Privacy & cookies

Last updated: 17/9/26

Website: Democracy Classroom, operated by The Politics Project CIC (“TPP”, “we”, “us” or “our”)
This Privacy Policy explains how we collect, use, store and share personal data when you use the Democracy Classroom website and related tools.

‍
1. Who we are

The Politics Project CIC is the organisation responsible for Democracy Classroom and is the data controller for personal data collected through the website.

For privacy questions or to exercise your rights, contact:
The Politics Project CIC
Market Coworking, 133a Rye Lane, London SE15 4BQ
info@thepoliticsproject.org.uk‍

You may also complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk.
‍

2. Personal data we collect

Depending on how you use the website, we may collect:

  • Your email address and a password, if you share these. Passwords are stored in hashed form and are not visible to us in plain text.
  • Your validated UK postcode, if you share this.
  • The role or roles you select, such as teacher, youth practitioner, voter or other, if you share these.
  • An account access role assigned by our system, such as User, Admin or Partner.
  • The page or form from which you registered.
  • The time at which you created an account or filled out a form.
  • Your answers to onboarding and profile questions.
  • Historical snapshots of questionnaire answers, including the question wording and answer as they appeared when submitted.
  • Your Framework self-assessment answers, the relevant question wording and the scores calculated at the time of submission.
  • Records of repeat self-assessment submissions.
  • Data-collection answers included in the self-assessment, including where those answers do not contribute to a score.
  • Records of certain actions, such as clicks and downloads, for internal statistics.
  • Your communications with us and any information you provide when requesting support or exercising your rights.
  • Your email address if you sign up for our newsletter.
  • Information collected through analytics cookies if you consent to them.
  • The final list of onboarding and profile questions may change. We will update this Policy or provide additional information where required.

We do not intend to collect special category data through the information needed by the Electoral Commission for the purposes described below. Please do not provide sensitive personal information.
‍

3. How we use personal data

We use personal data to:

  • Create and administer your account.
  • Verify your email address and send welcome, password-reset and account-related messages.
  • Provide access to member-only content and features.
  • Provide the Framework self-assessment tool and show its results when you complete it.
  • Store historical questionnaire and self-assessment submissions so that they remain interpretable and can support internal evaluation.
  • Use your own answers to recommend relevant content on the “For You” page.
  • Monitor usage, maintain the website and produce internal statistics.
  • Respond to enquiries and manage requests concerning your personal data.
  • Send a newsletter where you have separately signed up or otherwise provided the necessary permission.
  • Evaluate and improve Democracy Classroom and its impact.
  • Re-contact people who have used the Framework self-assessment, where they have given the separate permission described in section 5.
  • The “For You” recommendations are automated content matches based solely on your own answers. They do not produce legal, similarly significant or other decisions about you, and do not use external profiling, enrichment or third-party data.
    ‍

4. Lawful bases

The lawful bases for processing user data include:

  • Contract or steps requested before entering into a contract, where processing is necessary to create and operate your account or provide requested features.
  • Legitimate interests, where necessary to operate, secure, maintain and improve the website, manage the service, prevent misuse and produce internal statistics, provided those interests are not overridden by your rights.
  • Consent, where required for non-essential cookies, certain communications, newsletter purposes or the re-contact permission described below.
  • Legal obligation, where processing is necessary to comply with a legal or regulatory requirement.
    ‍

5. Sharing personal data

We share personal data only as described in this Policy or where required or permitted by law.
Service providers.

We use service providers to operate the website:

  • Xano: Backend database and API. Used for account data, questionnaire answers, self-assessment submissions and usage logs.
  • Brevo: Verification, welcome, password-reset and other transactional emails. Used for email address and email content.
  • Wized: Browser-based front-end logic connecting the website to the Xano API. Used for data passing through the browser session; stored in Xano.
  • Google Analytics 4: Usage analytics, where consent is given. Used for online identifiers and usage data collected through cookies
  • Airtable: Content management and pushing to Xano. Used to manage users and newsletter contacts.

