Privacy Policy

1. Who We Are

The Arena Hub Ltd (“The Arena Hub”, “we”, “us”, “our”) is a company registered in England and Wales under Company Number CH#1708605. Our registered address is available on request.

We are the Data Controller for any personal data you provide to us directly (e.g. during account setup or when contacting us). For pupil and staff data that your school uploads into the Arena Hub platform, your school acts as the Data Controller and we act as a Data Processor on your behalf.

To contact us regarding data protection matters: j.baguley@thearenahub.co.uk

2. What Data We Collect

2.1 Data You Provide to Us

• Contact enquiries: Name, email address, school name, and the content of your message when you contact us via the website or by email.
• Account & subscription set-up: Name, job title, school name, email address, phone number, and billing details (processed by Stripe — see Section 6).
• Pilot programme: School name, head teacher name and email, DSL name and email, and school code, collected during the deployment and unboxing process.

2.2 Pupil and Staff Data (School-Controlled)

When your school uses the Arena Hub platform, you may upload or create records containing:

• Pupil data: full name, preferred name, Unique Pupil Number (UPN), date of birth, year group, form group, gender, SEND needs, and daily attendance registers.
• Welfare data: DSL case notes, welfare anchors, chronology entries, and AI-generated pattern insights.
• Staff data: name, email address, role, and permission level.
• Qualification and resource data: vocational course records, equipment logs, and partner-managed course registrations.

This data is stored in your school’s own Google Workspace environment (Google Drive), which you control. We do not hold a central copy of pupil or staff records.

2.3 Technical and Usage Data

• Browser type, device type, and operating system (collected automatically when you access our website).
• Pages visited and time spent on site (via anonymised analytics).
• IP address (standard web server logging — not linked to individuals).
• Errors and performance data from the Google Apps Script platform (used to maintain service reliability).

3. How We Use Your Data

We use personal data only for the following purposes:

• To provide and maintain the Arena Hub platform and associated services.
• To respond to enquiries and provide customer support.
• To process subscription payments via Stripe.
• To deploy and configure the platform for your school during onboarding.
• To send service-related communications (e.g. maintenance notices, pilot updates). We do not send marketing emails without your explicit consent.
• To comply with legal obligations, including data protection law.

4. Our Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract: Processing necessary to fulfil our agreement with you (e.g. platform access, billing).
• Legitimate Interests: Maintaining service security, preventing fraud, and improving platform reliability — where these do not override your rights.
• Legal Obligation: Where we are required to process data to comply with applicable law.
• Consent: Where you have explicitly opted in (e.g. marketing communications — which we do not currently send).

For pupil and staff data processed on behalf of your school, we process under your instruction as Data Controller, in accordance with our Data Processing Agreement.

5. Where Your Data Is Stored

The Arena Hub uses a Sovereign Hybrid architecture. This means:

• School data (pupils, staff, welfare records) is stored in your school’s own Google Drive, within your Google Workspace environment. It never leaves your organisation’s Google account unless you choose to export it.
• Platform logic runs via Google Apps Script, hosted within Google’s infrastructure (data centres in the European Economic Area or United Kingdom).
• Kit Room file ingestion uses Google Cloud Run (EU region) for processing physical resource and qualification data. No pupil-identifiable data passes through this component.
• Contact and enquiry data is held in our Google Workspace account (j.baguley@thearenahub.co.uk), hosted within Google’s UK/EEA infrastructure.

We do not transfer personal data outside the UK or EEA.

6. Payment Processing — Stripe

All subscription payments for the Arena Hub platform are processed by Stripe Payments Europe Ltd, our third-party payment processor.

• When you make a payment, you are entering your card details directly into Stripe’s secure payment interface. We never see, handle, or store your card number, CVV, or full payment details.
• Stripe retains your billing information (name, billing address, last four digits of card, and transaction records) in accordance with their own privacy policy, available at stripe.com/gb/privacy.
• Stripe is certified to PCI DSS Level 1, the highest standard of payment security certification.
• We receive from Stripe only a payment confirmation token and your billing name — sufficient to confirm your subscription status.

By making a payment through our platform, you acknowledge that your payment data is processed by Stripe under their terms and privacy policy.

7. Data Sharing and Third Parties

We do not sell, rent, or commercially share your personal data. We share data only in the following limited circumstances:

• Stripe — payment processing (see Section 6).
• Google LLC — infrastructure provider for Google Workspace, Google Apps Script, and Google Cloud Run. Google processes data under our Data Processing Agreement with them, in accordance with UK GDPR.
• Legal obligation — where we are required to disclose information by law, court order, or to protect the vital interests of a data subject.

We do not use your data to train AI or machine learning models. Any AI features within the platform (e.g. welfare letter drafting, pattern insights) operate only on data within your school’s own Google Drive environment.

8. How Long We Keep Your Data

• Contact enquiries: Retained for up to 2 years, then securely deleted.
• Billing records: Retained for 7 years to comply with HMRC accounting obligations.
• School deployment records: Retained for the duration of your subscription plus 1 year following termination.
• Pupil and staff data: Held in your school’s Google Drive. Retention is your responsibility as Data Controller. We provide a Ground Zero backup at deployment which you can delete at any time.

9. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectification of any inaccurate data.
• Erasure (“right to be forgotten”) in certain circumstances.
• Restriction of processing in certain circumstances.
• Portability of data you have provided to us, in a structured, commonly used format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, where consent is the lawful basis.

To exercise any of these rights, contact us at j.baguley@thearenahub.co.uk. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by telephone on 0303 123 1113.

10. Cookies

Our website uses only essential functional cookies required for the site to operate. We do not use advertising, tracking, or analytics cookies. No cookie consent banner is displayed because no non-essential cookies are set.

The Arena Hub platform itself (the Google Apps Script web apps) does not set cookies. Session authentication is handled via Google’s OAuth mechanism, which is governed by Google’s own cookie and privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes, we will notify active subscribers by email. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.