This notice covers personal information we collect through the Minivox website (minivox.co.uk), the forms on it, and when you contact us by email, phone, video call or in person. It does not cover the Minivox platform that schools and pupils use. The platform has its own privacy notice for pupils and parents, which we give to every school that uses it and will send to you on request.

We handle personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. In this notice, "we", "us" and "our" mean Minivox Ltd.

1. Who we are

Minivox Ltd is a company registered in England and Wales under number 16278583, with its registered office at DMC 02 County Way, Barnsley, S70 2AG. We are the controller of the personal information described in this notice. Our ICO registration number is [ICO registration number].

For any question about your information, or to use any of your rights, email [privacy address]. [Named person, role] is responsible for data protection at Minivox.

2. What we collect

When you fill in a form on this site

Your name, the school, trust or organisation you work for, your role, your work email address, and anything you write in the message box. We also record which page you sent the form from, the date and time, and the country your request came from, so that we can tell real enquiries from automated ones.

Most of what we ask is about your school or organisation rather than about you. Please don't include information about pupils, or anything sensitive about yourself or anyone else, in a form on this site.

When you contact us or arrange a demo or pilot

Your name, email address and any other contact details you share. What you tell us in emails, calls and meetings, and our notes of them. If your school or organisation becomes a customer, the business contact and billing details we need to deliver and invoice the work.

From public sources

Before a demo we may read what is publicly available about your school or trust, such as its website, Ofsted or ISI reports and published strategy documents, so that the conversation reflects your context rather than a generic pitch.

When you visit the website

Our hosting provider records basic technical information, such as IP addresses, browser type and the pages requested, to keep the site running and secure. The site's fonts are served by Google, so your browser shares your IP address with Google when a page loads.

We use PostHog to understand which pages are read and which forms are sent. It runs without cookies unless you choose to accept them in cookie preferences. Without cookies it cannot recognise you between visits, and we do not use it to identify you. [Delete this paragraph if PostHog is not switched on at go-live.]

3. How we use it, and why we're allowed to

We only use personal information where the law gives us a reason to. The reasons we rely on are:

To reply to your enquiry, arrange a demo and talk about a pilot. Our legitimate interest in responding to people who ask about Minivox, and taking steps at your request before entering a contract.
To answer a safeguarding or data protection question. Our legitimate interest in giving schools accurate information, and in some cases our legal obligations.
To deliver a pilot or subscription we've agreed with your school or organisation. Performing our contract.
To send occasional updates about Minivox and oracy that we think are relevant to you as a school or education contact. Our legitimate interest in telling the people we work with about our work. Every message lets you opt out, and you can opt out at any time by emailing us. We only do this where you have asked about Minivox or work with us; we do not buy lists.
To keep accounts and meet our legal obligations. Legal obligation.
To understand how the website is used and improve it. Our legitimate interest in running a useful site. We use page-level statistics, not records of individuals.

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details, and you can object at any time (see section 9).

We do not use your information to show you advertising on other websites, and we do not make any decision about you by automated means.

4. Who we share it with

We don't sell personal information, and we don't share it for advertising. We share it only with:

Service providers who process it for us, under contract and only on our instructions: Cloudflare (website hosting and storage of form submissions), Resend (sending form submissions to us by email), Google (email, documents and calendar) and PostHog (website statistics).
Professional advisers, such as our accountants and lawyers, where needed.
Authorities or other parties where the law requires it, or to establish, exercise or defend legal claims.
A buyer or successor, if our business is sold or restructured. They would have to use your information in line with this notice.

5. International transfers

Some of our service providers process information outside the UK, including in the United States. Where they do, we make sure the transfer is protected: either the destination is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), or the transfer is covered by the ICO's International Data Transfer Agreement or Addendum.

6. How long we keep it

Enquiries and demo requests that don't lead to a pilot or subscription: 24 months from our last contact with you, then deleted.
Customer records: six years after the end of the contract, to meet tax and legal requirements.
Marketing opt-outs: we keep a short record that you've opted out, so that we don't contact you again.

If we no longer need information sooner, we delete or anonymise it sooner.

7. How we protect it

Access to personal information is limited to the people at Minivox who need it. Our accounts use two-factor authentication, and the site and our tools encrypt information in transit. No system is completely secure, but if a breach affected you, we would tell you and the ICO where the law requires it.

8. Children

This website is for school staff, trust leaders and the organisations we work with. It is not intended for anyone under 18, and we do not knowingly collect personal information about children through it. Pupils use the Minivox platform under their school's control, and the platform privacy notice explains how their information is handled.

9. Your rights

You have the right to:

ask for a copy of the personal information we hold about you;
ask us to correct information that is wrong or incomplete;
ask us to delete your information;
ask us to restrict how we use it;
object to how we use it, including an absolute right to stop marketing;
receive information you gave us in a portable format;
withdraw your consent at any time, where we rely on it. This doesn't affect anything we did before you withdrew.

Email [privacy address] to use any of these rights. It's free, and we'll respond within one month. We may need to confirm your identity first.

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

10. Cookies

This website does not set cookies unless you choose to accept them in cookie preferences. Without them, the site works in full and our statistics tool runs without recognising you between visits. If you accept, PostHog sets a cookie so that repeat visits are counted once. You can change your choice at any time from the cookie preferences link in the footer. We do not use advertising or tracking cookies.

11. Other websites

This site links to other websites, including gov.uk, the Education Endowment Foundation and the organisations we work with. They have their own privacy policies, and we're not responsible for how they handle your information.

12. Changes to this notice

We'll update this notice when our practices change. The date below shows when it was last revised.

Last updated [date of go-live].

Privacy notice.