR Art. 6(1)(b), Art. 8).
Not collected	No location, no contacts, no camera/microphone, no behavioural advertising identifiers, no data from the school.

4. AI — exactly what the model sees

Purpose	Builds and adjusts each child's learning plan (which module next) and generates practice questions and explanations.
Data sent to the model	Anonymous performance data only: year group, module scores, right/wrong patterns. Never the child's handle, the parent's name or email, or any free text a child types about themselves.
Contact with children	No child-to-child messaging, no public profiles, no human contact from us with any child. An in-lesson AI helper answers questions about the lesson content only.

5. Hosting, sharing, retention

Hosting	UK/EU-hosted managed cloud platform; encrypted in transit (TLS) and at rest. Sub-processors: hosting provider, Stripe (payments), AI model providers (anonymous performance data only).
Sharing	We never sell, rent or share data with advertisers. Ad-free. Aggregated, anonymous statistics only (e.g. 'Year 5 average in module 7').
Retention & deletion	Kept while the account is active. On cancellation or request, the child profile and all learning data are deleted within 30 days. Parents can delete a child profile themselves at any time.

6. Children's code and safeguarding

Age Appropriate Design Code	High-privacy defaults, no nudges to share data, no profiling for marketing, transparent language for parents. Data minimisation throughout.
Safeguarding lead	Designated Safeguarding Lead, Next Gen Learning UK Ltd · hello@nextgenlearninguk.com. Any concern is acknowledged within 1 working day. Contact with families is by parent email only.
Your rights	Access, rectification, erasure and portability requests: hello@nextgenlearninguk.com. Complaints: ico.org.uk.

✓ No pupil data reaches the school✓ Parent-held accounts only✓ Game handles, never real names✓ No chat, no ads, no data sold✓ Deletion within 30 days on request

BESA Launchpad Member

PTA+ Supplier Partner

Listed on PTA.co.uk

Questions, or a full DPIA walk-through: hello@nextgenlearninguk.com

Next Gen Learning UK Ltd · Company No. 17340185 · ICO Registration ZC198966 · 32 Salisbury Street, London NW8 8QE · nextgenlearninguk.com