CognateUK
Privacy Policy
Version 2026-09-v5 · Effective / updated: 3 September 2026
INTRODUCTION
CognateUK is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information. Our data handling practices are aligned to the UK GDPR and the Data Protection Act 2018.
CognateUK is operated by Excellence First Enterprise Consultancy Ltd (registered in England and Wales, company no. 06000580). ICO registration reference: ZB334374. Excellence First Enterprise Consultancy Ltd is the data controller for all personal data processed through CognateUK.
Our Data Policy and IT and Cyber Security Policy set out further detail on data management, retention and protection. These are internal governance documents rather than materials published to families; a summary is available on request to privacy@cognateuk.com.
INFORMATION WE COLLECT
We may collect and process the following types of personal data:
- Identity data: name, date of birth, username
- Contact data: email address, telephone number, postal address
- Technical data: IP address, browser type, device information
- Usage data: how you interact with our platform and services
- Educational data: school, academic background, course progress, onboarding responses (including self-assessment and AI attitude questions), portfolio work, session engagement
- Payment data: card and payment credentials are handled by our payment processing provider and are not stored on the CognateUK platform. We separately retain the transaction and payment records we need for our own accounting and legal obligations, for example confirmation of amounts paid and refunded.
- AI interaction data: ProfBot learning interactions to support student navigation and reflection
- Virtual classroom recordings: sessions may be recorded for programme delivery and quality purposes
- Correspondence data: personal data you share with us via email or other communication outside the platform
To participate in CognateHelix, we need to collect certain personal data (such as your name, contact details, and educational background). If this data is not provided, we may not be able to create your account, enrol you in the programme, or deliver the full learning experience.
In some cases, we receive personal data from a third party rather than directly from you. For example, a parent or guardian may provide a student's details during enrolment, or a school sponsor may provide student names and contact information for cohort allocation. Where we receive your data from a third party, the categories of data and purposes are as described in this policy.
HOW WE USE YOUR INFORMATION
We use your personal data for the following purposes:
- To provide and manage the CognateHelix programme and related educational services
- To create and manage your account and link it to the appropriate parent or school sponsor
- To communicate with you about your account and our services
- To support your learning experience through AI-enabled tools, including ProfBot
- To process payments securely
- To record virtual classroom sessions for programme delivery and quality purposes
- To comply with legal and regulatory obligations, including safeguarding
- To improve our platform and develop new features
ProfBot, our AI learning companion, retains relevant conversation history and learner context within the CognateUK platform to provide learning continuity. When generating responses, relevant context is submitted to the AI service provider via API. The AI service provider does not use this data to train its models. Every ProfBot message passes through a mandatory safeguarding detector; students are not shown internal classifications. No consequential decisions about students are made by AI.
LEGAL BASIS FOR PROCESSING
We rely on different lawful bases depending on whose data we are processing and why:
- Parent or guardian enrolment, account administration and payments: performance of a contract where the parent or guardian is the contracting party.
- Student programme data needed to deliver and manage CognateHelix: our legitimate interests in delivering the programme effectively and safely, balanced carefully against the student's rights and interests.
- Legal and regulatory requirements: compliance with a legal obligation where a specific obligation applies.
- Safeguarding and welfare: the appropriate lawful basis will depend on the circumstances and may include legitimate interests, legal obligation or vital interests.
- Platform improvement and development: our legitimate interests, balanced against your rights.
- Optional uses for which we specifically ask permission: consent, which may be withdrawn at any time.
Where special category personal data is processed, we also apply the additional safeguards and legal conditions required by data protection law. Further detail is set out in our Data Policy, available on request to privacy@cognateuk.com.
COOKIES
The CognateUK platform uses cookies to support essential platform functionality. CognateUK does not currently use non-essential analytics or tracking cookies.
If we introduce analytics in future, we will review the applicable legal requirements at that time and put in place whatever controls those requirements demand, which may include consent, before activation.
DATA SHARING
We use a small number of third-party services to support platform delivery. Data shared with third parties is limited to what is strictly necessary. We do not sell, rent, or share your personal data for marketing purposes.
| Service Function | Data Shared |
|---|---|
| Payment processing | Parent/customer payment details |
| Email delivery | User email addresses, communication content |
| AI learning support (ProfBot) | Student learning context, conversation history, interaction data |
| Virtual classroom | User identity, session participation |
| Hosting and infrastructure | All platform data |
| Translation services | Text content submitted for translation |
| Operational email and document management | Staff and programme communications |
Where a third-party service processes data outside the UK, we will only proceed once appropriate safeguards, such as adequacy or a recognised transfer mechanism, have been confirmed for that specific provider.
A register of our current third-party service providers, their processing locations, and the applicable transfer safeguards is maintained internally and is available on request to privacy@cognateuk.com.
DATA RETENTION
We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law.
| Data Category | Retention Period |
|---|---|
| Student programme data (profile, onboarding, learning activity, portfolio data, ProfBot interactions) | 90 days from individual programme completion |
| Sponsor data (parent/school contact details, relationship records) | 90 days from linked student's individual programme completion |
| Payment and financial records | 6 years from date of transaction, aligned to HMRC requirements |
| Safeguarding records (general documentation, DBS records, policy acknowledgements) | 6 years from end of student's programme |
| Safeguarding records (concerns, incidents, allegations) | Until the individual turns 25, reflecting our own safeguarding policy |
| Tutor and staff operational data | 90 days from end of their involvement |
Where a complaint, dispute, legal claim, or other legitimate requirement is active at the point a retention period would otherwise expire, the relevant records will be retained until that matter is fully resolved, after which the standard retention period and deletion process will apply. Full retention details, including the basis for each period, are set out in our Data Policy, available on request to privacy@cognateuk.com.
CHILDREN'S DATA
Many CognateUK students are under 18. We take additional care when handling children's data:
- Privacy information is written in clear, accessible language
- Data collection is minimised to what is genuinely necessary for programme delivery
- We do not use children's data for marketing or profiling purposes
- Onboarding baseline data is used solely to support the student's learning journey
- Sponsor dashboards are scoped so that parents and schools can only view data relating to their linked students
- We carry out Data Protection Impact Assessments (DPIAs) for processing activities involving children's data. A DPIA for CognateHelix and ProfBot is being completed ahead of programme launch and will be in place before the programme accepts its first students.
YOUR RIGHTS
Depending on the circumstances and the lawful basis we rely on, you may have the right to:
- Access your personal data
- Rectify inaccurate or incomplete data
- Request erasure of your data
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
To withdraw consent, please contact us at privacy@cognateuk.com. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.
We will respond to all rights requests within one calendar month. If a request is complex, we will let you know and may extend this by up to two further months.
A student's ability to exercise these rights themselves depends on their capacity and understanding, rather than a fixed age. In practice we will generally respond directly to an older teenager unless there is a safeguarding reason to involve a parent or guardian, and will use judgement in individual cases rather than applying a strict age cut-off.
SECURITY
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Full details are set out in our IT and Cyber Security Policy, available on request to privacy@cognateuk.com.
For details on your responsibilities when using the CognateUK platform, please refer to our Acceptable Use Policy.
CONTACT US
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at privacy@cognateuk.com.
CognateUK does not currently appoint a Data Protection Officer. All data protection enquiries can be directed to privacy@cognateuk.com.
If you are not satisfied with how we have handled your data or your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. CognateUK is operated by Excellence First Enterprise Consultancy Ltd, ICO registration reference: ZB334374.