Privacy Policy

[LAWYER REVIEW REQUIRED] — This is a scaffold for a UK GDPR / DPA 2018 lawyer to complete (Brief 31 Phase B). It is not legal advice and not the published policy. Each section below is a stub describing what the lawyer must cover.

Who we are

Stub: MyCovey Ltd (trading as Covey), registered in England & Wales, company no. 17269187. Add the registered address and the ICO registration number once obtained. Name the data controller and the contact route (privacy@mycovey.com).

What data we collect and why

Stub — cover, with lawful basis (UK GDPR Art. 6) for each: - Parent account data: name, email, postcode, location. - Children's data: first name, date of birth / age, school, interests — collected under parental consent (Art. 6(1)(a)); the parent confirms they are the parent/guardian at the point of adding a child. - Activity / engagement data: saved clubs, enquiries (leads), reviews, recommender impressions. - Operator data: contact details, and DBS certificate uploads — see special category data below. - Marketing preference (`marketing_opt_in`) — consent-based; separately opt-in.

Special category data (DBS certificates)

Stub: DBS certificate data is criminal-records data — special category / Article 10 processing. Cover the condition relied on, the safeguarding purpose, the 12-month retention limit (auto-purged; see §6.5), and that operators are notified 30 days before deletion.

Retention

Stub: how long each data type is kept and the deletion triggers (account deletion, DBS 12-month purge, suppression-list permanence).

Who we share data with (processors)

Stub — list each processor, purpose, location, and the safeguard for any non-UK transfer (Standard Contractual Clauses where applicable): - Vercel (hosting), Supabase (database + storage, eu-west-2 / London), Resend (transactional email), Instantly (cold outreach — separate processor), Plausible (analytics, EU-hosted, cookieless), Sentry (error monitoring — confirm EU routing; if not, document the SCC transfer mechanism here), Anthropic (AI — US-hosted; confirm data is not used for training before launch; document the SCC / transfer basis).

Cold email (PECR)

Stub: cross-reference the PECR basis for the operator cold-email channel (corporate-subscriber rule; soft opt-out; unsubscribe on every send). See the cold-email pipeline's legal foundation.

Your rights

Stub: access, rectification, erasure, restriction, objection, portability — and how to exercise them (link Your Data Rights, request a data export, delete your account). Right to complain to the ICO.

Cookies

Stub: cross-reference the Cookie Policy. Covey uses only strictly-necessary / functional cookies + cookieless analytics, so there is no consent banner.

Contact

Stub: data protection contact — privacy@mycovey.com — and how to escalate to the ICO.