Privacy Policy
This policy explains how we collect, use, and protect your personal data.
Our commitments
- We will never sell your personal data
- We will never share your personal data, unless you give us permission or the law allows or requires us to do so
- We may use anonymised data for research or insights for the benefit of the education sector
- We will always be transparent about how we use your data, and give you control over how it is used
- We will always communicate in plain English so that your choices are clear
- We have systems in place to ensure your personal data is stored securely
- We keep any personal data separate from any anonymised data
- We only collect the personal data we need to provide our service or make it better for you
- We only keep your personal data for as long as it is needed or as long as we are required by law
- We’re always mindful that many of our users are children and we add specific protections for any data received
1. Introduction
Oak National Academy Limited is committed to protecting and preserving the privacy of visitors to our website and other people with whom we communicate electronically (for example, by email). When we refer to "you" or "your" in this policy, we are referring to you as an individual visiting our website or communicating with us electronically. We refer to Oak National Academy Limited as “Oak”, "we", "our" or "us".
Under data protection law, individuals have a right to be informed about how we use any personal information (sometimes referred to as personal data), which we hold about them. We comply with this right by providing this privacy policy. This policy applies to our website (referred to as our website) at www.aibookslibrary.com.
We have separate privacy notices for our employees, volunteers, external contractors and suppliers and for our recruitment process.
It is important that you read this privacy policy, together with any other information we may provide on specific occasions (for example, if you are participating in a research project with us or entering a prize draw) when we are collecting or processing personal information about you, so that you are aware of how and why we are using any information provided to us.
- DPO Name: Jayne Taylor
- Name: Oak National Academy Limited
- Address: PO Box 520, Newcastle upon Tyne, NE3 9GW
- E-mail: dpo@thenational.academy
2. Data protection principles
We will comply with data protection law. This says that the personal information we hold about you must be:
- Used lawfully, fairly and in a transparent way;
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
- Relevant to the purposes we have told you about and limited only to those purposes;
- Accurate and kept up to date;
- Kept only as long as necessary for the purposes we have told you about;
- Kept securely.
3. Information we hold about you, what we do with it and our basis for doing so
The information below explains the various ways in which we collect, store and use (referred to as process) your personal information, the ways in which we use it and our legal basis for this.
We only process your personal information where the law allows us to.
Where we invite you to provide information about yourself, it is entirely up to you whether you provide us with that information or not. Often, however, we will not be able to do something that you are asking for, if you do not provide that information (for example, if you do not provide your email address, we would be unable to complete your request to receive our e-newsletter).
If we are relying on your consent as our legal basis for processing your personal information, you may withdraw your consent at any time. We will make this clear when we ask for consent and explain how it can be withdrawn.
The personal information we process about you is not normally classed as special category data. This includes any information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, health, genetic or biometric data. If we do hold any such data about you, we will inform you.
Information collected automatically by our website
We do not seek to identify you from this information or do anything which will affect you. To the extent practicable, we aggregate and/or remove anything which could be used to identify you from this information before we use it, including (where possible) minimising the storage of Internal Protocol (IP) addresses.
The information we collect includes:
- The IP address from which you access our website;
- Information about the device used to access the website (including the number of pupils using it);
- Your approximate location;
- Your school;
- The pages you click on our website, including the lessons that you view (and therefore your likely year group);
- The time you spend on our website, including the time you spend viewing videos;
- The resources you download.
In addition, our website uses cookies and webs beacons — please see our Cookie Policy for full details. We use this information to improve our website, including all of the lessons and resources available to you. Our legal basis for processing this information is our legitimate interest.
Information you input via our website
Some pages on our website invite you to provide information about yourself — for example, if you sign up to receive an e-newsletter or provide feedback through a survey.
The information collected is usually:
- Your name
- Your email address
- If you create an account with us, we will also collect your IP address.
If you are a teacher, we may also ask you to provide:
- Your school name and URN;
- Your school contact email address
We use this information to provide services (such as email updates), understand usage, improve resources, ensure our educational content reaches the intended audience, and invite feedback. Our legal basis is your consent.
Information you send us by email or other electronic means
This could be by email or through one of our social media channels (Facebook, X (formerly Twitter), LinkedIn, Instagram, Threads).
