Privacy Policy

1. Who we are

Viaduct Industries Limited is the data controller for personal data collected through Spello. We are registered in England and Wales, with our registered office at 3rd Floor, 86–90 Paul Street, London, EC2A 4NE.

You can contact us about any privacy matter at hello@spello.uk.

We are registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration number is ZC122777.

2. Who this policy applies to

This policy applies to:

• Parents and guardians who create and manage accounts on behalf of their children;
• Schools and educational institutions that subscribe to Spello and enrol children; and
• Children who use Spello through an account created for them by a parent or school.

Because Spello is designed for children aged 5 to 11, we apply the highest level of data protection by default across the entire service, regardless of whether a particular user is a child or an adult.

3. What data we collect

3.1 Account holders (parents and schools)

3.2 Children

We do not collect children's full dates of birth, email addresses, phone numbers, photographs, precise location, IP addresses tied to child profiles, or any information about their social connections.

3.3 Technical data

When you use Spello, we may collect limited technical data including browser type, device type, and anonymised usage logs. This data is used only for maintaining and improving the Platform and is not linked to individual child profiles.

4. How we use your data

We do not use personal data for advertising, profiling for commercial purposes, or any purpose beyond those listed above.

5. Legal basis for processing

We do not rely on consent as the basis for processing children's data in the ordinary operation of the Platform, as consent from a child is not considered freely given in this context. Instead, we rely on contract performance and legitimate interests, and apply strict data minimisation throughout.

6. Children's privacy

Spello is designed for primary school children aged 5 to 11. We take our responsibilities under the ICO's Children's Code (Age Appropriate Design Code) seriously and have built the Platform with the following principles in mind:

• High privacy by default. The most privacy-protective settings are applied automatically. No action is required from a parent to protect a child's data.
• Data minimisation. We collect only what is strictly necessary. Children's accounts require only a name, month and year of birth, and a username.
• No child-facing data collection. Children do not create their own accounts, agree to terms, or provide any data themselves. All account setup is done by a parent or school.
• No social features. Children cannot see, interact with, or be seen by other users of the Platform.
• No advertising or commercial profiling. We do not serve adverts to children and do not use their data for any commercial profiling purpose.
• No nudge techniques. The Platform does not use design techniques intended to encourage children to share more data or spend more time on the Platform than is in their best interests.
• Parental visibility. Parents always have access to view and request deletion of their child's data.

Where a school sets up accounts for children, we treat the school as responsible for ensuring appropriate authority exists to enrol those children. We recommend schools maintain their own records of parental consent in line with their data protection obligations.

7. Sharing data with third parties

We do not sell personal data. We share data only with the following processors, who act on our instructions under written data processing agreements:

Where data is transferred outside the UK (Stripe and Cloudflare), we ensure appropriate safeguards are in place in accordance with UK GDPR, including reliance on the UK's International Data Transfer Agreement (IDTA) or Standard Contractual Clauses. Transfers to Brevo and BunnyCDN take place within the EU, which the UK recognises as providing an adequate level of data protection.

We may also disclose data where required to do so by law, or to protect the rights, property, or safety of Viaduct Industries Limited, our users, or others.

8. Optional AI-assisted analysis

Spello includes an optional feature that uses an AI service to provide additional personalised learning guidance based on a child's performance data. This feature is off by default and must be actively enabled by a parent or school.

When this feature is enabled:

• performance data is anonymised before being transmitted to the AI service — no name, username, month/year of birth, or any account identifier is included;
• the AI service uses the data only to generate learning recommendations and does not retain it for its own purposes;
• the AI service will be listed as a data processor in this policy once selected — we will update this policy accordingly; and
• consent can be withdrawn at any time via account settings, after which no further data will be shared.

Spello is fully functional without this feature enabled.

9. Cookies and similar technologies

We use a small number of cookies that are strictly necessary to operate the Platform — for example, to keep you logged in during a session. We do not use advertising cookies, tracking cookies, or any cookies that follow users across other websites.

You can control cookies through your browser settings. Disabling strictly necessary cookies may affect your ability to use the Platform.

10. How long we keep data

You may request early deletion of any data at any time by contacting us at hello@spello.uk. We will action deletion requests within 30 days, subject to any legal obligations that require us to retain certain records.

11. Security

We take the security of personal data seriously, particularly because the Platform is used by children. Our measures include:

• all data transmitted between your device and our servers is encrypted using TLS;
• parent, teacher & staff passwords are stored as secure cryptographic hashes — we cannot read them;
• access to personal data within our systems is restricted to those who need it to operate the Platform;
• our infrastructure is protected by Cloudflare's security and DDoS mitigation services; and
• we conduct regular reviews of our security practices.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO within 72 hours and affected users without undue delay, as required by UK GDPR.

12. Your rights

Under UK GDPR, you have the following rights in relation to personal data we hold about you or your child:

To exercise any of these rights, email us at hello@spello.uk. We will respond within one calendar month. There is no charge for making a request.

If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

13. Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material — for example, if we begin collecting new types of data or share data with a new third party — we will notify account holders by email at least 14 days before the changes take effect.

The current version of this policy is always available at spello.uk/privacy. The date at the top of the page shows when it was last updated.

14. How to contact us

For any questions about this Privacy Policy or how we handle personal data, please get in touch:

• Email: hello@spello.uk
• Post: Viaduct Industries Limited, 3rd Floor, 86–90 Paul Street, London, EC2A 4NE

We aim to respond to all privacy enquiries within 5 business days.