Privacy Policy

1. Who we are

Milepost (milepost.fit) is a school staff and student information and management platform provided by Teaching Mr Allen Limited, a company registered in England and Wales (company number 16227056), whose registered office is at Unit 29 Highcroft Industrial Estate, Enterprise Road, Horndean, Waterlooville, PO8 0BT, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO), registration reference ZB987641.

This policy explains how we handle personal data in two different capacities:

• As a Data Controller -- for information about visitors to milepost.fit, people who contact us, and the school administrators who hold accounts with us (their name, work email, and login activity).
• As a Data Processor -- for the staff, student, and pastoral data that a school inputs into Milepost in the course of using the service. That data belongs to, and is controlled by, the school -- we only process it on the school's instructions, under a Data Processing Agreement with that school. If you are a parent, student, or staff member of a school using Milepost and have a question about your own data, please contact that school directly in the first instance -- their own privacy notice governs that data, not this one.

2. What we collect and why (as Controller)

Website visitors and enquiries: when you visit our website or contact us, we may collect your name and email address (if you contact us or request a demo), and technical information such as IP address, browser type, and pages visited, generally via cookies (see section 4). We use this to respond to enquiries, operate and secure the site, and understand how it's used, on the basis of our legitimate interests and, where you've contacted us, taking steps prior to entering into a contract.

School administrator and staff user accounts: for people who use Milepost on behalf of a school, we process name, work email address, role, and login/activity records, in order to provide the service, maintain security, and communicate about the service. Our legal basis is performance of our contract with the school, and our legitimate interests in keeping the service secure and reliable.

3. Data processed on behalf of schools (as Processor)

Depending on which modules a school switches on, Milepost may be used to store staff records (contact details, timetables, duty rosters, availability status) and student records (class/timetable data, pastoral and learning-support notes, assessment and gradebook data). We do not decide why this data is collected or how long it is kept -- the school does, as Data Controller. We process it strictly on the school's documented instructions, under a written Data Processing Agreement, and never use it for our own purposes such as marketing.

4. Cookies

milepost.fit uses cookies that are strictly necessary to keep you signed in and to operate the site securely. Where any non-essential cookies (for example, analytics) are introduced in future, we will provide a consent banner allowing visitors to accept or reject them before they are set.

5. Who we share data with

We use a small number of subprocessors to run the service:

• Supabase, Inc. -- database and file storage hosting (data centre region: AWS ap-southeast-1, Singapore).
• Render Services, Inc. -- application hosting.

Email sent from within Milepost (for example, bulk communications to staff) is sent using the school's own email account credentials, configured by them -- we do not route this through a third-party mailing provider of our own. We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

6. International transfers

Milepost's database and file storage are hosted in Singapore. Where this involves a transfer of personal data outside the UK, we rely on appropriate safeguards recognised under UK GDPR.

7. How long we keep data

Website enquiry data is kept only as long as needed to deal with the enquiry. Account holder data is kept for the duration of the school's contract with us and for a reasonable period afterwards for legal and accounting purposes. Data processed on a school's behalf is kept and deleted in line with the school's own instructions and our Data Processing Agreement with them, and is deleted or returned to the school at the end of the contract.

8. Your rights

Under UK GDPR, you have the right to access the personal data we hold about you, have inaccurate data corrected, ask us to delete data in certain circumstances, restrict or object to certain processing, and receive certain data in a portable format. To exercise these rights over data we control directly, contact us at admin@teachingmrallen.com. If your data is held within a school's Milepost account, please contact the school, as they control that data. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we have not handled your data properly.

9. Security

We use technical and organisational measures appropriate to the sensitivity of the data involved, including access controls, encryption in transit, and role-based permissions within the application.

10. Children's data

Milepost is a staff-facing administrative tool -- it is not intended to be used directly by children. However, it is used by schools to store information about their students, including children. We process that data only as instructed by the school, with particular care given the sensitivity of pastoral and learning-support information, and never for our own purposes such as marketing or profiling.

11. Changes to this policy

We may update this policy from time to time. Material changes will be indicated by an updated “last updated” date at the top of this page.

12. Contact us

Teaching Mr Allen Limited, Unit 29 Highcroft Industrial Estate, Enterprise Road, Horndean, Waterlooville, PO8 0BT, United Kingdom. Email: admin@teachingmrallen.com or support@milepost.fit.