Privacy Notice

1. Who We Are

This website (limitbreakers.co.uk) and the AcademicTrack progress dashboard are owned and operated by Limit Breakers Tutoring UK Ltd, registered in England and Wales under company number 12592302, with registered office at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.

Data Protection Officer: privacy@limitbreakers.co.uk

2. What Data We Collect

Your contact details: your name and email address.
Your child's details: name, initials, year group and, if you choose, gender.
What you tell us when you register: the exam and when it will be sat, any current tutor, how you heard about us and why you are joining. If you choose to answer them: your child's sport, how they handle setbacks, and any notes.
Learning records: enrolment, attendance, assessment scores and practice quiz results.
Your choices: whether you want emails about extra support, courses and bootcamps, whether you asked for feedback surveys (with the wording you were shown and when you answered), and your cookie choices.
Messages you send us through our contact form.

We do not collect dates of birth, home addresses, health information, or special category data (Art. 9 UK GDPR).

3. How We Use Your Data

Purpose	Legal Basis
Delivering the tutoring programme and tracking student progress	performance of a contract
Generating personalised AI progress notes via AcademicTrack by sending our AI provider, Anthropic, the student's pronoun and their scores and progress data to write tutor notes. We do not send the student's name or any other detail that identifies them.	performance of a contract
Sharing progress with the assigned tutor	performance of a contract
Sending transactional emails (login links, report notifications)	performance of a contract
Emailing parents about extra support, courses and bootcamps from Limit Breakers. We send these to parents only, never to students.	Consent. We only send them if you have agreed, when you registered or later in your account settings.
Answering enquiries you send through our contact form	legitimate interests
Sending feedback surveys about the programme, only to parents who ticked the feedback-surveys box	legitimate interests
Asking how your child's exam went, so we can understand and improve our results. Families who have left the programme are asked for one exam season only.	legitimate interests
Programme improvement and internal research using aggregated, non-identifiable data	legitimate interests
Sharing aggregate results (no individual data) with partner schools, churches, or community organisations	legitimate interests

We do not use your data for advertising. We use automated tools on your child's scores to suggest weekly focus topics, estimate how ready they are for each exam board, and write the AI tutor notes. The law calls this profiling. Your answers about sport and setbacks are never sent to our AI provider. No decision with a legal or similarly significant effect is made by a computer alone, and you can ask us about any of these results (see Section 14).

4. How We Get Your Consent

We only send you emails about other Limit Breakers courses and extra support if you have agreed to receive them, either when you registered or later in your account settings. You can stop them at any time using the unsubscribe link in every such email or your Email preferences setting. We will still send service emails about your child's programme (log-ins, progress reports, changes to sessions) while your child is enrolled.

5. Your Rights Under UK GDPR

To exercise any right, contact us (see Section 14). We will respond without undue delay and within one month.

Right of access: request a copy of all data held about your child
Right to rectification: correct inaccurate data
Right to erasure: request permanent deletion
Right to restriction: limit processing while a dispute is resolved
Right to portability: receive data in machine-readable format
Right to object to processing based on legitimate interests
Right to object to direct marketing at any time: if you do, we stop
Withdraw consent at any time without affecting other services

6. Data Retention

We keep your child's account and progress data while they are enrolled and for 12 months after enrolment ends. If an account is never enrolled, or is not used for 12 months, we delete it 12 months after it was last used. You can ask us to delete it sooner at any time. We may keep anonymised statistics, such as how many children answered a question correctly, which cannot identify your child; these are not personal data and are kept after your child's data is deleted.
Parent account data (email, gender preference): same as above
GDPR audit log records: retained for a period sufficient to meet our legal obligations
Consent log records: retained for a period sufficient to demonstrate compliance
Transactional email logs: retained for a short period for delivery and support purposes

You may request earlier deletion at any time — see Section 5.

