Effective April 2025

1. INTRODUCTION

This privacy notice provides you with details of how we collect and process your personal data through your use of our site https://puzzletreeacademy.com

By providing us with your data, you warrant to us that you are over 13 years of age. Puzzle Tree Academy Ltd is the data controller, and we are responsible for your personal data (referred to as "we", "us" or "our" in this privacy notice).

🔍 For more details on how we process and protect your personal data, you may also view:

• Our Full Data Protection Policy (legal version)

• Our Parent-Friendly Summary: How We Keep Your Data Safe (clear and simple version)

We have appointed a Data Protection Officer who is in charge of privacy-related matters for us. If you have any questions about this privacy notice, please contact the Data Protection Officer using the details set out below.

Contact Details

Full name of legal entity: Puzzle Tree Academy Ltd

Data Protection Officer: Olga Pavlovoiciene

Email address: [email protected]

Postal address: 1 Viaduct Lofts, Melbourne St, Brighton, BN2 3BN, United Kingdom

It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at [email protected]

2. WHAT DATA DO WE COLLECT ABOUT YOU, FOR WHAT PURPOSE AND ON WHAT GROUND WE PROCESS IT

In addition to data collected through our website, we also collect information through comprehensive wellbeing and neurodevelopmental assessments.

These include:

The Neuro-Wellness Evaluation Questionnaire (hosted by Puzzle Tree Academy)

PAGS Profiling Assessments (hosted externally on PAGS’ secure platform)

These assessments may contain sensitive data (health, emotional wellbeing, developmental history) provided with your consent to help us understand your family's needs and offer personalised guidance and support.

Personal data means any information capable of identifying an individual. It does not include anonymised data.

We may process the following categories of personal data about you:

- Communication Data – includes any communication you send to us through contact forms, email, text, social media or otherwise. Our lawful ground: legitimate interests (responding to communications and keeping records).

- Customer Data – includes name, title, billing/delivery address, email, phone, purchase details and payment info. Our lawful ground: performance of a contract.

- User Data – includes how you use our website and any data you post publicly. Our lawful ground: legitimate interests (to operate and administer our site and services).

- Technical Data – includes IP address, browser info, time zone, device data and usage analytics. Our lawful ground: legitimate interests (to improve site functionality and marketing strategy).

- Marketing Data – includes preferences for receiving marketing communications. Our lawful ground: legitimate interests and/or consent.

We may use Customer, User, Technical and Marketing Data to deliver relevant content and advertisements (e.g. Facebook ads) and send you other marketing communications based on consent or legitimate interest.

We may need to collect sensitive data about you (or your child) to deliver certain services. This may include information about health, developmental history, and support needs.

We do not collect or process genetic or biometric data as part of our services. However, if you are referred to one of our trusted partners (for example, Dr Irina Schurov) for additional medical, biochemical, or assessment services, you will enter into a separate agreement with them. In such cases, Puzzle Tree Academy does not access or store that information and is not the data controller for it.

We request that parents do not include children’s full names, addresses, or directly identifying information when completing forms or emails. Profiling and detailed assessments are conducted securely via our trusted platform PAGS.

We require your explicit consent before processing any sensitive data. You will receive a follow-up request to confirm your consent before we proceed.

If required by law or contract and you do not provide requested data, we may not be able to fulfil services or deliver products. We will notify you if this occurs.

We only use your data for the purposes stated or for reasonably compatible purposes. For unrelated purposes, we will seek your permission and explain the legal basis.

For more information about how long we retain this information, please refer to our Data Retention Policy

3. HOW WE COLLECT YOUR PERSONAL DATA

We collect data:

- When you provide it directly (e.g. via forms, email)

- Automatically via cookies or analytics as you interact with our website

- Through third-party platforms you choose to engage with (e.g. booking systems, assessments)

4. MARKETING COMMUNICATIONS

We may send you marketing communications based on:

- Your consent

- Our legitimate interests (e.g., to grow our business)

Under PECR (Privacy and Electronic Communications Regulations), we may send marketing messages if:

- You have made a purchase or requested info from us

- You have agreed to receive marketing and not opted out

You may opt out anytime using the unsubscribe link in emails or by contacting us at [email protected]. Opting out does not affect service-related communications.

