About This Privacy Policy

Hearo Phonics Ltd ("we", "us", "our", "the Company") is committed to protecting and respecting the privacy, safety and security of all users of the Hearo Phonics application and associated resources ("the Platform"), including pupils, teachers and Special Educational Needs Coordinators (SENCOs) (together, "Users").

This Privacy Policy explains in plain language who we are, what personal information we collect, how we use it, how long we keep it, who we share it with, and how you can exercise your privacy rights. It should be read alongside our Terms and Conditions of Use.

If you have any questions or concerns about our use of personal information, please contact us using the details provided at the end of this document.

This Privacy Policy has been developed in accordance with the following legislation:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018
• The Data (Use and Access) Act 2025
• All other applicable UK data protection legislation

About Hearo Phonics Ltd

Hearo Phonics Ltd is a UK-based company that produces phonics learning resources and progress-tracking tools for use in primary schools. The Platform is designed for use by teachers and SENCOs and is not directly accessed by pupils.

Hearo Phonics Ltd is registered with the Information Commissioner's Office (ICO). ICO registration number: ZC167612.

Contact email: privacy@hearo.school

How Hearo Phonics Ltd Acts in Relation to Data

The Platform is used by schools to record and track phonics progress. In this context:

• The School acts as the "Controller" of pupil data — the school determines the purposes and means of processing personal data relating to its pupils.
• Hearo Phonics Ltd acts as the "Processor" — we process personal data only on the School's instructions and in accordance with our contractual obligations.

This means that in most cases, the lawful basis for processing pupil data rests with the school, not with us. Schools are responsible for ensuring they have appropriate consent and lawful grounds before entering data into the Platform.

What Personal Information We Collect

The Platform is teacher-facing only. Pupils do not have accounts or log in directly. All pupil data is entered and managed by authorised school staff.

School and Teacher Information

When a school subscribes to the Platform, we may collect:

• School name and postal address (for account administration and billing)
• Teachers' and SENCOs' names and email addresses (to create and manage accounts and communicate with the school)

Pupil Information

Teachers and SENCOs may enter the following information about pupils:

• Pupils' names
• Year group and class
• Special educational needs and disability (SEND) information
• Phonics progress records and assessment results

SEND information is special category data under UK GDPR and is subject to additional protections. Please see the section below on special category data.

Voice Recordings

The Platform enables teachers to make voice recordings of pupils for the purpose of phonics assessment. At the point of recording, each recording is classified as either "correct" or "incorrect". Immediately following this classification, all links between the recording and any individual pupil's personal information are permanently and irreversibly removed. Voice recordings are thereafter held by us in fully anonymised form and are not linked to any personal data.

Technical Information Collected Automatically

When Users access the Platform, we may automatically collect certain technical information, including:

• IP address
• Device type and operating system
• Browser type and version
• Login information and session data
• Pages accessed and interaction data within the Platform

This information is used for security, platform maintenance and improving the user experience. It does not include pupil data.

Special Category Data (SEND Information)

SEND information entered into the Platform constitutes special category data under Article 9 of the UK GDPR. The following additional protections apply:

• SEND data is accessible within the Platform only to the class teacher and SENCO assigned to the relevant pupil's account.
• Hearo Phonics Ltd staff will not access individual pupils' SEND data.
• It is the School's responsibility to ensure that it has a sufficient lawful basis, including where required obtaining explicit consent from parents or guardians, before entering SEND data into the Platform.
• If a School no longer has a sufficient lawful basis to process a particular pupil's SEND data, it must inform us immediately so that the data can be deleted.

Why We Collect and Use Personal Information

We collect and use personal information for the following purposes:

• To create and administer school and teacher accounts on the Platform;
• To allow teachers and SENCOs to record, track and monitor pupils' phonics progress;
• To provide assessment and reporting features within the Platform;
• To send administrative communications to the school, including account notifications and subscription information;
• To respond to support queries and technical issues;
• To maintain the security, integrity and performance of the Platform;
• To use anonymised and aggregated data for the purposes of research, product development and improvement of the Platform.

We will not use personal data for any purpose that is incompatible with the purposes listed above without first notifying the school and obtaining any required consent.

Legal Basis for Processing

Our legal basis for processing personal information will depend on the type of data and the context in which it is collected. We rely on the following legal bases:

• Contract: Processing that is necessary for us to fulfil our subscription agreement with the school, such as creating accounts and providing access to the Platform.
• Legitimate interests: Processing that is in our legitimate interests, such as maintaining the security of the Platform and using anonymised data to improve our services, where these interests are not overridden by the rights of data subjects.
• Legal obligation: Processing necessary to comply with our legal and regulatory obligations.

For special category data (SEND information), we rely on Article 9(2)(g) UK GDPR — processing necessary for reasons of substantial public interest — as well as the school's explicit consent from parents or guardians where required.

