Your Data Rights & UK GDPR Compliance
Full control over your personal data, as it should be
Introduction
At Phoque, we believe you should have full control over your personal data. This page explains your rights under the UK General Data Protection Regulation (UK GDPR) and how to exercise them. Phoque is operated from the United Kingdom and is currently aimed at UK-resident learners; we do not actively target users in the European Economic Area.
We've designed Phoque with privacy at its core — not as an afterthought.
Your Rights Under UK GDPR
UK GDPR gives you powerful rights over your personal data. Here's what they mean in plain English:
1. Right of AccessArticle 15
You can request a copy of all personal data we hold about you.
What you'll receive:
- Account information (name, email, preferences)
- Learning data (lesson history, progress, mastery levels)
- Learning DNA profile
- Any voice recordings (if used)
- Parent dashboard data
- Technical data we hold
We'll provide your data in a commonly used, machine-readable format (JSON or CSV).
How to request:
- • Email: privacy@phoque.ai
2. Right to RectificationArticle 16
You can ask us to correct inaccurate personal data or complete incomplete data.
Examples:
- Correcting a misspelled name
- Updating your email address
- Fixing an incorrect date of birth
How to request:
- • In-app: Settings → Profile → Edit (for most data)
- • Email: privacy@phoque.ai for data you cannot edit yourself
3. Right to ErasureArticle 17
You can ask us to delete your personal data in certain circumstances.
When it applies:
- You withdraw consent
- Data is no longer necessary
- You object to processing
- Data was unlawfully processed
- Legal obligation requires deletion
What we'll delete:
- • Account information
- • All learning data and progress
- • Learning DNA profile
- • Voice recordings
- • Parent dashboard data
What we may retain:
- • Anonymised, aggregated data
- • Data required for legal obligations
- • Data necessary for legal claims
How to request:
- • Email: privacy@phoque.ai
4. Right to RestrictionArticle 18
You can ask us to limit how we use your data while we address a concern.
When it applies:
- You contest the accuracy of your data
- Processing is unlawful but you prefer restriction over deletion
- We no longer need the data, but you need it for legal claims
- You've objected to processing
How to request:
- • Email: privacy@phoque.ai with subject "Restriction Request"
5. Right to Data PortabilityArticle 20
You can receive your data in a portable format and, where technically feasible, have it transferred to another service.
What you'll receive:
- Structured, commonly used, machine-readable format (JSON/CSV)
- Data you provided to us
- Data generated through your use of the Service
How to request:
- • Email: privacy@phoque.ai
6. Right to ObjectArticle 21
You can object to certain types of processing.
Details:
- You can object to processing based on "legitimate interests"
- You have an absolute right to object to direct marketing
- We will stop immediately upon request
- You can also unsubscribe via the link in any marketing email
How to request:
- • Email: privacy@phoque.ai with subject "Objection to Processing"
7. Automated Decision-MakingArticle 22
You have rights regarding decisions made solely by automated means.
How Phoque uses automation:
- Adaptive difficulty adjustment (affects lesson experience, not significant legal effects)
- Grade predictions (informational only, not used for official purposes)
- Learning path recommendations (educational guidance only)
Our approach:
- No decisions with legal or similarly significant effects are made solely by automation
- You can always contact us for human review of any automated output
- Grade predictions are clearly labelled as estimates, not guarantees
How to request:
- • Email: privacy@phoque.ai to request human review
How to Submit a Request
Option 1: Email
- 1.Email privacy@phoque.ai
- 2.Include the request type
- 3.We will confirm identity before action
Access/Portability (export)
Erasure (delete eligible personal data)
Rectification (correct inaccurate data)
Option 2: Email
Send your request to: privacy@phoque.ai
Please include:
- • Your full name
- • Email address on your account
- • The specific right you're exercising
- • Any relevant details
Option 3: Post
Data Protection
TalentOptima Ltd (#15923883)
2nd Floor, College House
17 King Edwards Road
Ruislip, London HA4 7AE
United Kingdom
Identity Verification
We may ask for verification to confirm your identity before processing requests. This protects your data from unauthorised access.
