Privacy Notice

The first part applies to everyone. The second part has a section for each place you might have contacted us: our website, our webinars and information sessions, or our support portal.

Part one - applies to everyone

Who we are

Global Pathways Academy. Our Data Protection Officer looks after your information and answers questions about it. dataprivacy@gp.academy

Our representative in Europe

Szilvia Lázár, Diósd, Hungary. szilvi.lazar@gp.academy You can contact them about anything in this notice, and so can a data protection authority.

What we never do

We don't sell your information. We don't use student information to train commercial AI. And we don't make decisions about you automatically, without a person reviewing them. We don't use anything you send us through enrollment, lessons, assessments, advisory sessions, or our support portal for marketing or advertising. On our public website we do use tools that measure whether an advertising campaign brought someone here, but only if you turn on Marketing cookies, and never using anything you've sent us through a form.

Why we're allowed to use your information

The law requires us to tell you not just what we do with your information, but what permits us to do it. This is the short version; the fuller explanation is in our Data Privacy Policy Set.

Where we rely on our legitimate interest, you can object to what we are doing and we will stop unless we have compelling grounds to continue. Write to dataprivacy@gp.academy.

Some of the companies that handle your information for us are outside Europe. Which safeguard we need depends on the company. For most of them, including HubSpot and Google, it is their certification under the EU-US Data Privacy Framework, which the European Commission has recognized as providing adequate protection. For StreamYard it is the European Commission's Standard Contractual Clauses. Some are established in Europe, so no safeguard is needed at all. Write to dataprivacy@gp.academy and we'll tell you which applies to a particular company, and give you a copy where we hold one.

If you've told us about your child

Some of our forms ask about the child your inquiry concerns, their school grade for example, and you might mention them in your message.

That means we may hold some information about a child who hasn't given it to us themselves, and whom we have no way to contact directly. We handle it the same way we handle information about our enrolled students: access is restricted, and we never use it for commercial purposes. If your child later enrolls with us, we'll give them this information at that point.

Keeping your information safe

Everything is encrypted when it's stored and when it's sent. Only staff who need your information for their job can see it, access is logged, and we review who has access every year. Staff who work with student information are trained every year.

What you can ask us to do

Write to dataprivacy@gp.academy and you can ask us to:

• show you what we have about you - we'll reply within 30 days
• fix something that's wrong - within 15 days
• delete it - within 30 days
• send it to you in a file you can take elsewhere - within 30 days
• stop using it in a particular way - within 30 days
• not be subject to a decision made only by a computer, where that decision has a legal effect on you or something similarly significant - within 30 days
• withdraw your permission, where we relied on it - we'll confirm within 5 business days

If your request is complicated we may need longer, and we'll tell you why within the first 30 days.

Withdrawing permission stops us using your information that way from then on. It doesn't undo anything we did before you asked. None of this costs anything. We only charge a fee, or refuse, if a request is clearly excessive or unfounded, and it's on us to show that it is.

If we can't do what you asked, we'll explain why in writing within the same time. That can happen when the information is about someone else too, when the law requires us to keep it, when it's under a legal hold, when a request is excessive, or when acting on it would harm someone else's rights.

Checking who you are. Before we show you any information, we confirm you are who you say you are: by email from an address we already hold for you, by photo ID, or another reasonable way depending on how sensitive the information is. This protects you from someone else getting your information.

If you're a parent

Write to dataprivacy@gp.academy to ask what we hold about your child, to have it deleted, or to ask us not to collect any more. If you name your child, we'll delete it, unless the law requires us to keep it, or it's subject to a legal hold, in which case we'll tell you. If you want to see it, we'll check who you are first; that's to protect your child from someone else getting their information.

When your child reaches the age at which they can exercise these rights themselves, which depends on where you live, those rights pass to them. We'll let you know before that happens.

If you're under 18

If you're enrolled at GPA, your parent or guardian signed our Enrollment Agreement on your behalf, and you are a party to it. Most of what we do with your information is because we need to in order to teach you, not because anyone gave permission that could be taken back. A few things do rest on permission, like sharing certain sensitive information, and we ask for those separately. Helping you through our support portal is part of teaching you, so it doesn't depend on permission either.

