Privacy Policy — Politics Online
Last updated: 27 July 2026
This Privacy Policy explains how Politics Online Limited (“we”, “us”, “our”) collects, uses, discloses and protects your personal data on Politics Online (“the Platform”) — our website, shop, revision resources, and interactive lessons with quizzes and progress tracking. You reach the Platform at politicsonline.co.uk; the interactive lessons are hosted for us by Vercel and currently load from the address learning-design.vercel.app, which is moving to learn.politicsonline.co.uk. It is all one platform, run by one company — and this one policy covers all of it.
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the ICO’s Age Appropriate Design Code (Children’s Code).
1. Who we are
Politics Online Limited is a company registered in England and Wales (company number 15985148).
Registered office: 3rd Floor, 86–90 Paul Street, London, England, EC2A 4NE.
ICO registration number: ZB870204.
Contact for all data protection matters: admin@politicsonline.co.uk.
We are not required to appoint a Data Protection Officer under Article 37 UK GDPR, as we are not a public authority and our core activities do not involve large-scale monitoring of individuals.
2. Controller and processor — who is responsible for your data
Who is legally responsible for your data depends on how you use the Platform, not on which page you are on:
| Activity | Our role | Who decides why data is processed |
|---|---|---|
| Visiting the Platform, creating an individual account, buying a subscription, receiving our newsletter | Data controller | Politics Online Limited |
| Learning data (lessons, quizzes, progress) on accounts provided under a school or college licence | Data processor | Your school or college (the data controller), under a written Data Processing Agreement with us (Article 28 UK GDPR) |
| Learning data on accounts with an Individual Subscription | Data controller | Politics Online Limited |
Where we act as processor, we process personal data only on the documented instructions of the school. The school is responsible for its own lawful basis (typically Article 6(1)(b) — contract, or Article 6(1)(f) — legitimate interests), for authorising student access, and for making students and parents aware of this policy.
3. Who this policy applies to
- Visitors to the Platform.
- Individual subscribers aged 16 and over — including students whose subscription includes the Platform’s lessons.
- Students aged 16–18 using the Platform through a school or college licence.
- Teachers and staff at schools/colleges administering licences and classes.
Important: users under 16 must not register directly. Access for under-16s may only be arranged by a parent, guardian, or an educational institution that has secured appropriate parental consent; responsibility for valid consent rests with them. If we become aware of an unauthorised under-16 account, we will delete it promptly.
4. What data we collect
Account, shop and browsing data
- Identity & account data — full name, email address, school or institution (if applicable).
- Payment data — processed by Stripe and PayPal; we never store or process full card details.
- Technical & usage data — IP address and approximate (country/city) location, browser and device type, login activity, pages viewed.
- Cookie data — see section 7.
- Feedback and enquiries — anything you send via our forms or email.
Learning data (lessons, quizzes and progress)
In the lessons, we collect only what we need to make them work:
- Your first name and last initial (so your teacher can identify you — we deliberately do not store students’ full surnames)
- Your school and year group (school-provisioned accounts)
- The sign-in email/username provided by your school, or the email you registered with if you purchased an Individual Subscription
- A password, where your account signs in directly on the lesson pages — stored only as a secure one-way hash, never in readable form
- Your learning progress (topics completed, scores, attempts)
- Confidence ratings you choose to give on topics
- Session data (when you logged in and for how long)
- Quiz responses (which questions you answered and whether you got them right)
Beyond your sign-in email, the lessons do not collect your date of birth, home address, phone number, photos, or location.
We do not collect or request special category data (e.g. political opinions or health data) anywhere on the Platform. Please do not submit such information.
5. Why we collect it, and our lawful bases
We use students’ learning data to:
- Track your learning progress and help you improve
- Let your teacher see how the class is doing (school-provisioned accounts)
- Schedule spaced-repetition reviews at the right time
- Adapt question difficulty to your level
- Remind you to take breaks (we care about your wellbeing)
| Purpose | Lawful basis |
|---|---|
| Account creation and subscription management | Contract (Art 6(1)(b)) |
| Delivering educational services and content | Contract (Art 6(1)(b)) |
| Student learning data (school licences) | Determined by the school as controller — typically contract or legitimate interests; we act as processor |
| Student learning data (Individual Subscriptions) | Contract (Art 6(1)(b)) — we act as controller |
| Processing payments via Stripe/PayPal | Contract (Art 6(1)(b)) |
| Essential service communications | Contract (Art 6(1)(b)) |
| Security, fraud prevention and misuse monitoring (including rate limiting) | Legitimate interests (Art 6(1)(f)) |
| Compliance with tax and legal obligations | Legal obligation (Art 6(1)(c)) |
| Marketing communications (newsletter) | Consent (Art 6(1)(a)) |
We do not sell or rent personal data to anyone.
