1. Introduction:
1.1 At Educe Trading Ltd (“The PE Hub” or “us” or “we” or “our”), a UK registered company with company number 08918344 and registered address of Grosvenor House, 11 St. Paul’s Square, Birmingham, England, B3 1RB, we respect the privacy rights of everyone who uses our website (“Site”) (https://thepehub.co.uk/) and our Learning Management System (“LMS”) web application (https://lms.thepehub.co.uk/). We recognise the importance of protecting the information we collect about you. This Policy is designed to help you understand how we collect, hold, use, disclose and delete personally identifiable information (“personal data”) about you.
1.2 This Policy, together with our Terms and Conditions and any other documents referred to in it, sets out the basis on which we will process any personal data we collect from you, or which you provide to us, in the course of using our Site and/or our LMS.
1.3 For the purpose of the UK Data Protection Act 2018 (“DPA’18”), the UK General Data Protection Regulation (“UK GDPR”) and the Data (Use and Access) Act 2025 (“DUAA”), we are both a processor where we are processing personal data on behalf of Organisations, and a controller where we are onboarding Staff and collecting personal data for marketing purposes. “Organisations” and “Staff” are defined in section 2. We can be contacted at the following email address: info@thepehub.co.uk.
2. Who this Policy covers:
2.1 Our Site and LMS are designed to aid lesson planning by providing resources and tools in line with the national curriculum. The following terms are used throughout this Policy to describe the people and organisations it covers:
- Organisation – an Organisation is a school, academy or coaching company that has signed up to use the Site or LMS.
- Staff – teachers and other staff members of an Organisation, whether or not they have an account on the Site or LMS.
- Pupil – a child whose details an Organisation adds to the LMS, whether entered directly or imported from its own systems.
- Visitor – anyone who uses the Site without an account, including someone who submits a contact form or registration form.
2.2 The personal data of Pupils and Staff will be used for the purposes of creating profiles and records. In most instances, this personal data is not collected directly from the Pupils and Staff themselves, and therefore it is the responsibility of the Organisation to ensure that Pupils and Staff have access to this Policy to ensure they understand how their personal data is collected, processed, stored, disclosed and deleted, as well as understanding how they can exercise their individual data subject rights.
3. Your information:
3.1 All personal data collected through our Site and/or LMS is processed under the UK GDPR and DPA’18.
3.2 The personal data relating to Pupils and Staff that an Organisation provides to us is processed on behalf of that Organisation, which determines the lawful basis as controller. Where we act as controller of the account details of Staff with an account, that personal data is processed on the lawful basis of contract for the purposes of providing Staff with access to the LMS.
3.3 Technical and usage data relating to Visitors to our Site, including those who access free lesson plans and resources without an account, is processed on the lawful basis of legitimate interests, namely providing those resources, protecting our Site and content from misuse, and improving our services. Further detail is set out in our Cookie Policy.
3.4 All other personal data collected, including commercial data relating to Visitors who make an enquiry by filling in a contact form or registration form, is processed on the lawful basis of legitimate interests to facilitate sales and marketing information relating to the provision of our services.
3.5 Where you create an account, the provision of personal data is necessary in order to facilitate the provision of the service.
4. Information that may be collected:
4.1 The following data, including personal data, may be collected from you when you 1) fill in our contact form, 2) create an account, 3) log in to an existing account, 4) complete our registration flow, or 5) interact with The PE Hub:
- Your full name;
- Your email address; and
- Service name or name of institution.
4.2 During the course of using our Site and/or LMS other personal data may be collected from you. The personal data that may be collected includes:
- Your Internet Protocol (“IP”) address;
- Any referring or exit pages taking you to or from our Site;
- Your web and browser type;
- Your device type, for example, iOS or Android;
- Your time zone and location;
- Date and time stamps;
- Any browser plug-ins; and
- Your operating system.
4.3 Organisations provide us with information about their Staff and Pupils, either by entering it directly or by importing it from their own systems. The Organisation decides what to provide.
4.4 For Staff, this falls into the following categories:
- Identity and contact details, such as name and email address; and
- Account details, such as role, permissions and activity within the LMS, where the member of Staff has an account.
4.5 For Pupils, a name is the only information we require. An Organisation may choose to add further information in the following categories:
- Profile and enrolment details;
- Classes, groups and other categories the Organisation uses to organise its Pupils;
- Assessment and progress records created by Staff; and
- Other records added by Staff.
4.6 A current list of the fields available in the LMS can be provided to Organisations on request.
5. Information we do not require:
5.1 We do not require special category personal data, and none is needed to use the LMS. An Organisation may choose to provide information that includes or reveals such data. Where it does, the Organisation is responsible for ensuring that this is necessary and appropriate.