7. Children's Privacy

All students are minors. Parental or guardian consent is required in accordance with UK GDPR Article 8 and the Data Protection Act 2018 s.9. Our platform operates across two surfaces with distinct access models: parents log in to AcademicTrack to view their child's progress reports; students access learning content and quizzes on Thinkific using the parent's account credentials — students do not have a separate Thinkific account. Formal assessments are accessed by students via a link within Thinkific that directs them to Brillium; no separate Brillium login or account is created. By registering and logging in to AcademicTrack, parents confirm they are the child's parent or legal guardian and that they consent to their child accessing Thinkific and Brillium under the parent's account.

Student data is only visible to the child's parent or guardian and their assigned tutor. Gender data is used solely to choose the pronoun in AI-generated reports. To write those reports we send our AI provider, Anthropic, the student's pronoun and their scores and progress data. We do not send the student's name or any other detail that identifies them. Gender data is not shared with any other third party. Parents may update or delete this preference at any time by contacting us (see Section 14).

If you believe we have collected data from a child without proper consent, contact us immediately (see Section 14).

8. Sharing Your Data

a) Technology Providers

Thinkific Labs Inc. — learning management platform (Canada). Holds the parent's account credentials (email address and password) and the student's quiz scores, course progress, and completion data. Students access Thinkific using the parent's account; no separate student account is created. Data Processing Agreement in place. thinkific.com/privacy-policy
Brillium LLC — assessment platform (USA). Students access Brillium via a link from within Thinkific; no separate Brillium account or login is created. Brillium receives the student's name and assessment responses for marking purposes and returns scored results to AcademicTrack. Data processor under contract. brillium.com/privacy-policy
Neon Inc. — database hosting. Data Processing Agreement in place. neon.tech/privacy-policy
Vercel Inc. — application hosting. Data Processing Agreement in place. vercel.com/legal/privacy-policy
Anthropic PBC — AI progress report generation. To write tutor notes we send our AI provider, Anthropic, the student's pronoun and their scores and progress data. We do not send the student's name or any other detail that identifies them. No email addresses or sensitive data. Data Processing Agreement in place. anthropic.com/privacy
Resend Inc. — transactional email delivery. Email address only. resend.com/legal/privacy-policy
Formspree Inc. — delivers messages sent through the contact form on our website (USA). formspree.io/legal/privacy-policy
CookieYes Limited — records your cookie choices. cookieyes.com/privacy-policy

b) Payment Providers

Stripe and PayPal — PCI-DSS compliant. No payment data stored by Limit Breakers.

c) Education Stakeholders

Assigned tutors — student progress data for support delivery
Partner schools, churches, or community organisations — aggregate results only, no individual data

d) Legal and Regulatory

ICO — as required by law

We do not sell, rent, or share personal data with any other parties.

We do not sell personal data. We will never sell, rent, or trade your personal data to any third party, including advertisers or data brokers, now or in the future.

9. International Data Transfers

Some data is processed outside the UK (Thinkific in Canada, Brillium, Anthropic and Formspree in the USA, Stripe and PayPal globally). We ensure adequate safeguards are in place for all international transfers through Data Processing Agreements.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, in accordance with UK GDPR Article 32. These include encryption of data in transit and at rest, access controls ensuring each parent can only view their own child's data, secure session management, privacy-by-design principles (Art. 25), and consent and audit logging for data rights actions. Further details of our security measures are available to the ICO and relevant regulators on request.

11. Cookies and Tracking Technologies

We use cookies to enable secure logins and to remember your preferences, including your cookie choices. We do not set analytics or advertising cookies ourselves. Videos on our free resources page are embedded from YouTube, which may set its own cookies when a video loads. See our full Cookie Policy at limitbreakers.co.uk/cookie-policy.

12. Links to Other Sites

Our platform may link to external sites. We are not responsible for their privacy practices.

13. Changes to This Notice

We may update this policy to reflect changes in technology, services, or legal requirements. The latest version will always be posted on our site.

If our organisation changes structure, transfers its operations, or becomes part of another organisation, we will ensure your personal data continues to be protected under equivalent standards. We will notify you of any material changes that affect how your data is used.