Note on voice recordings: voice recordings used for phonics assessment do not constitute special category (biometric) data under Article 4(14) UK GDPR because they are not processed for the purpose of identifying a pupil by their voice. A pupil's identity is established through the name entered by the teacher, not through the recording. The ordinary obligations of Article 6 apply to any recording that remains linked to a pupil, and once that link is removed the recording ceases to be personal data entirely.

Who We Share Personal Information With

We will not sell personal data. We will keep personal information confidential and will not disclose it to advertisers or any external third parties, except in the following circumstances:

• Sub-contractors who assist us in delivering and maintaining the Platform (listed in Annex A of our Terms and Conditions). These parties are authorised to process personal data only as necessary to provide their services to us and are bound by data processing agreements.
• Where we are required to do so by law, court order or regulatory authority.
• In connection with any proposed merger, acquisition or sale of the Company, in which case the acquiring party will be subject to the obligations in this Privacy Policy.
• To protect the safety and security of our Users or the Platform.

We may share anonymised, aggregated data with research partners or educational bodies for the purposes of improving phonics education. No individual will be identifiable from any such data.

Hearo Phonics Ltd staff will not access individual pupils' SEND data under any circumstances.

How and Where We Store Personal Information

Personal information is stored securely on servers provided by Amazon Web Services (AWS), using UK or European Economic Area (EEA) regions. We use appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit and at rest
• Multi-factor authentication for system access
• Firewalls and anti-malware protection
• Role-based access controls, restricting access to personal data to authorised personnel only
• Staff training on data protection and information security
• Regular review of security procedures

We do not carry paid advertisements on the Platform. The Platform does not allow pupils to communicate with each other or to publish their own personal information.

How Long We Keep Personal Information

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by law.

• Pupil personal data (names, year group, SEND information, phonics progress records) will be retained for three years from the date on which a pupil leaves the school, after which it will be securely deleted.
• If a school does not renew its subscription, all identifiable pupil data will be deleted 90 days after the subscription expires. Schools will be notified before deletion takes place.
• Voice recordings are anonymised at the point of classification and do not subsequently constitute personal data. These anonymised recordings may be retained by us indefinitely for research and product improvement purposes.
• Teacher and school account information will be retained for the duration of the subscription and for a reasonable period thereafter for administrative and legal purposes.

International Transfers of Data

Personal data processed through the Platform is stored on AWS servers in the UK or EEA and will not be transferred outside the UK or EEA without appropriate safeguards in place to comply with UK GDPR requirements.

Where any transfer outside the UK or EEA is necessary, we will ensure that appropriate transfer mechanisms, such as Standard Contractual Clauses, are in place.

Your Data Protection Rights

Under UK GDPR and the Data Protection Act 2018, schools, teachers, parents and pupils (where applicable) have the following rights in relation to personal data we hold:

• Right of access: The right to request a copy of the personal data we hold about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of personal data in certain circumstances.
• Right to restrict processing: The right to request that we limit how we use personal data in certain circumstances.
• Right to data portability: The right to receive personal data in a structured, commonly used format in certain circumstances.
• Right to object: The right to object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, the right to withdraw that consent at any time.

These rights may be exercised by contacting us using the details at the end of this document. We will respond to all requests within one month.

Parents and guardians have the right to access, correct, update or request deletion of their child's personal data. Please note that where a pupil's data is managed through a school subscription, requests may need to be handled in conjunction with the school.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Children and Parental Consent

Children do not register for or directly access the Platform. All pupil data is managed exclusively by teachers and SENCOs.

It is the School's responsibility to ensure that appropriate parental or guardian consent has been obtained before pupil data — particularly SEND data — is entered into the Platform.

Where parents or guardians wish to access, correct or delete their child's data, they should contact the school in the first instance. The school can then liaise with us to action any such request.

Cookies and Tracking Technologies

The Platform uses essential cookies and session data necessary for the Platform to function, such as maintaining login sessions. These cannot be disabled without affecting your ability to use the Platform.

We may also use analytics tools to understand how the Platform is used and to improve its performance. Where any such tools involve cookies that are not strictly necessary, we will seek your consent before placing them. Further information is set out in our Cookie Policy, available on our website.

Updates to This Privacy Policy

We may update this Privacy Policy from time to time in response to changes in law, technology or our business practices. We will provide schools with at least one week's written notice by email before any material changes take effect. The updated Privacy Policy will be published on our website.

You can see when this Privacy Policy was last updated by checking the date at the top of this document.

How to Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or our use of your personal information, please contact us:

If you are not satisfied with our response to any query or complaint, you may also contact the Information Commissioner's Office (ICO):

This document is provided by Hearo Phonics Ltd and does not constitute legal advice. It reflects the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 as at August 2026.

© 2026 Hearo Phonics Ltd. All rights reserved.