Privacy Policy

Company information

Running Paper Limited (“Running Paper”, “we”, “us”, “our”) operates the website www.runningpaper.co.uk (the “Website”) and the Running Paper platform (the “Service”).

We are registered in England and Wales under company number 14874659, with our registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB706592.

For anything in this policy, contact info@runningpaper.co.uk.

Our roles

For schools, as processor. When a school, college or trust uses the Service, personal data about its pupils and staff is processed on the school’s documented instructions. The school is the data controller and Running Paper is a data processor. That processing is governed by the Running Paper Data Processing Agreement, which forms part of each customer’s agreement with us, together with the Sub-processor List and the Information Security Policy. Copies of these documents are provided to customers and are available on request.

Everything else, as controller. This policy explains the processing that Running Paper decides on and is responsible for itself: visitors to the Website, people who enquire about or book a demo of the Service, our contacts at customer and prospective customer schools, marketing, support and complaints, and statistics about how the Service is used.

Information we collect

Directly from you. When you enquire, book or attend a demo or training session, contact support, subscribe to updates or make a complaint, we collect the details you give us: typically your name, role, school or organisation, work contact details and the content of your message.

From your school, college or trust. If your school, college or trust names you as a contact for its agreement with us, or asks us to arrange access or training for you, we receive details about you from the school, typically your name, role and school email address.

From public sources. For business development, we may record the work contact details of school staff from public sources such as school websites and professional networking sites.

Automatically. When you use the Website, our hosting and security systems record technical data such as IP address, browser and device type, and the pages requested. Cookies and in-platform analytics are described under Cookies.

The Website is not designed to collect special category data, and we ask you not to include sensitive information in enquiries.

Use of data and legal basis

We use personal data as follows.

• Responding to enquiries and arranging demos and trials. Contact details and the content of your messages. Lawful basis: our legitimate interests (responding to people who contact us and promoting the Service to schools).
• Setting up and administering customer agreements. Contact details of school contacts and related correspondence, used for onboarding, training, service notices, invoicing and account administration. Lawful bases: our legitimate interests (managing our customer relationships and performing our agreements with schools) and legal obligation (the accounting records we must keep).
• Providing support and handling complaints. Contact details and correspondence. Lawful bases: our legitimate interests (resolving issues and improving the Service) and legal obligation (handling data protection complaints).
• Marketing the Service. Work contact details of staff at schools, colleges and trusts. Lawful basis: our legitimate interests (promoting the Service to the schools sector). You can opt out at any time (see Marketing).
• Running and protecting our business. Records and correspondence shared with our advisers, insurers and the authorities, and with a buyer on any sale or reorganisation. Lawful bases: our legitimate interests (obtaining advice and insurance and dealing with a sale of our business) and legal obligation (disclosures the law requires).
• Understanding how the Service is used. Usage data from our platform, used to understand how the Service is used and to improve it. Lawful basis: our legitimate interests (developing and improving our product).
• Security. Technical logs relating to the Website and our systems. Lawful bases: our legitimate interests (keeping our systems and data secure) and legal obligation (security of processing).

Where we rely on legitimate interests, we have balanced those interests against your interests and rights, and you can object at any time (see Your Rights). You are not under any statutory or contractual obligation to provide personal data to us.

Marketing

We send marketing about the Service to work contacts at schools, colleges and trusts. Every marketing email includes an unsubscribe link, and you can also opt out at any time by emailing us. We honour opt-outs promptly and keep a minimal suppression record so that we do not contact you again. We never send marketing to pupils or parents.

Cookies

Essential cookies. We use essential cookies on the Service that are necessary for the proper functioning and security of the platform. These include authentication cookies that manage your login sessions and security features. They are strictly necessary and cannot be disabled.

Analytics cookies (Amplitude). When you sign in to the Service, we use Amplitude to collect statistics about how the platform is used, so that we can understand and improve it. It is not used for advertising, and we do not use it to make decisions about individual teachers. No pupil data is included. Amplitude processes this information on our behalf on servers in the European Economic Area (EEA).