6. How we personalise learning (profiling explained in plain English)
The Platform’s lessons use algorithms to adapt each student’s experience:
- Spaced repetition: after you complete a topic, we schedule reviews at increasing intervals (1, 3, 7, 18 and 35 days) based on how well you scored, to help you remember long-term.
- Mastery tracking: we calculate a mastery score per topic from your quiz scores and attempts; topics are “mastered” at the threshold (usually 80%).
- Difficulty tagging: questions are tagged by difficulty level to support personalisation of question selection as this feature develops.
- Peer comparison: if your class has enough students, we show anonymised class statistics. This feature is off by default; only class-level averages and anonymised distributions are shown, and only when a class has at least 5 students, in line with ICO statistical-disclosure guidance. No individual student’s data is ever visible to another student.
These algorithms exist solely to support learning. They are never used for decisions outside the Platform, never for advertising or commercial profiling, and teachers cannot use them to set grades.
7. Cookies
This information is also published as a standalone Cookie Policy. Different parts of the Platform use different cookies:
Browsing, shop and articles
| Cookie type | Purpose | Consent required |
|---|---|---|
| Essential | Login, authentication, shopping cart (WooCommerce), fraud prevention, and storing your cookie-consent choices (Usercentrics) | No |
| Analytics — Google Analytics | Usage analysis and optimisation. Runs in Google Consent Mode: all analytics storage is off by default and is only enabled if you accept via the consent banner | Yes |
| Advertising — Google AdSense | Serves advertising on public website pages (never in the lessons). Runs in Google Consent Mode: ad storage and personalisation are off by default and only enabled if you accept via the consent banner | Yes |
| Marketing — Brevo | Links your visits to our newsletter so we can understand what subscribers find useful | Yes |
| Push notifications — WonderPush | Web push notifications, only if you opt in to receive them | Yes |
| Analytics — Koko (self-hosted) | Counts page views on our own server — nothing is shared with any third party. One first-party cookie (page IDs viewed that day, no personal data) prevents double-counting; expires at midnight | No — anonymous and first-party |
| Shop attribution (WooCommerce) | First-party cookies recording how you arrived at the site, attached to an order if you place one | First-party; blockable in your browser |
Cookie consent is managed by the Usercentrics consent banner shown on your first visit. Non-essential cookies are only set with your consent, which you can change or withdraw at any time via the banner’s privacy settings or your browser.
Inside the lessons
The lesson pages use only strictly necessary cookies — no analytics, advertising, or tracking cookies — so no cookie banner appears there under PECR:
| Cookie | What it does | Lifetime |
|---|---|---|
| pol-session | Your digitally signed login session (it cannot be forged or altered). HttpOnly (cannot be read by JavaScript), Secure (HTTPS only), SameSite=Strict. | 24 hours |
| pol-prefs | A copy of your display and accessibility preferences (theme, font size, dyslexia-friendly font, reduced motion) so pages load with your settings straight away. HttpOnly, Secure. | 30 days |
| pol-password-change | Set only while you set a new password — on first login or after a password reset — to authorise that single step. | Up to 15 minutes (single use) |
| pol-session-original | Set only during a supervised support-access session (see section 11), preserving the support administrator’s own identity so the access is fully logged. | Duration of the supervised session (max 15 minutes) |
The lesson pages also use your browser’s local storage (a “similar technology” under PECR) for strictly necessary purposes only: remembering your position in a lesson, your audio-playback speed, your display preferences, a short-lived offline buffer of quiz progress so nothing is lost if your connection drops, and small flags such as whether you have seen the welcome tour or dismissed a notification. None of this is tracking; it stays on your device and is removed when you clear your browser’s site data.
8. How login works across the Platform
You sign in once at politicsonline.co.uk. When you open your lessons, the Platform passes a secure, single-use token to the lesson pages containing only: your user ID (a number), your role, your school ID (if any), your class code (students), the date your access began (direct subscribers only), and your first name and last initial — never your email, surname, or password. The token can be used once, expires within about ten minutes, and is verified cryptographically before it becomes your session cookie. That session expires after 24 hours (4 hours for direct subscribers). Learning records stay on the lesson platform and are never sent back to the main site. A small number of administrator and setup accounts sign in directly with a password (stored only as a secure one-way hash); this route is being phased out for students.