5.2 All personal data held in the LMS is protected to the same standard, as described in section 7.
6. How your personal data may be used:
6.1 The personal data we collect about you during the course of your use of our Site and/or LMS may be used in a number of ways including, but not limited to, the following:
- To respond to any enquiries made through our contact form;
- To provide any resources or services requested;
- To fulfil our obligations under any contract we have with Organisations and Staff;
- To collect payment for our services;
- To ensure that the content on our Site and/or LMS is presented in the most optimised and effective manner for you and your device;
- To diagnose and fix technology problems;
- To control unauthorised use or abuse of our Site and/or LMS, or otherwise detect, investigate or prevent activities that may violate our policies or are otherwise illegal;
- To notify you about changes to our software, our services or our policies;
- To deliver support where necessary;
- To administer our Site and/or LMS, including data analysis, testing, traffic monitoring, research, statistical and survey purposes; and
- To send you newsletters and other marketing information from time to time.
6.2 If you do not wish to be contacted for marketing purposes, please unsubscribe from any marketing communication using the unsubscribe function in the footer of the email.
7. Where your personal data may be stored:
7.1 The personal data you provide to us through our Site is held on secure servers operated by our hosting and storage providers Vercel, PlanetScale, Cloudflare and Hetzner, in data centres located in the UK and the European Economic Area (“EEA”). It is encrypted in transit using TLS 1.2 or higher, and encrypted at rest using AES-256. Our backups are held under the same protections and in the same regions.
7.2 The personal data you provide to us through our LMS is held on the same infrastructure and subject to the same protections: encrypted in transit using TLS 1.2 or higher, encrypted at rest using AES-256, and stored in data centres in the UK and the EEA.
7.3 We take your privacy seriously and will take all reasonable steps to protect your personal data.
7.4 In order to provide services to you, we may transfer your personal data to third parties, affiliates, and other service providers, some of which may process and/or store your personal data outside of the UK. In such instances, all reasonable steps will be taken to ensure that your personal data is treated securely and in accordance with this Policy (where possible). Transfers to the EEA are covered by UK adequacy regulations. Any other transfers outside of the UK will be covered by appropriate safeguards, for example, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations.
8. How your personal data may be disclosed:
8.1 In accordance with clause 7.4 above, the third parties to whom your personal data may be disclosed include, but are not limited to:
- Anthropic – https://www.anthropic.com/legal/privacy
- Beehiiv – https://www.beehiiv.com/privacy
- Calendly – https://calendly.com/legal/privacy-notice
- Cloudflare – https://www.cloudflare.com/privacypolicy/
- Eject – https://eject.tech/privacy/
- Fathom Analytics – https://usefathom.com/privacy
- Google (YouTube, reCAPTCHA and Fonts) – https://policies.google.com/privacy
- Hetzner – https://www.hetzner.com/legal/privacy-policy/
- Microsoft 365 – https://privacy.microsoft.com/en-gb/privacystatement
- OpenAI – https://openai.com/policies/privacy-policy/
- Pipedrive – https://www.pipedrive.com/en/privacy
- PlanetScale – https://planetscale.com/legal/privacy
- PostHog – https://posthog.com/privacy
- QuickBooks – https://www.intuit.com/privacy/statement/
- SendGrid (Twilio) – https://www.twilio.com/en-us/legal/privacy
- Sentry – https://sentry.io/privacy/
- Stripe – https://stripe.com/gb/privacy
- Upstash – https://upstash.com/trust/privacy
- Vercel – https://vercel.com/legal/privacy-notice
- Vimeo – https://vimeo.com/privacy
9. Additional information regarding the storage of your personal data:
9.1 The PE Hub acts as a processor on behalf of Organisations. The PE Hub is consequently processing personal data under instructions from the Organisations that are defined as controllers under the DPA’18. As controllers, Organisations are responsible for collecting the personal data of Pupils and Staff and making decisions with regard to the retention, transmission, processing, review and deletion of that personal data. Consequently, Organisations as controllers remain responsible for the personal data that they collect and provide to The PE Hub for processing. Each Organisation is its own unique institution and should be aware of any specific data retention legislation that applies to it regarding the ongoing retention of the personal data of their Pupils and Staff.
9.2 The PE Hub’s general data retention period is outlined at 9.6 below. However, Organisations will be aware of the data retention legislation applicable to them. Please contact any such Organisation for more information on this.
9.3 We hold your personal data in a combination of hard copy and electronic files for the period necessary to support our Site and/or LMS, comply with our legal obligations, resolve disputes, or otherwise fulfil the purposes outlined in this Policy.
