Data Controller Information
🏢 Company
WhimsyLabs Ltd
Edinburgh, United Kingdom
📋 ICO Registration
Registration with the UK Information Commissioner's Office is pending. Reference number will be published here upon completion.
📄 Data Processing Agreement
Schools and institutions can request our standard DPA for procurement and compliance purposes.
📄 Download DPA (PDF)🎓 Student Data Privacy Commitment
"We believe student data belongs to students and their schools, never to us. Our platform is designed from the ground up to protect learner privacy."
Our Student Privacy Principles
- Data Minimisation: We collect only what's necessary for educational purposes
- Purpose Limitation: Student data is used exclusively for learning and assessment
- No Advertising: We never use student data for advertising or marketing
- No Data Sales: Student data is never sold, rented, or traded to third parties
- School Control: Schools retain full control over their students' data
🛡️ COPPA Compliance (Under-13 Users)
WhimsyLabs fully complies with the Children's Online Privacy Protection Act for users under 13:
- We require verifiable parental or school consent before collecting data from children under 13
- We collect only the minimum data necessary for educational purposes
- We never use children's data for marketing, advertising, or profiling
- Parents can review and download their children's data; deletion requests are processed in accordance with school data retention policies
- Data is automatically deleted when no longer needed for educational purposes
🗑️ School Data Deletion Requests
Schools can request complete deletion of their institution's data at any time. Here's our process:
Submit Request
Email [email protected] with your institution details and deletion request
Verification
We verify the request comes from an authorised administrator (within 2 business days)
Data Export (Optional)
We can provide a complete data export before deletion if requested
Complete Deletion
All student data, learning records, and account information permanently deleted within 30 days
To request data deletion: [email protected]
1. Information We Collect
1.1 Information You Provide
When you use WhimsyLabs virtual laboratory software, we may collect information that you voluntarily provide, including:
- Account Information: Name, email address, school/institution affiliation
- Educational Data: Lab experiment results, assessment scores, learning progress
- Communication Data: Messages sent through our support system or contact forms
- Feedback Data: Survey responses, feature requests, and user feedback
1.2 Automatically Collected Information
We automatically collect certain technical information to improve our service:
- Usage Data: Time spent in virtual labs, experiments completed, interaction patterns
- Technical Data: Device type, browser information, IP address, operating system
- Performance Data: Load times, error logs, system performance metrics
2. How We Use Your Information
We use the collected information for the following purposes:
2.1 Educational Services
- Provide access to virtual laboratory experiments and simulations
- Generate AI-powered feedback and assessments
- Track learning progress and provide personalised recommendations
- Enable teachers to monitor student performance and provide support
2.2 Service Improvement
- Analyse usage patterns to improve our virtual lab platform
- Develop new features and experiments based on user needs
- Optimise performance and fix technical issues
- Conduct educational research to enhance learning outcomes
2.3 Communication
- Respond to support requests and technical issues
- Send important updates about our service
- Provide educational resources and best practices
- Notify users of new features and improvements
3. Data Sharing and Disclosure
WhimsyLabs follows a strict data minimisation policy. We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:
3.1 Educational Institution Access
If you access WhimsyLabs through your school or educational institution, authorised educators and administrators may have access to your educational data and progress reports as part of the normal educational process.
3.2 Service Providers
We may share information with trusted third-party service providers who assist us in operating our platform, such as cloud hosting services, analytics providers, and customer support tools. These providers are contractually bound to protect your information and use it only for specified purposes.
3.3 Legal Requirements
We may disclose information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
4. Data Security and Protection
We implement comprehensive security measures to protect your information:
- Encryption: All data is encrypted in transit and at rest using industry-standard protocols
- Access Controls: Strict access controls ensure only authorised personnel can access user data
- Regular Audits: We conduct regular security audits and vulnerability assessments
- Data Backup: Secure backup systems protect against data loss
- Incident Response: We have procedures in place to respond quickly to any security incidents
5. Your Rights and Choices
You have several rights regarding your personal information:
5.1 Access and Portability
You can request access to your personal data and receive a copy in a portable format.
5.2 Correction and Updates
You can update or correct your personal information through your account settings or by contacting us.
5.3 Deletion
You can request deletion of your personal data, subject to legal and educational record-keeping requirements.
5.4 Opt-Out
You can opt out of non-essential communications and certain data collection practices.
6. Children's Privacy (COPPA/GDPR Compliance)
WhimsyLabs is designed for educational use and may be used by students under 18. We comply with applicable children's privacy laws, including COPPA (Children's Online Privacy Protection Act) and GDPR requirements:
- We collect minimal information necessary for educational purposes
- We require parental or school consent for users under 13
- We do not use children's data for advertising or marketing
- We provide enhanced privacy protections for student data
- We allow parents and schools to review children's data; deletion follows school retention policies
7. International Data Transfers
WhimsyLabs operates globally and may transfer data across international borders. We ensure appropriate safeguards are in place for international transfers, including:
- Standard Contractual Clauses (SCCs) for EU data transfers
- Adequacy decisions where applicable
- Additional security measures for sensitive educational data
8. Data Retention
We retain your information only as long as necessary for educational and legal purposes:
- Active Accounts: Data is retained while your account is active
- Educational Records: Student progress data may be retained for educational continuity
- Legal Requirements: Some data may be retained to comply with legal obligations
- Deletion Requests: We honour deletion requests while respecting educational and legal requirements
9. Cookies and Tracking Technologies
We use cookies and similar technologies to enhance your experience:
- Essential Cookies: Required for basic platform functionality
- Performance Cookies: Help us understand how users interact with our platform
- Preference Cookies: Remember your settings and preferences
You can control cookie settings through your browser, though disabling certain cookies may affect platform functionality.
10. Updates to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify users of significant changes through:
- Email notifications to registered users
- Prominent notices on our website
- In-platform notifications
Continued use of WhimsyLabs after policy updates constitutes acceptance of the revised terms.
11. Contact Information
If you have questions about this Privacy Policy or our data practices, please contact us:
Company: WhimsyLabs Ltd
Address: Edinburgh, United Kingdom
General Inquiries: [email protected]
Privacy & Data Protection: [email protected]
12. Regulatory Compliance
WhimsyLabs complies with applicable privacy regulations, including:
- GDPR: General Data Protection Regulation (EU)
- COPPA: Children's Online Privacy Protection Act (US)
- FERPA: Family Educational Rights and Privacy Act (US)
- UK GDPR: UK Data Protection Act 2018
- PIPEDA: Personal Information Protection and Electronic Documents Act (Canada)
We regularly review our practices to ensure ongoing compliance with evolving privacy regulations.