Privacy Policy

At ootiboo, accessible from ootiboo.com, one of our main priorities is the privacy of our visitors. This Privacy Policy document explains what types of personal data we collect, how we use it, your rights, and how we protect it in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

1. Data Controller Identity and Contact Details

ootiboo operates as the Data Controller for your personal data.

• Legal Entity Name: ootiboo CIC
• Registered Address: 30 East Cliff, Folkestone, Kent, CT19 6BU
• Contact Email: info@ootiboo.com

2. Legal Bases and Purposes for Processing Personal Data

Under the GDPR, we must have a valid legal basis to process your personal data. We rely on the following grounds:

• Performance of a Contract (or taking steps at your request before entering into one):
  • To manage the workshop bookings you request.
  • To provide, operate, and deliver the workshops, educational services and resources you ask us for.
• Consent:
  • To retain the name, school name and school email address that teachers submit through our Workshop Sign Up and Submission forms, so that we can contact them about future workshops, competitions and activities. You give this consent by ticking the consent box on the form.
  • To add your email address to our mailing list (through the sign-up fields on our website) and send you our newsletter and project updates.
  • To process competition entry submissions (including both parent and child data) for the duration of a specific project.
  • To place non-essential cookies (such as analytics cookies) on your device.

  You have the right to withdraw your consent at any time.

• Legitimate Interests:
  • To keep in touch with teachers we already have a relationship with, including teachers who previously held a school account with us, about workshops, competitions and activities that may be relevant to them. You can object to this or unsubscribe at any time.
  • To keep the contact details of teachers who get in touch with us where the relationship goes beyond an initial enquiry and reply (for example, where it leads to a meeting or workshop booking).
  • To analyze how you use our website so we can improve and personalize your experience.
  • To develop new products, services, and features.
  • To detect, investigate, and prevent fraudulent activity or security breaches.
  • To respond directly to your customer service requests, inquiries, or attachments submitted via contact forms.

3. Types of Personal Data Collected

ootiboo no longer offers school accounts. We do not hold any passwords, and you do not need to register to use our website.

To power the school auto-complete list in our Workshop Sign Up and Submission forms, we also store a list of school names and addresses in our content management system. This is publicly available information and is not linked to any individual.

A. Data You Provide Directly

• Workshop Sign Up and Submission Forms (teachers): When a teacher completes one of these forms, we collect their name, school name and school email address. Both forms include a required tick box confirming that you consent to ootiboo retaining these details for future communications.
• Mailing List Sign-Ups: If you enter your email address in a mailing list field on our website (for example in the footer or on the contact page), we collect your email address only.
• Direct Communications: If you contact us via email or a contact form, we collect your first name, email address, name of your school or organisation (if provided), the content of your message, and any attachments you choose to send. If our relationship with you goes beyond an initial enquiry and reply (for example, it leads to a meeting or a workshop booking), we keep your first name, school name (if given) and email address.
• Competition Entries: When a parent submits an entry to our competitions via our online submission form, we collect the parent’s first name, parent’s email address, child’s first name, child’s age, and the child's school.
• Former School Account Holders: For teachers who previously registered for a school account with us, we continue to hold the name, school name and email address they provided. Passwords were deleted when accounts were closed.

B. Data Collected Automatically (Log Files and Cookies)

• Log Files: ootiboo uses standard log files. The information collected includes internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamps, referring/exit pages, and click data. Under the GDPR, IP addresses are treated as personal data. We use this data strictly for system administration, security, and tracking website usage.
• Cookies: We use cookies to store user preferences and optimize your experience. Essential cookies are deployed automatically, while performance, analytical, and marketing cookies are only deployed with your explicit consent.
• Resource Downloads: We count how many times each resource is downloaded each year. When a resource is downloaded, our hosting provider (Base44) sends us a notification email. If you have accepted our cookies, this email also uses your IP address to give us a general location of where the download took place.

4. Cookie Inventory

Below are the detailed cookies utilized on ootiboo.com:

5. Hosting Infrastructure and Server-Side Analytics

This website is hosted by Base44, a software platform that provides hosting, database, and infrastructure services. Base44’s servers are located in the United States. As part of normal website operation, Base44 automatically collects and processes certain technical data at the server level. This is standard practice for any hosted website and is necessary for keeping the site secure, operational, and performant.

The data collected at the infrastructure level includes:

• Pages visited and URLs requested
• IP address (used to determine approximate geographic location, e.g. country)
• Browser and operating system (derived from the User-Agent string sent by your browser)
• Referrer (the website or source you arrived from)
• Timestamps of requests

This data is processed under our Legitimate Interest in operating a secure and reliable website. It is used solely for high-level traffic monitoring, system security, and technical performance purposes. It is not used for profiling, advertising, or cross-site tracking. No separate consent is required for this server-side logging, but we are committed to transparency in accordance with our obligations under GDPR and the UK Data Protection Act 2018.

The only other personal data stored by Base44 is the information submitted through our contact form and mailing list sign-up fields. We delete this data from the Base44 database weekly. Information submitted through our Workshop Sign Up and Submission forms is not collected by Base44. It is stored in our content management system (Strapi), hosted on OVHCloud servers in the European Union.

