hello@ediway.co.uk

hello@ediway.co.uk

Privacy Policy

Last updated: 27 June 2026

This Privacy Policy explains how EdiWay collects, uses, stores, shares, and protects personal data through our website, school platform, home education tools, marketplace features, careers features, support services, and related digital services.

This draft must be reviewed and completed with your final company, hosting, and operational details before publication. Replace the placeholders in square brackets before use.

1. Who We Are

EdiWay is operated by EdiWay School Management.

You can contact us at hello@ediway.co.uk.

If you have appointed a Data Protection Officer or privacy lead, their contact details are: privacy@ediway.co.uk.

2. Scope of This Policy

This Privacy Policy applies to:

  • visitors to www.ediway.co.uk;
  • school owners, principals, teachers, staff, and professionals using the platform;
  • parents, carers, and invited family members;
  • students and home-educated learners;
  • marketplace users, including school-store customers;
  • careers users, applicants, and HR-related users;
  • support ticket users, enquiry submitters, and messaging users.

3. Important Position on School and Child Data

Depending on the service and workflow, EdiWay may act as a controller, joint controller, or processor of personal data. In many school-facing workflows, the relevant school may decide why and how learner data is used, while EdiWay provides the technology and operational platform.

You should complete this section with the final legal position for:

  • public website enquiries;
  • school customer accounts;
  • home education parent-managed records;
  • invited professional access;
  • school-store orders and payments;
  • Careers and HR data.

4. The Personal Data We Collect

Depending on how the platform is used, we may collect and process the following categories of personal data:

  • identity data, such as names, usernames, job titles, and account roles;
  • contact data, such as email addresses, phone numbers, and postal addresses;
  • school and organisational data, such as school name, linked school records, classes, departments, and employment relationships;
  • student and learner data, such as names, dates of birth, year groups, class information, attendance, timetable information, learning records, and academic records;
  • family and relationship data, such as parent links, guardian links, parental responsibility data, invited co-parent or professional relationships, and access permissions;
  • SEN, SEND, SEN-L, support, and intervention data;
  • health and medical data, such as allergies, medications, immunisation information, incidents, and appointment-related records, where the service is used for these purposes;
  • safeguarding, wellbeing, behaviour, bullying, welfare, and child protection-related records;
  • home education data, such as learning records, review notes, evidence uploads, pathway planning, EHCP evidence, and HLE or neuro-affirming records, where used;
  • message content, support tickets, notes, attachments, and uploaded documents;
  • resource, homework, and assessment responses, including digital notes, essay responses, evidence uploads, and reference texts;
  • payment, order, invoice, wallet, and transaction records;
  • careers and HR data, such as applicant records, qualifications, references, interviews, onboarding, leave, payroll-related records, and staff documents;
  • technical and usage data, such as log data, device/browser information, security records, access events, and service analytics, where enabled;
  • AI usage data and AI-submitted content where users access AI-supported features.

5. Special Category and High-Risk Data

Some platform areas may involve special categories or otherwise highly sensitive data, including:

  • Children’s personal data;
  • Health and medical information;
  • SEN, SEND, EHCP, and support-related information;
  • Safeguarding and welfare information;
  • mental health, behaviour, and wellbeing information;
  • Documents uploaded by schools, parents, professionals, or applicants that contain sensitive information.

We expect these categories to be processed only where there is a valid legal basis and, where required, an additional condition for special category processing.

6. How We Collect Personal Data

We collect personal data:

  • directly from users when they register, fill out forms, send enquiries, open tickets, upload files, or use dashboards;
  • from schools and authorised school users who create or manage records;
  • from parents and carers who create, manage, or share learner records;
  • through invitations and access workflows involving family members and professionals;
  • through transactions, subscriptions, and store purchases;
  • through system logs, security tools, cookies, and similar technologies;
  • Through AI-supported form or document features when these are used.

