Privacy

Privacy policy

Last updated: 29 August 2026

Overview

This policy describes how the PreventED training platform handles personal information for teachers, school administrators, and programme staff in the United Kingdom.

1. Introduction

PreventED is an online safeguarding training programme for education professionals, operated by the National Network to End Child Abuse ("NNECA", "we", "us", or "our").

This Privacy Policy explains how we collect, use, store, and share personal information when you use the PreventED website, progressive web app (PWA), and native mobile applications that load the PreventED service (together, the "Service").

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who this policy applies to

This policy applies to individuals who register for or use PreventED, including teachers, school administrators invited to manage staff training, and NNECA programme administrators.

PreventED is intended for adults working in education. It is not directed at children, and we do not knowingly collect personal information from anyone under 18.

3. Data controller and contact

The data controller for PreventED is National Network to End Child Abuse (NNECA).

If you have questions about this policy or how we handle your personal information, contact us at:

Email: help@nneca.org.uk
Website: https://nneca.org.uk

School accounts

If your school invited you to PreventED, your school may also act as a data controller for certain staff training records. In those cases, NNECA processes data on our platform to deliver the training service your school has engaged. Questions about your school's use of training data can also be raised with your school administrator.

4. Personal information we collect

We collect only the information needed to provide safeguarding training, issue certificates, and administer school or programme accounts.

Account and profile information

When you register or are invited, we collect:

Email address
Password (stored in hashed form by our authentication provider; we do not store plain-text passwords)
First and last name
School name (optional for individual registration; required for school registration and teacher invites)
School association where your account is linked to a school record
Account role (for example teacher, school administrator, or NNECA administrator)

Training and assessment records

As you use PreventED, we store progress and completion data, including:

Module and lesson progress (including the furthest point reached in each module)
Activity completion state within lessons, including confidence check responses (your selected confidence level and personal intention text, stored with your lesson progress so you can resume)
Branching scenario completion
Assessment attempts, scores, pass or fail outcomes, and related question-level outcomes used for remediation flows
Certificate records (including a unique certificate reference, module completed, score where applicable, and date of issue)
Your last training route within the Service, so you can resume where you left off
Video playback data (watch progress, completion percentage, replays, and playback events needed to confirm you have watched required training videos)

Information we do not keep

Module reflection prompts at the end of each module are for your personal use only. Text you enter there is not saved to our servers after you continue.

PreventED does not ask you to enter information about identifiable children as part of the training activities. Please do not enter names or details that could identify a child, colleague, or real safeguarding case in any free-text field.

Communications

We also process:

Transactional emails sent through Supabase when needed to operate your account (account verification, password reset, and school invitations)
Certificate emails sent through Resend when a CPD certificate is issued to your account
Technical information needed to operate the Service securely (see section 8)

Administrator and school reporting data

Where you are linked to a school, authorised school administrators can view training progress, completion, assessment results, certificate status, and a summary activity log derived from your training records for teachers at their school.

Authorised NNECA administrators can access programme-wide user directory, analytics, exports, and individual teacher records needed to operate and improve the training programme.

5. How we use your information

We use personal information to:

Create and manage your account and authenticate you securely
Deliver training content, save your progress, and unlock modules in sequence
Record video watch progress so you can continue once required training videos have been watched
Run assessments, provide feedback, and issue CPD certificates
Send transactional service emails through Supabase (account verification, password reset, and school invitations)
Email CPD certificates through Resend when they are issued
Allow school administrators to monitor staff training completion for their school
Allow NNECA administrators to manage content, users, analytics, and exports
Maintain the security, integrity, and performance of the Service
Comply with legal obligations and respond to lawful requests

Lawful bases

We rely on the following lawful bases under UK GDPR, depending on the activity:

Performance of a contract: to provide the training service you or your school signed up for
Legitimate interests: to secure the platform, prevent misuse, support schools with training oversight, and improve programme delivery, balanced against your rights
Legal obligation: where we must retain or disclose information to comply with law

7. Service providers (processors)

We use trusted third-party providers to run PreventED. They process personal data only on our instructions and under appropriate contractual safeguards.

Supabase: authentication, database, secure storage for application data, and transactional email delivery (account verification, password reset, and invitations)
Resend: delivery of certificate emails when a CPD certificate is issued

Where your data is stored

PreventED stores personal data in Supabase, in the EU (AWS eu-west-1, Ireland). Account verification, password reset, and invitation emails are sent through Supabase. Certificate emails are sent through Resend from Ireland (eu-west-1). Resend stores account data and email delivery logs in the United States.

8. Cookies, local storage, and similar technologies

PreventED uses essential technologies to keep you signed in and to run the Service reliably.

Authentication cookies: set by Supabase to maintain your secure session
Local storage: used on your device to remember dismissed in-app training reminders in the notification menu
Service worker: registered in production to support PWA installation; it is not used for advertising tracking

Analytics and advertising

PreventED does not use third-party advertising cookies or sell data for targeted advertising. Programme analytics visible to administrators are derived from training records on our platform, not from cross-site tracking.

9. How long we keep information

We keep personal information for as long as your account is active and as needed to provide the Service, meet legal obligations, and resolve disputes.

You can delete your teacher account at any time. Step-by-step instructions are on our Delete account page (Delete account page). In the app, you can also go to Profile → Delete account.

When your account is deleted, we remove your profile, training progress (including confidence check responses), assessment records, video playback data, certificates, and authentication account from our active systems, subject to limited backup retention by Supabase (typically up to 30 days).

Aggregated or de-identified statistics that cannot reasonably identify you may be retained for programme reporting.

10. Security

We apply technical and organisational measures appropriate to the sensitivity of training and account data, including encrypted connections (HTTPS), access controls, and database row-level security so users can access only their own learner records unless an authorised administrator role applies.

No online service can be guaranteed completely secure. Please use a strong, unique password and keep your login details confidential.

11. Your rights

Under UK data protection law, you may have the right to:

Access the personal information we hold about you
Correct inaccurate information (you can update your name and school name in Profile)
Request erasure in certain circumstances (including self-service account deletion, see Delete account page)
Object to or restrict certain processing
Request data portability where applicable

How to exercise your rights

Delete your teacher account at Delete account page.

Other requests: contact us at help@nneca.org.uk. We may need to verify your identity before responding.

If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) in the United Kingdom at ico.org.uk.

12. Children

PreventED is a professional training tool for school staff. We do not offer accounts to children and do not knowingly collect children's personal data through the Service.

13. Account deletion

PreventED provides a dedicated page where you can review how to delete your account and, when signed in as a teacher, start deletion immediately on our Delete account page.

That page describes the steps in the app, what data is deleted, what may be retained in backups, and how to request deletion if you cannot sign in.

14. Changes to this policy

We may update this Privacy Policy from time to time, for example when we add features or change how the Service is hosted. The "Last updated" date at the top of this page will change when we do.

If changes are material, we will take reasonable steps to inform registered users, such as a notice in the Service or by email where appropriate.