If you would rather we did not collect these statistics from your use of the Service, email us and we will disable this for you.

Disclosure of data

We share personal data with service providers who process it on our instructions under contracts meeting UK GDPR requirements: providers of cloud hosting and infrastructure, email and communications, customer relationship management and support tools.

For personal data processed within the Service on behalf of schools, the sub-processors we use are set out in the Running Paper Sub-processor List. The list identifies each sub-processor, its role, where it processes data and, where relevant, the transfer safeguard relied on; it is provided to customers with their agreement and is available on request.

We may also share personal data with our professional advisers (such as accountants, auditors and lawyers) and insurers; with regulators, law enforcement and other authorities where the law requires or permits it; and, in the event of a sale or reorganisation of our business, with the prospective or actual new owner, who may use it only in the ways described in this policy.

We do not sell personal data.

Data storage and transfers

Personal data we hold as controller (enquiries, customer contacts, marketing and platform analytics) is stored in the United Kingdom or the EEA. Transfers to the EEA are covered by the UK’s adequacy regulations.

Where personal data is processed within the Service on behalf of schools, the core infrastructure is hosted in the UK, with some processing in the EEA under the UK’s adequacy regulations and a limited amount outside the UK and EEA under the safeguards set out in the Data Processing Agreement and Sub-processor List.

Retention of data

As controller, we keep personal data only for as long as we need it:

1. Enquiry and business development contacts: no more than 24 months after our last meaningful contact with you;
2. Records of customer agreements, invoicing, support and complaints: the life of the agreement plus 6 years, in line with legal requirements and the period in which legal claims can be brought;
3. In-platform analytics: no more than 12 months;
4. Security logs: no more than 12 months;
5. Marketing opt-outs: a minimal suppression record, kept for as long as needed to honour your opt-out.

We then delete or anonymise the data. Personal data processed for schools within the Service is kept and deleted as set out in the Data Processing Agreement with the school.

Security measures

We implement a range of technical and organisational security measures to protect personal data, including encryption of data in transit and at rest, access controls, and monitoring. Our measures are set out in full in the Running Paper Information Security Policy, which is provided to customers and is available on request. While we strive to use commercially acceptable means to protect your data, no method of transmission or storage is completely secure.

Your rights

You have the following rights over personal data we hold about you as controller: to request access to it (a copy of the data and information about how it is used); to have it rectified; to have it erased; to restrict how it is used; to receive it in a portable, machine-readable format; and to object to processing based on legitimate interests. You have an absolute right to object to direct marketing: if you object, we will stop. Where we rely on your consent for anything, you can withdraw it at any time, without affecting processing that happened before, and you can ask us to disable analytics for your account at any time (see Cookies). Not every right applies in every situation; if one does not apply to your request, we will explain why.

To exercise any of these rights, contact us. We may need to verify your identity, and we may ask you to clarify your request. We respond within one month; for complex or multiple requests this can be extended, and the period can be paused while identity is verified or clarification is provided.

If your request concerns personal data processed within the Service on behalf of your school (for example pupil data, or the records your school holds in your teacher account), the school is the controller. We will pass your request to the school without undue delay and assist it in responding.

Children

The Website and the Service are designed for school staff and other adults. Pupils do not sign in to or interact with the Service: teachers upload work, and marked work and feedback reach pupils only when a teacher releases them. We process pupils’ personal data (including their written work) only as a processor, on schools’ instructions, under the Data Processing Agreement. We never use pupils’ personal data for marketing, and neither we nor our sub-processors use student work to train AI models. Schools explain how pupils’ data is used through their own privacy notices, and questions about a pupil’s data should be raised with the school in the first instance; we help schools answer them.

Complaints

If you are unhappy with how we have handled your personal data, contact us. We will acknowledge your complaint within 30 days and respond as quickly as we can. You also have the right to lodge a complaint with the Information Commissioner’s Office (ico.org.uk) at any time. We would welcome the chance to address your concerns first.

Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. We will post updates on this page with an updated date.