Privacy Notice

• Account data — name, work email, school name, login credentials and role. Used to create and secure your account and to provide the service. Legal basis: performance of a contract.
• School records — student names, boarding house, year group, attendance and check-in/out events, location reports against school geofences, medication regimes and administration records, guardian contact details. Processed on the school's instructions to deliver safeguarding functionality.
• Support data — messages you send us. Used to answer your enquiries. Legal basis: legitimate interests.
• Technical data — IP address, device and browser information, and usage and error telemetry. Used for security, fraud prevention and product improvement. Legal basis: legitimate interests.

Health-related medication data is special category data. Schools must ensure they have an appropriate lawful basis and condition under applicable law before entering it.

• Service providers and subprocessors for hosting, database, email and error monitoring.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, payments, invoicing and tax compliance.
• Professional advisers such as legal and accounting providers.
• Authorities where we are required to do so by law.

We do not sell personal data or use it to train third-party models.

Data is hosted within the EEA where possible. Where personal data is transferred outside the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses together with appropriate technical safeguards.

Account data is kept while your subscription is active and for up to 12 months after it ends. School records are retained for the period the school configures, and are deleted or anonymised within 30 days of a deletion request or subscription termination, unless we must keep them to meet a legal obligation.

Subject to applicable law you may request access, rectification, erasure, restriction, portability, and object to processing, and withdraw consent where processing relies on it. We respond within one month. Under UK/EU GDPR you also have the right to complain to your supervisory authority.

To exercise a right, email support@campusbeacon.app. If your child is a student at a school using Campus Beacon, contact the school first — they control those records.

We apply appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls so each school can only reach its own records, role-based staff permissions, read-only guardian access and audit logging of welfare events.

We use strictly necessary cookies and local storage to keep you signed in and to secure the service. We do not use advertising cookies. Any analytics we use is limited to aggregate product usage and can be managed through your browser settings.