If you're unhappy with us

Write to the DPO first. If that doesn't resolve it, you can write to the Head of School, use the school's complaints process, or contact the data protection authority in the country where you live. Nobody at GPA will treat you differently for raising a concern in good faith.

Changes to this notice

We review this notice at least once a year, and again whenever something changes that it describes: a new company handling your information, a change to what we collect, a change to how long we keep it, or a change to how we ask for your consent.

When we change something that affects what you'd expect us to do with your information, we update the version and date at the top of this page. We don't email you about it, so if this matters to you, it's worth checking back.

We keep a record of every version of this notice. If you want to know what it said when you contacted us, write to dataprivacy@gp.academy and we'll tell you.

If you used our website

Who this site is for

This website is for parents, guardians, and school or organization contacts. We don't ask students to create accounts here, and we don't collect information from students through our inquiry or application forms. If you're a student and you need help with your coursework or your account, use our support portal.

What we collect

Our contact form asks first who you are - a family, a school or administrator, or something else - and shows different fields depending on your answer.

If you're a family: your name, your email address, the school grade of the child your inquiry concerns, your country or time zone, and your message. The grade and the country are optional. The grade is about your child, not about you; we don't ask your age and we don't check it.

If you're a school or administrator: your name, your email address, your school or organization, and your message.

If you chose "other": your name, your email address, and your message.

Every version has a box to tick if you'd like to hear from us occasionally. You don't have to tick it; we'll still answer your question. Ticking it is how you join our mailing list, and you can unsubscribe from any email we send.

Please leave sensitive things out. You don't need to tell us about health conditions, disabilities, learning-support needs, or anything private about your life in order to ask us a question. If your question is about one of those, write to support@gp.academy and we'll respond directly.

Cookies

When you first visit, we ask about cookies. You can accept everything, decline everything that isn't essential, or choose category by category. Analytics and Marketing are both off unless you turn them on, and you can change your mind at any time through the Cookie Preferences panel. Your choices take effect as soon as you save.

Site analytics

Our website is built and hosted on Lovable. With your consent, its built-in analytics records each page you visit: the page address, the site you arrived from, your browser and language, a country estimate taken from your device's time zone, and a randomly generated session identifier. This is processed for us by Lovable and its analytics provider Tinybird. We use it to understand how people find and move through the site. It doesn't follow you across other websites. Lovable's standard terms also let it use customer data for its own purposes, including training artificial intelligence models. We have opted out of that, so it does not apply to data from this site.

Separately, and whatever you choose here, Lovable's servers keep technical logs - your IP address, your browser, and the pages you request - for up to 90 days, for security, troubleshooting, and running the service. These logs are part of delivering the site.

HubSpot analytics

HubSpot is the company we use to receive your inquiry and to send our mailing list. If you turn on Analytics cookies, HubSpot also records which pages you visit on our site. We use that to understand which pages families and schools find useful.

HubSpot also uses this information for its own purposes, including building signals about which organizations are showing interest in services like ours, which it offers to its other customers as a product. That use is HubSpot's decision, not ours, and it's described in HubSpot's own privacy policy rather than in this notice.

If you'd rather not take part in that, decline Analytics cookies. Everything else on the site works the same way.

Advertising

We advertise to reach families who might be interested in the school. If you turn on Marketing cookies, we use tools that tell us whether an advertising campaign brought you here. We never pass information you send us through a form to an advertising platform, and we don't build advertising audiences from it. Because GPA provides faith-based education, what you look at on this site may reveal something about religious belief. We therefore treat this as special category information and ask for your explicit consent separately, rather than bundling it with anything else.

The support form on our site

Some pages include a support form embedded from our support portal. It runs inside a frame served by support.gp.academy, so anything you submit through it goes to our support system rather than our website systems. See how we handle support requests below.

