Privacy Policy

At ootiboo, accessible from ootiboo.com, one of our main priorities is the privacy of our visitors. This Privacy Policy document explains what types of personal data we collect, how we use it, your rights, and how we protect it in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

1. Data Controller Identity and Contact Details

ootiboo operates as the Data Controller for your personal data.

• Legal Entity Name: ootiboo CIC
• Registered Address: 30 East Cliff, Folkestone, Kent, CT19 6BU
• Contact Email: info@ootiboo.com

2. Legal Bases and Purposes for Processing Personal Data

Under the GDPR, we must have a valid legal basis to process your personal data. We rely on the following grounds:

• Performance of a Contract:
  • To create, maintain, and manage your school account.
  • To provide, operate, and deliver the educational services and resources you request from us.
• Legitimate Interests:
  • To analyze how you use our website so we can improve and personalize your experience.
  • To develop new products, services, and features.
  • To detect, investigate, and prevent fraudulent activity or security breaches.
  • To respond directly to your customer service requests, inquiries, or attachments submitted via contact forms.
• Consent:
  • To process competition entry submissions (including both parent and child data) for the duration of a specific project.
  • To send you direct marketing emails and project updates via our mailing list.
  • To place non-essential cookies (such as analytics cookies) on your device. You have the right to withdraw your consent at any time.

3. Types of Personal Data Collected

A. Data You Provide Directly

• School Account Registration: When you register for a school account, we collect your name, school name, school address, and email address.
• Direct Communications: If you contact us via email or a contact form, we collect your first name, email address, name of your organisation (if provided), the content of your message, and any attachments you choose to send.
• Competition Entries: When a parent submits an entry to our competitions via our online submission form, we collect the parent’s first name, parent’s email address, child’s first name, child’s age, and the child's school.

B. Data Collected Automatically (Log Files and Cookies)

• Log Files: ootiboo uses standard log files. The information collected includes internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamps, referring/exit pages, and click data. Under the GDPR, IP addresses are treated as personal data. We use this data strictly for system administration, security, and tracking website usage.
• Cookies: We use cookies to store user preferences and optimize your experience. Essential cookies are deployed automatically, while performance, analytical, and marketing cookies are only deployed with your explicit consent.

4. Cookie Inventory

Below are the detailed cookies utilized on ootiboo.com:

5. Hosting Infrastructure and Server-Side Analytics

This website is hosted by Base44, a software platform that provides hosting, database, and infrastructure services. As part of normal website operation, Base44 automatically collects and processes certain technical data at the server level. This is standard practice for any hosted website and is necessary for keeping the site secure, operational, and performant.

The data collected at the infrastructure level includes:

• Pages visited and URLs requested
• IP address (used to determine approximate geographic location, e.g. country)
• Browser and operating system (derived from the User-Agent string sent by your browser)
• Referrer (the website or source you arrived from)
• Timestamps of requests

This data is processed under our Legitimate Interest in operating a secure and reliable website. It is used solely for high-level traffic monitoring, system security, and technical performance purposes. It is not used for profiling, advertising, or cross-site tracking. No separate consent is required for this server-side logging, but we are committed to transparency in accordance with our obligations under GDPR and the UK Data Protection Act 2018.

For more information about how Base44 handles infrastructure data, please refer to the Base44 Privacy Policy.

6. Data Processors and Third-Party Tools

We share your data with trusted third-party service providers who act as data processors to help us run our operations:

• Google Workspace: Competition entry data is securely transferred from our website server to a secure Google Sheet for project management.
• Advertising Networks & Links: Third-party ad servers or ad networks use technologies like cookies, JavaScript, or web beacons within their advertisements which automatically capture your IP address. ootiboo has no access to or control over cookies used by third-party advertisers.

7. International Data Transfers

Some of our third-party service providers (such as Google Analytics and Google Workspace) are located outside of the United Kingdom (UK) and European Economic Area (EEA), notably in the United States. Whenever your personal data is transferred internationally, we ensure a similar degree of protection by verifying that appropriate safeguards are in place, such as UK/EU Standard Contractual Clauses (SCCs) or the UK-U.S. Data Privacy Framework.

8. Data Retention Periods

We only keep your personal data for as long as necessary to fulfill the purposes we collected it for:

• School Account Information: Retained for the duration of your active school relationship with us.
• Contact Enquiries: Retained for 2 years from the date of the last communication.
• Competition Entries: Submitted data is stored on our secure website server and a secure Google Sheet. It is completely deleted 30 days after the end of the specific project/competition, unless a parent has opted-in to join our mailing list.
• Mailing List & Demographic Data: If a parent explicitly consents to receive updates, we retain the parent’s email address on our mailing list. We also retain the parent's first name, child's first name, child's age, and child's school to tailor our mail-outs to specific demographics. This data is held until the user withdraws consent or unsubscribes.
• Log Files: Retained for a maximum of 30 days before being automatically overwritten or anonymized.

9. Your GDPR and UK Data Protection Rights

You hold comprehensive legal rights over your personal data. You may exercise any of these rights at any time by emailing us at info@ootiboo.com:

• The Right to Access: You have the right to request copies of your personal data.
• The Right to Rectification: You have the right to request that we correct any information you believe is inaccurate.
• The Right to Erasure ("Right to Be Forgotten"): You have the right to request that we erase your personal data under certain conditions.
• The Right to Restrict or Object to Processing: You have the right to restrict our processing of your data, or object to our processing, particularly regarding direct marketing and demographic targeting.
• The Right to Data Portability: You have the right to request that we transfer the data we have collected to another organization, or directly to you.
• The Right to Withdraw Consent: Where processing is based on your consent (such as competition entries or newsletter signups), you have the right to withdraw it at any time.

10. Children's Privacy

Protecting children online is paramount. ootiboo does not knowingly collect or request any Personally Identifiable Information directly from children under the age of 16. Any personal data relating to a child (such as a first name, age, or school for competition entries) must be submitted exclusively by a parent or legal guardian with explicit consent. If you believe a child under 16 has directly provided personal data on our website without parental consent, please contact us immediately at info@ootiboo.com, and we will delete such data from our records promptly.

11. Right to Lodge a Complaint

If you are unhappy with how we collect or handle your data, you have the right to lodge an official complaint with the UK data protection authority:

• Information Commissioner's Office (ICO):(www.ico.org.uk)