9. Our service providers (sub-processors)
We use the following providers to run the Platform. Each acts under our instruction and a data processing agreement:
| Provider | What it does | Where data is processed |
|---|---|---|
| Krystal Hosting | Hosting for the Platform’s website and shop (WordPress) | United Kingdom |
| WordPress / WooCommerce | Website and shop software | United Kingdom (self-hosted on Krystal) |
| Stripe | Card payments (PCI-DSS compliant) | UK/EU; international transfers covered by Stripe’s safeguards (SCCs/IDTA) |
| PayPal | Payments (PCI-DSS compliant) | UK/EU; international transfers covered by PayPal’s safeguards |
| Supabase Inc | Database for the Platform’s lessons (learning records, learner accounts) | AWS eu-west-2 (London, UK) |
| Amazon Web Services (AWS) | Underlying infrastructure for Supabase | eu-west-2 (London, UK) |
| Vercel Inc | Web hosting and edge compute for the lesson pages. Processes HTTP requests (including session cookies) at edge locations; no persistent storage of personal data | EU/UK edge; DPA with Standard Contractual Clauses for any non-UK processing |
| Upstash Inc | Rate limiting for the lessons’ API (abuse prevention). Processes hashed identifiers and IP-derived keys for the duration of the rate-limit window only; nothing stored beyond it | AWS eu-west-2 (London, UK) |
| Vimeo Inc | Streams the lesson videos. When you play a video, your IP address is sent to Vimeo. We embed all videos with Do-Not-Track enabled (dnt=1), which disables Vimeo’s tracking and analytics cookies | USA; transfers covered by Vimeo’s SCCs/IDTA safeguards |
| Brevo (formerly Sendinblue) | Sending our newsletter to subscribers who opted in, and — with your consent via the banner — linking your website visits to your newsletter subscription so we can understand what subscribers find useful | European Union (Brevo is EU-based; UK adequacy applies) |
| Google (Google Analytics) | Consent-gated usage analytics on the Platform’s browsing and shop pages only — runs in Consent Mode, disabled until you accept the banner. Never used inside the lessons | Google Ireland / USA; transfers covered by Google’s SCCs and the UK-US Data Bridge |
| Google (AdSense) | Serves advertising on public website pages only — never in the lessons and never to student accounts. Runs in Consent Mode: ad storage and personalisation are disabled until you accept the banner | Google Ireland / USA; transfers covered by Google’s SCCs and the UK-US Data Bridge |
| WonderPush | Web push notifications on the website, only for visitors who expressly opt in to receive them | European Union |
| Usercentrics | The cookie-consent banner; stores your consent choices | European Union |
No student personal data is shared with any other third party, used for advertising, or used to train AI models. The lessons use no analytics, advertising networks, or social-media tracking of any kind, and show no advertising. Elsewhere on the Platform, analytics (Google Analytics), advertising (Google AdSense on public pages), marketing (Brevo) and push notifications (WonderPush) operate only with your consent via the banner; our own self-hosted page-view counter (Koko Analytics) runs on our server and shares nothing with anyone. There are no social-media pixels anywhere. We do not sell or share your data.
10. Who can see a student’s data
- You can see all your own data.
- Your teacher can see your progress — but only if you are in their class.
- Other students cannot see your individual data.
- No one outside your school can see your data.
- Individual Subscription accounts are not linked to any school — your data is visible only to you.
- Platform support staff — see section 11.
11. Supervised support access
Platform support staff may access an account in a supervised session for technical support. All such access is logged, visible in the audit trail, and automatically time-limited to 15 minutes.
12. How long we keep your data
| Data | Retention |
|---|---|
| Individual subscriber accounts (including any learning data) | Deleted after 2 years of inactivity, or within 30 days of your deletion request — whichever comes sooner |
| School/centre licence data | Duration of licence; on expiry, student data is exported to the school within 30 days and then permanently deleted. Teachers are notified before deletion. |
| Student learner accounts (inactive) | Name removed and account deactivated after 2 years of inactivity; all remaining data, including identifiers, permanently deleted within 30 days thereafter |
| Deletion requests | Personal data removed within 30 days of a verified request; anonymised learning statistics may be retained for platform improvement |
| Lesson session logs | 90 days, then automatically deleted |
| Audit logs | 2 years, then automatically deleted |
| Payment records | 6 years (UK tax and financial law) |
| Aggregate analytics (non-identifiable) | Up to 24 months |
Data may be retained longer only where the law requires it (e.g. dispute resolution or fraud prevention).
13. Data security
- All data encrypted in transit (HTTPS/TLS) and at rest.
- Row-level security on the learning database — each user can only access their own data; teachers only their own classes.
- IP addresses used for security logging are hashed before storage and cannot be reversed.
- Access controls and audit logging of significant actions (logins, exports, administrative access).