Before sharing your data with third parties for their own marketing, we will obtain your express consent.

5. DISCLOSURES OF YOUR PERSONAL DATA

We may share your data with:

- Companies providing IT, system support, or administrative services

- Professional advisers (lawyers, auditors, insurers)

- Government bodies (where required by law)

- Educational, medical, or social professionals (only with your consent)

- Third parties in case of business sale or merger

All third parties are required to protect your data and use it only as instructed and lawfully.

We may also disclose personal data without consent if there is a safeguarding duty or legal obligation to do so. This includes circumstances where there is reason to believe that a child or vulnerable person may be at risk of harm. In such cases, data may be shared with appropriate authorities including healthcare providers, schools, social services, or the police, in accordance with applicable child protection and safeguarding laws.

We may also disclose your personal data without your consent if we have a legal obligation or a safeguarding duty to do so. This includes circumstances where we have reason to believe that there is a risk of harm to a child or vulnerable adult. In such cases, data may be shared with appropriate authorities, such as health professionals, educational staff, social services, or law enforcement agencies, strictly in accordance with applicable laws and professional safeguarding standards.

6. INTERNATIONAL TRANSFERS

We use third-party platforms that may process data outside the UK and EEA.

We currently work with:

- Go High Level (via Taft Systems) – CRM and email communication

- PAGS – secure profiling and assessment

- Google Workspace – intake forms, document storage, and questionnaires

- Zoom – used for virtual consultations, group sessions, and webinars

We ensure these providers meet GDPR-compliant standards through contractual safeguards and secure data processing agreements.

You can review their privacy policies here:

- PAGS: https://pagsprofile.com/privacy-policy/

- Taft Systems: https://www.taftsystem.com/privacy-policy

- Google: https://policies.google.com/privacy](https://policies.google.com/privacy | Google GDPR Info: https://support.google.com/a/answer/9282959?hl=en

- Zoom: https://explore.zoom.us/en/privacy/ | Zoom GDPR Info: https://explore.zoom.us/en/gdpr/

7. DATA SECURITY

We take appropriate technical and organisational measures to protect your data. Access is limited to staff and partners with a business need. All processing follows strict confidentiality procedures.

We have breach response protocols and will notify the ICO and you (if required) in the event of a breach.

8. DATA RETENTION

We retain your data only as long as necessary. We consider the sensitivity and purpose of processing, and legal requirements.

For tax and accounting purposes, we keep customer records for six years. Data may be anonymised for statistical use indefinitely.

For wellness assessment data (e.g. Neuro-Wellness Evaluation), we retain information for up to 2 years after last contact, unless consent is withdrawn earlier.

See our full Data Retention Policy for details.

For more details about how we manage and protect personal data, including our lawful basis for processing and internal responsibilities, you can view our Data Protection Policy.

9. YOUR LEGAL RIGHTS

You have the right to:

- Request access, correction, deletion, or restriction of your data

- Object to processing

- Request data transfer (portability)

- Withdraw consent at any time (if that was the lawful basis)

You can exercise your rights by emailing [email protected]

No fee is charged unless requests are unfounded, repetitive, or excessive. We may request ID to verify your identity. We aim to respond within one month.

If you are in the UK, you can complain to the Information Commissioner’s Office (ICO) via www.ico.org.uk

We appreciate the chance to address concerns directly first.

If you are in the EU, you may contact your country’s data protection authority.

10. THIRD-PARTY LINKS

Our website may include links to other websites. Clicking these may allow third parties to collect or share your data. We are not responsible for the privacy practices of other sites. Please review their privacy policies.

11. COOKIES

You can set your browser to refuse or alert you to cookies. Disabling cookies may affect your website experience.

Thank you for trusting Puzzle Tree Academy Ltd with your personal data. We are committed to nurturing privacy, safety, and transparency at every stage of your journey with us.