Privacy policy

Butter Technologies Ltd, registered in England and Wales, company number TBC, registered office TBC.

We are the controller for the personal data described here.

The route for anything on this page is dpo@butter.school. We have not appointed a Data Protection Officer under Article 37 of the UK GDPR and we are not required to. The address is a route to a person, not a statutory office, and we would rather say so than let the name imply otherwise.

It does not cover what happens to a student's or a member of staff's data inside the Butter product.

When a school uses Butter, the school is the controller and we are its processor. What we may do with that data is set by the data processing agreement we sign with the school, not by this page. Those are separate documents and the school holds them. The data position

When you email us. Whatever you put in the message, and the address you sent it from.

When you read a page. The site is served through Cloudflare, which records the technical detail needed to deliver and protect a website: the IP address the request came from, the time, the page requested, and information about the browser and device. An IP address is personal data, so we say so here rather than describe this as anonymous.

We use no analytics that identify a reader and we set no cookies of our own. The cookie statement sets out the full position.

To reply to you, where you have contacted us. Our lawful basis is legitimate interests, Article 6(1)(f) UK GDPR, and the interest is answering a business enquiry from someone who asked us to. We use what you send to reply and for nothing else. We do not add you to a mailing list, we do not pass you to a salesperson, and we do not build a profile of you.

To run the site securely, where the data is technical. The basis is again Article 6(1)(f), and the interest is keeping a website online and defended against attack.

We do not ask for special category data through this site and an email to us is not the place to send it. Where a school needs to raise something involving a child, the route is safeguarding@butter.school.

No. There is no statutory or contractual requirement to write to us. Without a name and an email address we cannot reply, which is the only consequence.

Two providers process this data on our behalf, each under written terms:

We do not sell personal data, we do not share it for advertising, and we disclose it to no one else except where the law requires it.

Our own working copy of an enquiry sits in our Google Workspace mailbox.

These providers operate internationally, and the technical data in particular may be processed outside the United Kingdom. Where that happens the transfer is covered by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses.

We do not claim that everything stays in the United Kingdom, because for a site served by a global content delivery network that would not be true.

Enquiries: two years after our last contact with you, then deleted. Where the conversation turns into a school using Butter, the records belonging to that relationship are governed by the agreement with the school instead.

Technical data stays in Cloudflare's logs for the period Cloudflare operates and is not copied into any record of ours.

You can ask us to delete an enquiry earlier, and we will.

The site is served over HTTPS with HSTS and a content security policy. Access to the mailbox is limited to the people who need it. We will report a personal data breach to the Information Commissioner where the law requires it, and tell you where the law requires that too.

You have the right to:

• be told what we hold about you and to have a copy of it (access);
• have it corrected if it is wrong (rectification);
• have it deleted (erasure);
• have us stop using it while a question about it is resolved (restriction);
• object to us using it, which for everything on this page means we stop unless we can show a compelling reason not to.

Data portability does not apply here. It is a right that attaches to data processed on consent or under a contract, and everything on this page rests on legitimate interests. We say so rather than list a right you do not have.

Nothing on this site involves automated decision-making or profiling.

Write to dpo@butter.school. We will acknowledge a complaint about how we have handled your data within 30 days, as sections 164A and 164B of the Data Protection Act 2018 require.

You can complain to the Information Commissioner's Office at any point, whether or not you have come to us first. ico.org.uk/make-a-complaint, or 0303 123 1113.

When this policy changes, the version number and the date at the top change with it, and we say what changed. We will not add something that collects more about you and describe it afterwards.