- Your name
- Contact details
- Information you include in your communication with us
We collect this information to communicate with you, respond to queries, and manage our relationship with you. Our legal basis is your consent.
Information collected when you create an account
Access to specific features is restricted to users who create an account. When you create an account, we collect your name, email address, and country code (e.g. GB). We may also collect whether or not you are a teacher. Our legal basis is your consent.
Teacher area
Our “Teacher Notes” feature allows you to make notes and share these with colleagues. Teacher Notes that you create and share are stored anonymously. We do not actively moderate or remove identifying information from these notes, so you must ensure your notes do not include personal or sensitive information that could identify an individual (including pupils). Our legal basis is your consent.
Pupil area
If you complete a quiz in the Pupil area, your answers, marks, and total scores are collected and stored anonymously. We do not actively remove identifying information from quiz responses. Please ensure your answers do not contain personal or sensitive information. We collect this information to drive motivation and improve lesson content. Our legal basis is our legitimate interest.
Feedback tool
We use a third-party tool (hosted by Gleap and Hubspot) that allows users to make enquiries, provide feedback, and report technical bugs.
Information we collect may include:
- Your name (if you provide it)
- Email address
- Approximate geo-location
- Operating system, browser info, screen size
- URL visited, screenshot data
- Session replay data (for bug issues and lesson concern types only)
We use this information to respond to enquiries and improve resources. Our legal basis is your consent.
Help Centre
Hosted by Hubspot. We collect name (if provided), email address, and information you include in communications. We use this to improve support content and respond to issues. Our legal basis is your consent.
AI tool
When you use our tools, we collect your interactions with the user interface, your inputs, and outputs generated from your inputs. Cookies and web beacons may also be used (see Cookie Policy). We use this to provide access, contact you about your account, and develop and improve our services. Our legal basis is your consent.
OpenAPI site
When you request an API key, we collect your name, email address, and company name. When you use your key, we may collect logs of requests, interactions, IP address, approximate geo-location, operating system, and browser information. Our legal basis is your consent.
4. Storing your personal information
We use systems and processes to prevent unauthorised access or disclosure. We use encrypted drives, limit access, keep records of access and modification, and manage devices with access to our systems.
- Account information: retained for 2 years from your last logged-in use (with deletion notifications 3 months and 1 month before).
- Visits to our website: retained for up to 5 years after the start of each session.
- E-newsletter subscriptions: retained for 5 years after you unsubscribe (or we stop sending).
- Emails and other communications: retained for 5 years after sent/received.
- Feedback Tool data: retained for 12 months.
5. Sharing your personal information
We will not sell, rent, use or share your personal information to any third party for marketing purposes (other than sending our e-newsletter with your consent), unless the law, our policies or this privacy policy allow it.
Your personal information may be shared with third-party service providers who host and process information on our behalf, including:
- Calendly, Clerk, Condens, Gleap, Hubspot, Incycle, Lakera Guard, PostHog, Postmark, Zapier
We may share aggregated and anonymised data for research, and may share personal information to protect legal rights and comply with legal obligations, including cooperation with law enforcement and safeguarding agencies where required.
6. International transfers
Some services we use are based outside the UK and the EEA. We only use these where we are satisfied with their levels of security and we will put contractual safeguards in place. Personal information may be transferred, stored, or processed outside the UK and the EEA.
7. Your rights
Under certain circumstances, you have rights in respect of your personal information, including:
- Request access to your personal information;
- Request correction of your personal information;
- Request erasure of your personal information;
- Object to processing (including direct marketing);
- Request restriction of processing;
- Request transfer of your personal information to another party.
To exercise these rights, contact our DPO. You will not usually have to pay a fee, but we may charge a reasonable fee where a request is clearly unfounded or excessive. We may request information to confirm your identity.
Where you have provided consent, you may withdraw it at any time by contacting the DPO. We will then stop processing for that purpose unless we have another lawful basis.
8. Complaints
If you have concerns, contact our DPO first. We aim to respond within 20 working days. If you remain unhappy, you can complain to the ICO:
- Report a concern online (ICO website)
- Call 0303 123 1113
- Write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
9. Changes to this privacy policy
This privacy policy is reviewed regularly, at least annually. We reserve the right to update it at any time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.