- UK-based encrypted servers and encrypted backups.
- PCI-DSS compliant payment gateways (Stripe, PayPal) — we never see full card numbers.
14. Children’s data, the Children’s Code, and safeguarding
The Platform’s lessons are designed for students aged 16–18 in England and Wales. Access is provided through your school, which verifies your age at enrolment, or through an Individual Subscription (available only to users aged 16 or over, with parental consent required for under-18 purchases); we do not knowingly collect data from anyone under 16. The Platform complies with the ICO’s Age Appropriate Design Code. In every decision about data, we treat the best interests of student users as a primary consideration:
- We collect only what is needed to deliver the educational service (data minimisation by design — e.g. last initial instead of surname).
- Privacy-protective settings are the default — e.g. peer comparison is off by default.
- We never use student data for advertising or commercial profiling.
- Personalisation algorithms are explained in plain English (section 6) and used solely to support learning.
- Wellbeing by design: after 45 minutes in the lessons, students are reminded to take a break.
Safeguarding (KCSIE): the Platform supports the principles of Keeping Children Safe in Education. Teacher-to-student messaging (“nudges”) is limited to educational prompts — homework reminders, encouragement, review prompts. Students cannot message each other, and all nudge messages are auditable by the school. If you have a safeguarding concern about a student’s use of the Platform, contact your school’s Designated Safeguarding Lead (DSL) directly — do not use the Platform’s messaging for safeguarding communications. To report a safeguarding concern about the Platform itself, email admin@politicsonline.co.uk.
15. Parents and guardians
If a student is under 18, their parent or guardian has the same data rights as the student — to see, correct, delete, or object to the processing of the student’s data. Parents should contact the school in the first instance (school-provisioned accounts), or email us directly at admin@politicsonline.co.uk; we will verify the relationship (with the school where applicable) before acting on any request.
16. International data transfers
Personal data is stored primarily in the UK. Where a provider processes data outside the UK/EEA (see section 9), we ensure a UK adequacy decision applies, or Standard Contractual Clauses / the UK International Data Transfer Addendum are in place, or the transfer is otherwise permitted by UK GDPR. Users outside the UK/EEA acknowledge that their data is processed under UK law.
17. Your rights under UK GDPR
- Access the personal data we hold about you (Subject Access Request).
- Correct inaccurate or incomplete data.
- Erasure, where no lawful basis for retention applies.
- Restrict or object to processing (including any based on legitimate interests — Article 21).
- Data portability — students can download their own data directly from the Platform.
- Withdraw consent where processing is based on consent.
To exercise any right, email admin@politicsonline.co.uk — students can also simply ask their teacher, and teachers can delete a student’s account directly from their dashboard. Requests are free and answered within one calendar month. For learning data on school-provisioned accounts, your school is the data controller, so we may pass the request to the school and help them fulfil it; for Individual Subscription accounts we are the controller and handle the request directly.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.
18. Data breach notification
If we discover a personal data breach we will notify the ICO within 72 hours where required by UK GDPR, and — where the breach is likely to result in a high risk to your rights and freedoms — notify you (and, for school-provisioned accounts, your school) directly and without undue delay. We maintain an internal breach register and documented breach procedures.
19. Data Protection Impact Assessment
We have carried out a DPIA covering the Platform’s processing of children’s data, its personalisation algorithms, and the peer-comparison feature. It is reviewed annually and on any significant change. A summary is available on request.
20. Use of AI tools in content development
We use AI-assisted tools to create and refine educational resources. All AI-assisted content is reviewed by subject experts before publication. No personal data — and no student data of any kind — is input into or used to train AI systems. AI tools are used solely for content development, never for profiling users.
21. Business transfers and legal disclosure
We may disclose data to comply with legal obligations or valid court orders, or transfer it as part of a merger, acquisition or restructuring — in which case this policy would continue to apply to that data.
22. External links
The Platform may link to third-party sites. We are not responsible for their privacy practices — please review their policies.
23. Communications and marketing
Service communications (account confirmations, billing, policy updates) are necessary and not subject to opt-out. Marketing communications (e.g. our newsletter) are sent only with your prior consent, which you can withdraw at any time via the unsubscribe link or by contacting us. We never send marketing to student accounts.
24. Changes to this policy
We may update this policy periodically. Significant changes will be notified by email and on the Platform, and — for school-licensed processing — to subscribing schools.
25. Contact us
Politics Online Limited
3rd Floor, 86–90 Paul Street
London, EC2A 4NE, United Kingdom
Email: admin@politicsonline.co.uk
Company number: 15985148 | ICO registration: ZB870204