Who else sees it

Your inquiry goes to HubSpot, which we use to reply to you and to send our mailing list. HubSpot stores it in the United States. Because that is outside Europe the transfer needs a safeguard. HubSpot is certified under the EU-US Data Privacy Framework, which the European Commission has recognized as providing adequate protection, and that is what we rely on. Write to dataprivacy@gp.academy if you want the details.

Our website is built and hosted by Lovable, which uses other companies to deliver the site, including a content delivery network that receives your IP address and browser information as the page loads.

How long we keep it

We keep your message for up to four years, then delete it. If you're still in touch with us, we keep it while that continues. We do this clear-out once a year, so it may sit with us a little longer than four years before the next one comes round.

If you registered for a webinar or information session

Our sessions are for parents and guardians rather than for students.

What we collect

When you register we ask for your first name, last name and email address. You can also give us a phone number and the school grade of the child your inquiry concerns if you'd like to; neither is required. There's a box for your biggest question about high school at home, and a box to tick if you'd like to hear from us afterwards.

Please leave sensitive things out of that box, the same as on our contact form. If your question involves health, disability or learning support, write to support@gp.academy instead.

The live chat

During a session, your name and anything you type in the chat are visible to everyone else attending. We do this so the session works as a conversation.

We don't keep the chat. It isn't exported or transcribed, and it doesn't appear in the recording. If a moderator has to remove a message, they note that it happened without recording what it said.

Please don't post health, disability or other private information about a child in the chat; write to us at support@gp.academy instead.

Recordings

We record our sessions. The chat doesn't appear in the recording, and neither do participants' names or messages. If a host reads out a question, they don't say who asked it, and they change any detail that could identify someone. Questions about health or disability are never read aloud.

Watching a replay

Our replay pages show the edited video on YouTube. When you open the page your browser contacts Google to fetch the player, which means Google receives your IP address. We use YouTube's privacy-enhanced mode, which stops YouTube setting advertising cookies until you press play. It does not stop everything: as soon as the player loads, YouTube writes identifiers into your browser's storage and contacts Google's servers, whether or not you watch anything. Because that happens before you press play, we do not load the player until you tell us we can; the page shows a placeholder until you click it.

We never publish the video's address on YouTube. If you registered, we send you a link to a page on our own site where the recording is embedded. The video is unlisted, so it doesn't appear in YouTube search. The page link isn't password-protected, so anyone you forward it to could watch it. We can also see whether you watched, when, and for how long, both the live session and the recording afterwards. We use that only to follow up on your interest. It doesn't feed into any score or ranking of you or your child, and we don't combine it with anything held in our school systems. Whether we email you afterwards depends on the box you ticked when you registered, not on whether you watched.

Who runs it

Registration goes to HubSpot, the same as our contact form, and HubSpot stores it in the United States. The session itself runs on StreamYard, which holds the original recording on its platform, hosted on Google Cloud. Both are outside Europe. For StreamYard we rely on the European Commission's Standard Contractual Clauses. For HubSpot and for Google we rely on their certification under the EU-US Data Privacy Framework.

How long we keep it

Registration details, and the record of what you attended or watched, for up to four years, on the same yearly clear-out as our contact form. Recordings stay up while they're still current; we review them each year and remove them, from YouTube and from StreamYard, when they're out of date.

If you used our support portal

What we collect

When you open a ticket you give us your email address, your name, and a short summary of the problem. You can add a longer description and attach a file if you want to; neither is required.

What we do with it

We use it to answer you and to fix the problem. We don't use it to advertise to you and we don't add you to marketing lists.

Where it's kept

Your ticket is stored on servers in Frankfurt, Germany. Staff in other countries may read it in order to help you.

Cookies

The support portal uses one cookie, OSTSESSID, so you can come back and see your ticket. It has to be there for the portal to work.

How long we keep it

Two years after your ticket is closed, then we delete it. If your ticket turns out to be a report of a security problem, we have to keep it longer; those records are held under a separate rule.

Reporting a security problem

If you think something has gone wrong with our systems, or with someone's information, you can tell us through our support portal. Any student, teacher, or staff member can report it, and you don't need an account.

Questions about this notice: dataprivacy@gp.academy