Privacy Policy

How we collect, use, and protect your personal data

Last updated: September 2026
Note: This is a living document. As EduRisk develops, we will expand this policy to provide comprehensive detail on all data processing activities.

1. Who We Are

EduRisk is a product of CX1 Ltd, a company registered in the United Kingdom.

For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), CX1 Ltd is the data controller for personal data collected through the EduRisk marketing website.

2. What Data We Collect

Marketing Website (edurisk.uk)

When you visit our marketing website or contact us, we may collect:

  • Contact form submissions: Name, email address, organisation, role, and message content when you enquire about EduRisk
  • Email correspondence: When you email us at hello@edurisk.uk
  • Technical data: IP address, browser type, and pages visited (via standard server logs)

EduRisk Application

When your school or trust uses EduRisk, we process data as a data processor on your behalf. Your organisation remains the data controller for that data. Processing is governed by our Data Processing Agreement.

3. How We Use Your Data

We use personal data collected through the marketing website to:

  • Respond to your enquiries and provide information about EduRisk
  • Arrange demonstrations and pilot programmes
  • Maintain records of our communications
  • Improve our website and services

Legal basis: Legitimate interests (responding to enquiries, improving services) and, where applicable, your consent.

4. Data Sharing

We do not sell your personal data. We may share data with:

  • Service providers: Hosting and infrastructure providers (AWS, UK region) who process data on our behalf under appropriate agreements
  • Professional advisors: Where required for legal or accounting purposes
  • Legal requirements: Where required by law or to protect our rights

5. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption in transit (HTTPS/TLS)
  • Encryption at rest
  • Access controls and authentication
  • UK-based hosting (AWS London region)

For more detail on our security practices, see our Data Security page.

6. Your Rights

Under UK GDPR, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data (subject to legal retention requirements)
  • Restriction: Request restriction of processing
  • Portability: Receive your data in a portable format
  • Object: Object to processing based on legitimate interests

To exercise these rights, contact us at hello@edurisk.uk.

7. Data Retention

We retain personal data only as long as necessary for the purposes described above, or as required by law. Contact form submissions and email correspondence are typically retained for the duration of our business relationship plus a reasonable period thereafter.

8. Cookies

The EduRisk marketing website currently uses only essential technical cookies required for the website to function. We do not use tracking or advertising cookies.

9. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via our website. The "Last updated" date at the top indicates when the policy was last revised.

10. Complaints

If you have concerns about how we handle your personal data, please contact us first at hello@edurisk.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Contact Us

For any privacy-related questions or to exercise your data protection rights:

Email: hello@edurisk.uk

Questions About Our Privacy Practices?

We're committed to transparency. Get in touch if you have any questions.

Contact Us