1. Who We Are & Data Controller
LuraPrep (“we”, “our”, “us”) is committed to protecting the privacy and personal data of parents, students, and educators using our platform.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller is the Company operating LuraPrep, as identified in our Terms of Service.
We operate in full compliance with the UK Information Commissioner’s Office (ICO) data protection guidelines and standards. For all data protection inquiries or to exercise your statutory data rights, you can reach our Data Protection team at privacy@luraprep.com.
2. Our Commitment to Children’s Privacy (ICO Children’s Code)
LuraPrep is an educational platform designed for children aged approximately 8–11 preparing for 11+ entrance examinations, used under the direction and supervision of a parent or legal guardian.
In compliance with the ICO Age Appropriate Design Code (Children’s Code) and UK GDPR:
- The Account Holder is Always the Parent or Guardian: Children cannot register accounts directly. Accounts must be created and managed by a parent, legal guardian, or authorized educator aged 18 or older.
- Data Minimisation: We do not require or collect children’s surnames, national identifiers, or physical home addresses. A first name or nickname is sufficient.
- Zero Commercial Profiling: A child’s learning activity, answers, and scores are never used for advertising, never sold, and never shared with third-party advertising networks.
- No Detrimental Nudges: Our daily routines and streaks are structured around spaced repetition learning principles, never to encourage compulsive screen time or addictive usage.
3. What Data We Collect
- Account Details (Parent/Tutor): First name, last name, email address, password (cryptographically hashed using industry standards), and account role.
- Student Profile: First name or nickname, birth year and month (used strictly to calculate accurate Standardised Age Scores / SAS), target grammar or independent schools, and chosen avatar.
- Learning Activity & Diagnostics: Practice questions attempted, answers chosen, response times, topic breakdown, exam scores, mistake vault history, and daily streak activity.
- Payment Identifiers: Subscription tier, billing status, and transaction references provided by Stripe. We do not store credit or debit card numbers on our servers.
- Technical & Security Logs: IP address, browser user-agent, operating system, and login timestamps collected to maintain platform security and protect against unauthorized access.
4. Why We Collect Your Data & Legal Basis
Under the UK GDPR, we process personal data under the following lawful bases:
- Contractual Necessity: To create your account, deliver access to mock papers and learning materials, calculate student progress, and process subscription payments.
- Legitimate Interests: To diagnose topic weak spots, calibrate question difficulty, ensure platform integrity, prevent cheating, and provide parent support.
- Consent: Where you opt in to receive non-essential product updates or revision guides (you may withdraw this consent at any time from your account settings).
- Legal Obligation: Retaining transaction records to comply with UK tax, VAT, and financial accounting laws.
5. Third-Party Service Providers (Subprocessors)
We share data only with trusted third-party technical providers necessary to operate our platform securely. All subprocessors are subject to strict Data Processing Agreements (DPAs):
- Cloud Hosting & Database: Secure European / UK data centers with encryption at rest and in transit.
- Payment Processor: Stripe Payments UK, Ltd. (PCI-DSS Level 1 compliant).
- Transactional Email Delivery: To dispatch verification emails, password resets, and account alerts.
We do not sell, rent, or trade your or your child’s personal data to third parties for marketing purposes under any circumstances.
6. Data Retention & Erasure
We retain account data and student learning metrics for as long as your account remains open and active.
You can request permanent deletion of your account and all associated student learning data at any time by emailing privacy@luraprep.com. Upon receiving your deletion request, all personal data, practice history, and student scores will be permanently and irreversibly erased within 30 days, except where statutory UK financial records must be retained for statutory tax compliance.
7. Cookies & Tracking Technologies
We employ a privacy-first approach to cookies:
- Strictly Necessary Cookies: Essential session tokens and security cookies required to keep you logged in, navigate between tests, and protect account data. The platform cannot operate without these cookies.
- No Student Tracking Cookies: We do not load third-party marketing, behavioral, or advertising trackers across our practice areas, test environments, or student dashboards.
8. Your Rights Under UK GDPR
As a parent, guardian, or user in the United Kingdom, you have the following rights regarding personal data:
- Right of Access: Request a copy of the personal data we hold about you or your child.
- Right to Rectification: Request correction of inaccurate or incomplete records.
- Right to Erasure: Request complete deletion of your account and student data (“right to be forgotten”).
- Right to Restriction & Objection: Ask us to limit processing or object to processing under certain conditions.
- Right to Data Portability: Receive your learning data in a structured, machine-readable format.
- Right to Lodge a Complaint: If you have concerns about our handling of your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by phone at 0303 123 1113.
To exercise any of these rights, please email us at privacy@luraprep.com. We respond to all verified requests within one calendar month.
9. Contact Us
For any questions, requests, or concerns regarding this Privacy Policy or our student data protection practices, please contact our Data Protection team at privacy@luraprep.com.