9.4 In order to provide our services, we may use third-party systems that may process, store and/or have access to your personal data. These third parties will act as data processors on our behalf and will operate in line with this Policy where possible.
9.5 We may also retain backup information on our servers for some time in order to comply with applicable laws and regulations, and our internal security policies and procedures.
9.6 In line with our internal procedures and applicable laws and regulations, we operate the following data retention periods:
- Data such as usernames and passwords, contact information, and other personal data that is collected through the general use of our Site or LMS will be retained for 7 years from the last date of interaction.
- Any profile data added to the LMS by an Organisation will be subject to the internal data retention period of the Organisation using the LMS.
9.7 At the end of the above data retention periods, all of the data stored, including personal data, will be reviewed and securely deleted/destroyed.
9.8 We use appropriate technical and organisational security measures, in line with industry standard best practice, such as firewalls, encrypted databases with limited physical and electronic access, and other encryption methods, to protect your personal data against unauthorised use, disclosure or modification. Further detail is available on our security page (https://thepehub.co.uk/security/).
10. Processing of personal data of those below the age of 13:
10.1 As described above in section 2 of this Policy, our Site and LMS are designed to be used by schools and companies that operate within the education sector. Due to this, Organisations may provide us with the personal data of Pupils who are children, including children below the age of 13. We process this personal data on behalf of the Organisation, as described at 3.2.
10.2 Please note that all of the personal data that is collected and processed through our Site and/or LMS is treated with a high standard of care. This applies whether the personal data relates to a child under the age of 13 or any individual above the age of 13.
11. Data subject rights:
11.1 Subject access request – Under the UK GDPR you have the right to access the personal data we hold about you. If you wish to exercise this right, please send your request to info@thepehub.co.uk.
11.2 Right to rectification – Under the UK GDPR you have the right to request the amendment or updating of all the personal data that we hold about you. If you wish to exercise this right, please send your request to info@thepehub.co.uk.
11.3 Right to erasure – Under the UK GDPR you have the right to have all of the personal data that we hold about you deleted in line with our statutory and legal responsibilities. If you wish to exercise this right, please send your request to info@thepehub.co.uk.
11.4 Right to restriction of processing – Under Article 18(1)(a) to (d) of the UK GDPR, you have the right to obtain from us the restriction of processing. If you wish to exercise this right, please send your request to info@thepehub.co.uk.
11.5 Right to data portability – Under the UK GDPR, where applicable, you may have the right to request a copy of all of the personal data we hold about you in a structured, commonly used and machine-readable format. If you wish to exercise this right, please send your request to info@thepehub.co.uk.
11.6 Right to object – Under the UK GDPR, where we process your personal data on the lawful basis of legitimate interests, you have the right to object to that processing. We will stop unless we have compelling legitimate grounds to continue. Where you object to direct marketing, we will always stop. If you wish to exercise this right, please send your request to info@thepehub.co.uk.
12. Enforcement:
12.1 The PE Hub regularly reviews its compliance with relevant data protection laws and regulations, and this Policy.
12.2 Should you have any queries or complaints in relation to how we process your personal data, in the first instance please contact us at info@thepehub.co.uk and we will review your request as soon as possible.
12.3 Where applicable, we cooperate with the appropriate regulatory authorities, including data protection authorities, for example the UK Information Commissioner’s Office (“ICO”), to resolve any complaints regarding the collection, processing and disclosure of personal data that cannot be resolved between us and the individual.
13. Notices and provisions:
13.1 Please note that this Policy applies to The PE Hub Site and LMS only. If you click on, or follow, any links from our Site or LMS to an external website or application, this Policy will no longer apply. Please ensure you check the privacy policies of any such external website or application before submitting any personal data, as we cannot accept any responsibility or liability in relation to such websites or applications.
13.2 We reserve the right to change this Policy at any time. These changes will take immediate effect unless you are notified otherwise. For this reason, we recommend that you refer to this Policy on an ongoing basis so that you understand our current practice at the time you use our service.
13.3 If you have a concern about this Policy or would like to know more about how your personal data is collected, processed, stored or disclosed, please contact us in the first instance.
13.4 If you wish to contact us with a complaint regarding the processing of your personal data, please ensure you include your full name, contact information and a detailed description of your complaint.
13.5 If you are not satisfied with our response to any of your data subject rights or a complaint that you have made, you may also contact your local data protection authority to lodge a complaint.
14. Contact information:
14.1 If you have any questions regarding this Policy or want to exercise any of your data subject rights, please email us at info@thepehub.co.uk.
14.2 As outlined in the above section, should you not be satisfied with the process, conduct or response to a request you have made, you have the right to complain to the ICO. The contact information for the ICO can be found here: (https://ico.org.uk/make-a-complaint/).