For more information about how Base44 handles infrastructure data, please refer to the Base44 Privacy Policy.

6. Data Processors and Third-Party Tools

We share your data with trusted third-party service providers who act as data processors to help us run our operations:

• Base44: Hosts our website and database. See Section 5 for the data it processes.
• OVHCloud: Hosts our content management system (Strapi), where Workshop Sign Up and Submission form data is stored on servers in the European Union.
• Brevo: Our email platform and CRM, which stores its data within the European Union. The email address of anyone who completes a Workshop Sign Up form, a Submission form or a mailing list field on our website is added to Brevo so that we can send our newsletter. Every email we send through Brevo includes an unsubscribe link.
• Google Workspace: Competition entry data is securely transferred from our website server to a secure Google Sheet for project management. Workshop Sign Up information is also kept on a secure Google Drive so that we can create booking forms for schools that have a workshop with us. We also keep the name, school name and email address of teachers who previously held school accounts on a restricted Google Sheet. We use this information to send targeted emails (mail merges) about workshops, competitions and activities.
• Google Analytics: Provides website usage statistics, but only where you have consented to analytics cookies (see Section 4).

7. International Data Transfers

Some of our third-party service providers (such as Base44, Google Analytics and Google Workspace) are located outside of the United Kingdom (UK) and European Economic Area (EEA), notably in the United States. Whenever your personal data is transferred internationally, we ensure a similar degree of protection by verifying that appropriate safeguards are in place, such as UK/EU Standard Contractual Clauses (SCCs) or the UK-U.S. Data Privacy Framework.

Our hosting provider, Base44, processes data on our behalf under a Data Processing Addendum that requires it to use lawful transfer mechanisms, such as the Data Privacy Framework or standard contractual clauses.

Data stored in our content management system (OVHCloud) and in our email platform (Brevo) is held on servers within the EU.

8. Data Retention Periods

We only keep your personal data for as long as necessary to fulfill the purposes we collected it for:

• Workshop Sign Up and Submission Forms (teachers): Your name, school name and school email address are retained until you ask us to delete them or until they are removed at our two-yearly review (see below), so that we can manage workshop bookings and contact you about future workshops, competitions and activities.
• Former School Account Holders: The name, school name and email address you gave us are retained until you ask us to delete them or until they are removed at our two-yearly review (see below). Passwords were deleted when school accounts were closed.
• Mailing List (teachers and others): Your email address is held in Brevo until you unsubscribe or ask us to delete it.
• Contact Enquiries: Correspondence is retained for 2 years from the date of the last communication. Contact form submissions held on our website database are deleted weekly. If our relationship with you goes beyond the initial enquiry and reply (for example, it leads to a meeting or workshop booking), we keep your first name, school name (if given) and email address until you ask us to delete them or until they are removed at our two-yearly review (see below).
• Competition Entries: Submitted data is stored on our secure website server and a secure Google Sheet. It is completely deleted 30 days after the end of the specific project/competition, unless a parent has opted-in to join our mailing list.
• Mailing List & Demographic Data (parents): If a parent explicitly consents to receive updates, we retain the parent’s email address on our mailing list. We also retain the parent's first name, child's first name, child's age, and child's school to tailor our mail-outs to specific demographics. This data is held until the user withdraws consent or unsubscribes.
• Log Files: Retained for a maximum of 30 days before being automatically overwritten or anonymized.

Two-yearly review: Every two years we review the teacher contacts we hold and delete the details of anyone who has not interacted with us within that time.

9. Your GDPR and UK Data Protection Rights

You hold comprehensive legal rights over your personal data. You may exercise any of these rights at any time by emailing us at info@ootiboo.com:

• The Right to Access: You have the right to request copies of your personal data.
• The Right to Rectification: You have the right to request that we correct any information you believe is inaccurate.
• The Right to Erasure ("Right to Be Forgotten"): You have the right to request that we erase your personal data under certain conditions.
• The Right to Restrict or Object to Processing: You have the right to restrict our processing of your data, or object to our processing, particularly regarding direct marketing and demographic targeting.
• The Right to Data Portability: You have the right to request that we transfer the data we have collected to another organization, or directly to you.
• The Right to Withdraw Consent: Where processing is based on your consent (such as workshop and submission form sign-ups, competition entries or newsletter sign-ups), you have the right to withdraw it at any time. Every email we send through our mailing list also contains an unsubscribe link.

10. Children's Privacy

Protecting children online is paramount. ootiboo does not knowingly collect or request any Personally Identifiable Information directly from children under the age of 16. Any personal data relating to a child (such as a first name, age, or school for competition entries) must be submitted exclusively by a parent or legal guardian with explicit consent. If you believe a child under 16 has directly provided personal data on our website without parental consent, please contact us immediately at info@ootiboo.com, and we will delete such data from our records promptly.

11. Right to Lodge a Complaint

If you are unhappy with how we collect or handle your data, you have the right to lodge an official complaint with the UK data protection authority:

• Information Commissioner's Office (ICO): www.ico.org.uk