Privacy Policy

Privacy Policy

Last reviewed 30 October 2026

CimotaTech Ltd / Handwriting Horizons

Last Updated: October 2026

This Privacy Policy explains how CimotaTech Ltd ("we", "us", or "our") collects, uses, secures, and legally protects personal data. This policy applies to our corporate website, the Handwriting Horizons platform (handwriting.education and llawysgrifen.cymru), and all related B2B communications.

We are committed to absolute transparency and strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Information Commissioner’s Office (ICO) Age Appropriate Design Code (Children's Code).

1. Our Dual Role Under UK GDPR

  • As a Data Processor (The Handwriting Platform): When providing our educational software, the contracting school is the Data Controller. We process pupil and staff data strictly on their documented instructions via our Wonde API integration.
  • As a Data Controller (Our Business Operations): When you engage with our corporate website or enter a B2B contract, CimotaTech Ltd acts as the Data Controller for your professional contact data.

2. The Platform: How We Process School Data (Processor Role)

When a school authorizes Handwriting Horizons via Wonde, we process the minimum amount of data required to deliver a pedagogically tailored service.

What we process:

  • Standard Pupil Data: First name, last initial, Year Group, Class Name, and Unique Pupil Number (UPN) strictly for secure database matching.
  • Special Category Data (SEND): Specific Special Educational Needs and Disabilities (SEND) indicators (e.g., flags for dyspraxia, dyslexia, visual impairments, or motor-skill interventions) ingested via the school's MIS to automatically tailor the accessibility features and pedagogical interventions of the platform for that specific learner.
  • Staff Data: Name, school email address, and assigned classes.
  • Pedagogical Data: Handwriting progression metrics and grapheme motor-skill acquisition data.

What we DO NOT process:

  • We do not process full medical records, safeguarding notes, or any Special Category data beyond the specific pedagogical flags required for platform accessibility.
  • We do not create or store user passwords.
  • We do not use any pupil data for profiling, automated decision-making, or third-party marketing.

Data Retention & Deletion: Pupil data is synced continuously with the school’s MIS. If a pupil leaves the school, our Wonde integration automatically flags their profile (including all SEND history and progression data) for permanent deletion. Upon termination of a MAT contract, all associated tenant data is securely destroyed.

3. Business Operations: How We Handle Corporate Data (Controller Role)

When you engage with CimotaTech as a business lead, Headteacher, or IT Director:

  • Data Collected: Name, professional email, school/MAT name, job title, and billing details.
  • Lawful Basis: We process this data for the performance of a contract (Article 6(1)(b)) or our legitimate interests (Article 6(1)(f)) in running our B2B SaaS business.
  • Usage: To send onboarding packs, compliance updates, and invoices. We never sell professional contact data.

4. Children’s Privacy & The ICO Children’s Code

Handwriting Horizons is engineered with privacy-by-design at its core. We fully comply with the 15 standards of the ICO Children's Code:

  • High Privacy by Default: Pupil interfaces contain zero social sharing, no chat features, and no external hyperlinks. SEND status is structurally hidden from the pupil interface to prevent peer visibility.
  • No Nudge Techniques: We do not use gamified behavioral nudges to encourage children to stay on the platform longer than pedagogically necessary.
  • Data Minimization: We only display a child's last initial on the user-facing dashboards.

5. Sub-processors and Data Sovereignty

To deliver a highly available service, we use enterprise-grade third-party infrastructure. All personal data remains strictly within the United Kingdom.

  • Google Cloud Platform: Hosting and encrypted database infrastructure (London/Cardiff regions).
  • Wonde Ltd: Secure MIS synchronization (UK).
  • Zitadel: Identity and SSO routing (UK hosted).

6. Security Measures

  • Encryption: Data is encrypted at rest using AES-256 and in transit using TLS 1.3.
  • Access Control: Strict Role-Based Access Control (RBAC). CimotaTech engineers do not have default access to live school databases; such access requires logged authorization for P1 support tickets only.

7. Your Data Protection Rights

  • For Pupils and Parents: Because the school is the Data Controller, all Subject Access Requests (SARs) or deletion requests regarding pupil data must be directed to the school’s Data Protection Officer (DPO). CimotaTech will rapidly assist the school in fulfilling these requests.
  • For Business Contacts: If you wish to access, update, or delete your professional data held by CimotaTech, please email us directly.

8. Contact Us

For any questions regarding this Privacy Policy, our data architecture, or to request our Data Protection Impact Assessment (DPIA) template, please contact our Compliance Team:

  • Email: compliance@cimotatech.com
  • Registered Entity: CimotaTech Limited
  • Location: Unit F1 Intec, Parc Menai, Bangor, Gwynedd, LL57 4FG