The website also uses Webflow and Algolia. They receive or host published website content, search records or aggregate content statistics and are not used to store user accounts or questionnaire and self-assessment submissions. Search queries sent to Algolia are not accompanied by account identifiers.

TPP owns and controls the relevant provider accounts. Providers process data under their applicable data-processing terms and instructions from TPP.

‍

The Electoral Commission

TPP may share limited personal data with the Electoral Commission, our funder, where this is necessary for evaluation and related engagement concerning the Democratic Education Framework and the self-assessment tool.
‍

If you use the self-assessment tool, the Electoral Commission, or TPP acting on its behalf, may re-contact you:

  • To invite you to complete a survey or provide feedback.
  • To ask whether you are willing to participate in evaluation activity.
  • To ask whether you would permit the use of your experience as a case study.
  • For closely related evaluation and impact-assessment purposes explained at the time of contact.

This permission will expire on 31 July 2030. This date reflects the anticipated timing of a first general election at which 16-year-olds may vote (a key date for the purpose of the self-assessment tool) together with an additional year for evaluation. You may withdraw this permission at any time by contacting us at the email address at the start of this policy or using the unsubscribe or opt-out method in the relevant message. Withdrawal will not affect processing carried out before withdrawal.

‍We do not intend to collect special category data through the information needed by the Electoral Commission, or anywhere on the website. Please do not provide sensitive personal information.

6. Cookies and browser storage

The Electoral Commission will not share data shared in this way with other third parties unless it has been anonymised. TPP will not sell personal data or share it for advertising or third-party data enrichment.
‍

We use:

  • An authentication token in browser storage or cookies to keep you signed in. This is strictly necessary for the login service.
  • Functional browser storage, for example to remember that you dismissed an onboarding reminder.
  • Google Analytics 4 cookies and related technologies to measure website use and interactions. These are not strictly necessary and will only operate after you give consent through our cookie banner.
  • We will not activate Google Analytics 4 before the required consent has been obtained.
    ‍

7. International transfers

Personal data is intended to be stored in or processed through the following locations or arrangements:

  • Xano: UK, London region
  • Algolia: UK region
  • Airtable: EU-headquartered provider
  • Brevo: EU-headquartered provider
  • Google Analytics 4: global Google infrastructure; transfers outside the UK or EEA may occur.
  • Wized: browser-delivered service through its CDN.

Where personal data is transferred outside the UK, we will use a lawful transfer mechanism and appropriate safeguards where required.
‍

8. Retention and deletion

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required by law.

Questionnaire and self-assessment submissions are currently designed to be stored as historical, append-only records.

Re-contact permissions will be retained until they expire on 31 July 2030, or until withdrawn, subject to any limited record needed to ensure that an opt-out is respected. Contact information used for re-contact should be deleted or anonymised when no longer needed.
‍

9. Security

We use appropriate technical and organisational measures, including:

  • HTTPS encryption for traffic.
  • Hashed passwords.
  • Role-based access controls.
  • Authenticated access to member-only API endpoints.
  • Restriction of the Airtable content workspace to authorised team members.
  • Keeping personal data in the Xano backend rather than mirroring it into Webflow or Algolia.

No internet-based service can be guaranteed to be completely secure. If we become aware of a personal-data breach requiring notification, we will respond in accordance with applicable law.
‍

10. Your rights

Subject to applicable law, you may have the right to:

  • Ask for access to your personal data.
  • Ask us to correct inaccurate or incomplete data.
  • Ask us to delete your data.
  • Ask us to restrict processing.
  • Object to processing based on legitimate interests.
  • Object to direct marketing.
  • Withdraw consent where processing relies on consent.
  • Request a copy of data you provided to us in a portable format.
  • Complain to the Information Commissioner’s Office.

To exercise a right, contact the email address given at the start of this policy. We may need to verify your identity before responding.