Privacy and Cookie Policy

Last updated: February 2026

1. Introduction: Data Controller

We at Kloodle Limited take privacy and data protection seriously. We are fully committed to respecting and protecting your personal information as this Privacy and Cookie Policy (“Policy”) will outline.

If you have any questions after reading this Policy, please contact us at privacy@kloodle.com.

This Policy applies to Kloodle, a trading name of Kloodle Limited, a company registered in England and Wales under registration number 08497166 with its registered address at 100 Barbirolli Square, Manchester, United. We may refer to Kloodle as “we”, “us” or “our”.

This Policy also applies to the storing and processing of personal data by schools that are our direct customers. Please see our Children’s Privacy Statement for information about the use of our services by children.

In accordance with Article 13 and 14 UK GDPR and the Data Protection Act 2018, we inform our visitors and subscribers (“User(s),” “you,” or “your”) about our privacy and data protection policies.

2. Categories of Personal Data We Process

Standard Personal Data:

• Names and contact details (email addresses)
• Educational institution and year group
• Skills, achievements, and qualifications
• Work experience records
• Reflective journal entries and self-assessments
• Activity participation records
• Account credentials (securely encrypted)
• Technical data (IP addresses, device information, usage logs)

Special Category Data:

Where schools choose to record such information on student profiles, we may process:

• Health-related information
• Special Educational Needs and Disabilities (SEND) information

Processing of special category data requires explicit consent or is necessary for reasons of substantial public interest in connection with education.

3. How We Use Your Personal Data

Your personal data is used for the following purposes:

• To build an online record of achievement and reflective journal for students
• To identify the school or college a user belongs to
• To communicate information about our system to users
• To enable schools and colleges to capture student information such as work experience, education history, and activity participation
• To provide AI-powered features for skills analysis and personalised feedback
• To improve our services and provide technical support

4. Hosting and Data Location

Primary Data Storage:

Your personal data is primarily stored on servers operated by Hetzner Online GmbH, located in Germany within the European Union.

International Transfers:

For AI-powered features, limited personal data may be processed by our sub-processors in the United States. These transfers are protected by the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), which ensures an adequate level of protection for your data.

5. Third-Party Processors (Sub-processors)

Kloodle uses the following third-party processors to operate our services:

All third-party processors are bound by contractual agreements to protect your personal data and process it only as instructed by us.

6. Information Security

We implement appropriate technical and organisational measures to protect your personal data:

Encryption:

• All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Passwords are securely hashed and never stored in plain text

Access Controls:

• Role-based access ensures only authorised personnel can access your data
• Student profiles are private and not publicly accessible
• Multi-factor authentication is available for administrative accounts

Backup and Recovery:

• Regular automated backups ensure data can be recovered in case of system failure

Staff Training:

• All staff with access to personal data receive regular data protection training

7. Data Retention and Deletion

Personal data is retained for the duration of our service agreement with your school or college.

End of Contract:

Upon termination of a service agreement, schools may request:

• Export of all data in a machine-readable format
• Secure deletion of all data, with written confirmation

Deletion requests are processed within 30 days. Backup copies are deleted within 90 days in accordance with our backup rotation schedule.

8. Your Rights

Under UK GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Erasure: Request deletion of your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing of your data
• Complaint: Lodge a complaint with the ICO

To exercise any of these rights, contact us at privacy@kloodle.com.

9. Children and Privacy

Our services are directed to children in educational settings. We take additional precautions to protect children’s privacy:

• We do not collect personal data from children under 13 without parental/guardian consent
• Parents and guardians can request access to, correction of, or deletion of their child’s data
• Student profiles are private and not accessible to external parties

Please see our Children’s Privacy Statement for full details.

10. Use of Cookies

We use cookies to improve your experience on our website. Cookies are small files stored on your device that help us:

• Remember your preferences
• Understand how you use our platform
• Improve our services

You can control cookie settings in your browser. Disabling cookies may affect some functionality.

11. Changes to This Policy

We may update this Policy from time to time. Changes will be posted on our website with an updated revision date. Continued use of our services after changes constitutes acceptance of the updated Policy.

12. Contact Us

For any questions about this Policy or your personal data:

Kloodle Limited
Email: privacy@kloodle.com
Address: 100 Barbirolli Square, Manchester, United