7. Why We Use Personal Data

We use personal data to:

  • operate the website and platform;
  • create and manage school, staff, parent, student, professional, and applicant accounts;
  • support school management, home education, family collaboration, and learner oversight;
  • manage attendance, timetables, behaviour, safeguarding, SEN, interventions, assessments, resources, and reports;
  • process enquiries, support tickets, and messages;
  • operate school-store, invoice, wallet, payment, and order features;
  • provide careers, applicants, and HR-related functionality;
  • protect the platform, prevent abuse, detect unauthorised access, and maintain audit trails;
  • enable AI-supported drafting, summaries, translation, and reporting where these features are enabled;
  • Improve, monitor, and secure our services.

8. Lawful Bases

Depending on the processing activity, we may rely on one or more of the following lawful bases:

  • consent;
  • performance of a contract;
  • compliance with a legal obligation;
  • legitimate interests;
  • Public task, where a school or other relevant body relies on that basis in its own operations.

You must complete this section with your final lawful-basis schedule for each major processing area.

9. Children’s Data

EdiWay is a service that is likely to involve children’s personal data. We recognise that children merit specific protection and that information about how their data is used must be clear, accessible, and appropriate to the audience.

Where children use the platform directly, we aim to present relevant information in clear language and to apply role-based visibility, invitation controls, and age-appropriate safeguards. You should also publish a child-friendly privacy summary alongside this policy.

10. AI-Supported Features

Some platform features may use AI-supported processing, including AI-assisted drafting, report generation, quick-fill support, and document translation or summarisation.

Where AI-supported features are used:

  • user-entered or uploaded content may be processed to generate outputs;
  • AI outputs may be inaccurate, incomplete, or unsuitable without human review;
  • AI outputs must not be treated as professional, medical, safeguarding, or legal advice;
  • We expect schools, parents, and professionals to review outputs before relying on them.

See our separate AI Use and Transparency Notice for more details.

11. Who We Share Personal Data With

Depending on the workflow, personal data may be shared with:

  • the relevant school and its authorised staff;
  • linked parents, carers, and authorised family members;
  • invited professionals, support workers, or other authorised third parties;
  • payment service providers, including Stripe;
  • hosting, infrastructure, storage, email, support, or security providers;
  • AI service providers where AI-enabled features are used;
  • Other recipients where required by law or where a valid sharing decision is made.

12. International Transfers

Some of our service providers may process data outside the UK. If we transfer personal data internationally, we will take appropriate steps to ensure a lawful transfer mechanism and suitable safeguards are in place.

This section must be updated with your actual live transfer position before publication.

13. Retention

We keep personal data only for as long as it is reasonably necessary for the relevant purpose, legal obligations, safeguarding requirements, audit requirements, dispute handling, platform security, and service administration.

The platform currently requires a finalised retention schedule. Until that schedule is published, retention depends on the data category, the role of the school or organisation involved, legal obligations, and operational necessity.

You should publish or link to a formal retention schedule covering, at a minimum:

  • enquiries;
  • student and family records;
  • home education records;
  • safeguarding and welfare records;
  • messages and support tickets;
  • store, invoice, payment, and order records;
  • careers and HR records;
  • AI uploads, prompts, and generated outputs.

14. Security

We use technical and organisational measures designed to protect personal data. These may include role-based permissions, audit logging, private file handling, invitation controls, account security measures, and restricted access to sensitive areas.

No internet service can be guaranteed to be completely secure, but we work to reduce risks and protect the confidentiality, integrity, and availability of the data processed through the platform.

15. Your Rights

Depending on the circumstances, individuals may have rights, including:

  • the right to be informed;
  • the right of access;
  • the right to rectification;
  • the right to erasure;
  • the right to restrict processing;
  • the right to data portability;
  • the right to object;
  • rights relating to automated decision-making and profiling.

To exercise these rights, contact us using the details above. In some cases, the relevant school or organisation may need to handle or coordinate the request.

16. Complaints

If you have a concern about how personal data is handled, please contact us first so we can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office in the UK.

17. Cookies and Similar Technologies

We use cookies and similar technologies to operate the site and platform, maintain sessions, store settings, secure services, and support selected features. Some technologies may be strictly necessary. Others may require consent.

See our Cookie Policy for full details.

18. Updates to This Policy

We may update this Privacy Policy from time to time. Where required, we will bring significant changes to the attention of users through the website, platform notices, or account communications.

Shopping Basket