Privacy notice.

1. Who we are

EdPsych Connect Limited is a private limited company registered in England and Wales (Company No. 14989115). We are the data controller for the personal data described in this notice. Contact details are on the contact page.

Our Data Protection Officer is Hannah Ighavongbe-Patrick, appointed on 1 May 2026 under UK GDPR Article 37, reachable at dpo@edpsychconnect.com. EdPsych Connect Limited is registered with the Information Commissioner's Office as a data controller (registration number ZC136984), registered on 30 April 2026 and current until 29 April 2027.

Our registered office is 38 Buckingham View, Alexander Street, Chesham, HP5 3HA. You can verify our ICO registration on the public register at ico.org.uk/ESDWebPages/Entry/ZC136984.

2. What data we currently hold

While the platform is in pre-launch, the only personal data we hold about visitors to edpsychconnect.com is:

• The email address and stated role you submit to the early-access waitlist (parent or carer; young person; educational psychologist; SENCo or Designated Teacher; LA professional; other).
• The timestamp of your signup and the value of your consent checkbox.
• Standard server logs: IP address, user agent, and request path — retained for 14 days for security and abuse monitoring.

We do not collect cookies that identify you. We do not run third-party marketing pixels. We do not share waitlist signups with anyone.

3. Lawful basis

UK GDPR Article 6(1)(a) · explicit consent. The signup form requires you to tick a consent box before your email can be stored. You can withdraw consent at any time by emailing the data-protection address on the contact page; we will erase your record within 7 days.

4. Retention

Waitlist signups are retained until 30 days after public launch (so we can send the launch notification and follow-up questions about onboarding). After that, your record is deleted unless you have signed in to the platform and migrated to a normal account.

5. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you (Article 15).
• Rectify inaccurate data (Article 16).
• Erase your data (Article 17).
• Object to processing (Article 21).
• Lodge a complaint with the Information Commissioner's Office atico.org.uk.

6. International transfers

Your data is hosted in the United Kingdom (Vercel London region lhr1) and a UK-based managed Postgres database. We do not transfer waitlist data outside the United Kingdom or the European Economic Area.

7. Security

The platform enforces TLS in transit, encryption at rest, HSTS with a 2-year max-age, X-Frame-Options DENY, a strict Content Security Policy and HMAC-signed audit logs (B1.12). Special-category processing (planned for the platform proper) is gated by an Article 9(2) decision engine that prints the lawful basis on the practitioner's screen.

8. Changes to this notice

If we materially change how we use your waitlist data we will email you before the change takes effect, giving you a clear opportunity to withdraw consent.