Privacy Policy

River Learning Trust takes the privacy of the users of this website and the protection of their personal data very seriously. River Learning Trust is a Multi-Academy Trust based in the United Kingdom and acts as the "Data Controller" for the personal data collected via this website.

Please read the following to learn more about how we process your personal data in compliance with the UK GDPR and the Data Protection Act 2018.

1. Lawful Basis for Processing

Under the UK GDPR, we rely on the following specific lawful bases to process your website data:

• Consent (Article 6(1)(a)): Where you choose to accept optional performance and analytics cookies (such as Google Analytics) to help us measure and improve website performance.
• Legitimate Interests (Article 6(1)(f)): We have a legitimate financial and operational interest in understanding how our website is used so we can develop relevant features, improve tools, and maintain network security. Specifically, we process data to:
• Track and authenticate users logging into the website.
• Monitor technical logs to maintain system security and prevent unauthorised access.
• Analyse internal, aggregate website usage statistics to see how often certain tools and pages are accessed.
• Public Task (Article 6(1)(e)): Where website portal usage is required to fulfill our official educational duties and administrative functions as a school trust.

Special Category Data

We do not collect or process "Special Category Data" (such as health, ethnicity, religious beliefs, or voice/biometric data) through this website.

2. Information Collection and Use

Mandatory vs. Voluntary Information

Currently, all data collected through your interaction with the website is mandatory for operational, security, and authentication purposes. This includes:

• Authentication and Access Logs: Your name, email address, and timestamp when you log in to our services.
• Technical Logs: Your IP address and requested pages.

You can also voluntarily choose whether to allow optional analytics cookies. If you consent, we use Google Analytics to collect information about how visitors use our site (e.g., pages visited, time spent on the site, and approximate location based on truncated IP addresses). We use this information to compile reports and help us improve the website. Google Analytics collects information anonymously.

3. Data Infrastructure & Third-Party Sharing

Your personal data is handled under strict confidentiality. We do not rent, sell, or share personal information about you with external companies, marketing agencies, or third parties.

All website data, user logs, and technical metrics are hosted, processed, and stored entirely within River Learning Trust’s secure, enterprise-grade Google Cloud infrastructure tenancy, with all data storage physically located on secure servers within the United Kingdom. Google acts strictly as a data processor on our behalf under our data processing agreements. Your data remains completely isolated within our trust environment and is never used to train public AI models.

For website optimisation, we also share pseudonymised website usage data with Google Analytics. While our main data infrastructure is UK-based, Google Analytics data may be processed on a global network. We ensure appropriate safeguards (such as Standard Contractual Clauses) are in place to protect this data in accordance with UK data protection laws.

We will only disclose your data outside this environment if required to do so by law, regulation, or a valid order from law enforcement or a regulatory authority.

4. AI Safeguards & Human Evaluation

The platform utilises an enterprise-grade LLM to summarise open-text comments into high-level themes. All text transmitted to the LLM is completely ring-fenced within River Learning Trust’s secure, enterprise-grade Google Cloud infrastructure tenancy. Your data remains completely private and is never used to train public models.

This is strictly an assistive tool for human interpretation. We explicitly prohibit the use of automated systems or artificial intelligence to make individual, automated decisions or profiling that carries legal or significant effects for our users. All data analysis, feature development reviews, and system management decisions are performed exclusively by human administrators.

5. Data Retention

We hold your personal data securely and only for as long as necessary to fulfill the operational security and analysis purposes outlined in this policy.

• Website and Security Logs: Access logs, login details, and associated IP addresses are retained for a maximum period of 37 months to monitor security trends, troubleshoot technical issues, and evaluate feature updates.
• Analytics Data: Google Analytics data is retained in accordance with our analytics configuration (typically up to 37 months) before being automatically deleted.
• Anonymisation: After this retention window, data is either permanently deleted or fully anonymised (removing all identifiable information such as names and IP addresses) so that it can only be used as aggregate, historical trend data.

6. Your Data Subject Rights

Under UK data protection legislation, you have the following rights regarding your personal data:

• Right of Access: You can request copies of your personal data held by us (Subject Access Request).
• Right to Rectification: You can ask us to correct any of your personal data we hold that you think is inaccurate or incomplete.
• Right to Erasure: You can ask us to erase your personal data under certain legal circumstances.
• Right to Restriction or Objection: You have the right to object to or request that we restrict our processing of your data based on our legitimate interests.

To exercise any of these statutory rights, please contact our Data Protection Officer using the details below.

7. Privacy Support, Contact Information & Complaints

If you have questions, suggestions, or wish to make a data rights request, please contact our Data Protection Officer (DPO):

• Data Protection Officer: Louise Askew
• Email contact: office@riverlearningtrust.org
• Address: River Learning Trust Central Office C/O Rose Hill Primary School, The Oval, Oxford OX4 4SF

If you remain unsatisfied with our response or how we handle your data, you have the right to lodge a formal complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

• Website: https://ico.org.uk
• Helpline: 0303 123 1113