Response Times
| Request Type | Response Time |
|---|---|
| Access | One calendar month (may extend by 2 months if complex) |
| Rectification | One calendar month |
| Erasure | Live stores within 72 hours; backup purge timing is not yet evidenced |
| Restriction | One calendar month |
| Portability | One calendar month |
| Objection | One calendar month |
We aim to respond faster where possible. If we need more time (up to two additional months for complex requests), we'll tell you why within the first month. The clock starts when we receive your complete request.
Children's Data Rights
Parents/guardians can exercise all rights on behalf of their children.
If your child is under 18, you have full access to:
- View all their learning data via the Parent Dashboard
- Request access, correction, or deletion of their data
- Manage their privacy settings
Students aged 16-17 may contact us directly regarding their data rights, and we will consider requests on a case-by-case basis in accordance with their capacity and best interests.
How We Comply with GDPR
Beyond respecting your rights, here's how we've built GDPR compliance into Phoque:
Privacy by Design
- Data minimisation: We only collect what we need
- Purpose limitation: Data is used only for stated purposes
- Storage limitation: We don't keep data longer than necessary
- Security: Encryption, access controls, regular audits
Security Measures
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Regular security audits and penetration testing
- Access controls based on least privilege
- Staff training on data protection
- Incident response procedures
International Transfers
When data is transferred outside the UK/EU, we use appropriate safeguards:
- UK-US Data Bridge (for certified US providers)
- UK International Data Transfer Agreement (IDTA)
- EU SCCs + UK Addendum
- Transfer Impact Assessments
Breach Notification
If a data breach occurs:
- We'll notify the ICO within 72 hours (if required)
- We'll notify affected users without undue delay (if high risk)
- We'll document all breaches and our response
Lawful Basis for Processing
We document our lawful basis for every type of processing:
| Processing Activity | Lawful Basis |
|---|---|
| Providing lessons | Contract |
| Personalisation | Legitimate interest |
| Parent reports | Contract |
| Grade predictions | Legitimate interest |
| Marketing emails | Consent |
| Service improvement | Legitimate interest |
| Legal compliance | Legal obligation |
Complaints
Internal Complaints
If you're unhappy with how we've handled your data or a request, please contact us first:
Email: privacy@phoque.ai
Subject: “Complaint”
We take complaints seriously and will investigate and respond within 30 days.
Complaints to the Regulator
You have the right to lodge a complaint with the UK's supervisory authority:
Information Commissioner's Office (ICO)
Frequently Asked Questions
Q: Does Phoque sell my data?
A: No. We never sell personal data to third parties.
Q: Is my child's data used for advertising?
A: No. We never use children's data for advertising purposes.
Q: Can I see exactly what data you have about my child?
A: Yes. Email privacy@phoque.ai for a full export.
Q: How long do you keep data after I cancel?
A: Active data is retained for 2 years after cancellation (in case you return). You can request immediate deletion at any time.
Q: What happens to my data if Phoque is acquired?
A: You would be notified before any transfer and given choices about your data.
Q: Is data transferred outside the UK?
A: Some processing occurs in the EU and USA. For US transfers, we use the UK-US Data Bridge or IDTA + UK Addendum. Your data receives equivalent protection wherever it goes.
Q: Can I opt out of AI personalisation?
A: You can object to processing based on legitimate interests. However, AI personalisation is core to our service—opting out would significantly limit functionality.
Contact Our Privacy Team
Email: privacy@phoque.ai
Response time: 2-3 business days for general enquiries
Data Protection Contact:
TalentOptima Ltd (#15923883)
2nd Floor, College House, 17 King Edwards Road
Ruislip, London HA4 7AE, United Kingdom
We're committed to your privacy. If anything on this page is unclear, please ask—we're happy to explain.