CimotaTech Ltd / Handwriting Horizons

At CimotaTech, safeguarding pupil data is our foundational engineering principle. We fully comply with the Information Commissioner’s Office (ICO) Age Appropriate Design Code (Children’s Code). Drawing on over a decade of experience in highly regulated cybersecurity and financial markets, we have engineered Handwriting Horizons to provide enterprise-grade privacy and protection for primary-aged pupils (EYFS to KS2).

Below is our public commitment detailing how our architecture meets the core standards of the ICO Children’s Code.

1. Best Interests of the Child

The primary design mandate of Handwriting Horizons is to support educational development without exploiting pupil attention or data. Our platform exists solely to deliver biomechanical handwriting pedagogy. We do not monetize pupil attention. There are zero advertisements, zero in-app purchases, and zero behavioral monetization loops.

2. High Privacy by Default

Pupils are automatically granted the highest possible privacy settings the moment they log in.

• Pupils cannot change their privacy settings to a lower standard.
• Pupil profiles are entirely closed; they cannot search for, contact, or share data with other users on the platform or externally.

3. Data Minimization & Secure MIS Integration

We strictly process only the absolute minimum data required to deliver our educational service.

• Through our secure read-only integration with Wonde, we only sync essential class roster data from the school’s Management Information System (MIS).
• We do not scrape, request, or store extraneous pupil records, behavioral logs, or medical data.
• When a pupil is removed from the school’s MIS, our automated sync immediately flags their data for secure deletion.

4. Zero Nudge Techniques

Handwriting Horizons does not use "nudge techniques" to encourage children to provide unnecessary personal data, weaken their privacy settings, or extend their screen time beyond the pedagogical requirements of the handwriting intervention.

5. Identity & Access (No Passwords)

To protect against compromised credentials and reduce cognitive load for young children, we do not issue or store passwords. All authentication is managed via Zitadel Single Sign-On (SSO), routing securely through the school's existing identity providers (Google Workspace, Microsoft Entra ID, or Hwb).

6. Geolocation & Profiling

• Geolocation: We do not track, process, or store the physical location of any pupil device.
• Profiling: We do not use algorithms to profile children for marketing, content feed manipulation, or targeted advertising. Data is processed solely to generate pedagogical progression reports (e.g., grapheme mastery) for the school’s teaching staff.

7. Data Sharing

CimotaTech Ltd does not—and will never—sell, rent, or trade pupil data to third parties, data brokers, or marketing agencies. Data is securely processed on UK-based Google Cloud infrastructure strictly for the provision of the Handwriting Horizons platform to the contracted school or Multi-Academy Trust.

8. Transparency & Age-Appropriate Communication

While our primary legal agreements (such as the Data Processing Agreement) are executed with the school's Data Protection Officer and Executive Leadership, our user interface is designed to be clear and transparent. Error messages and system prompts within the pupil-facing application are written in age-appropriate, accessible language (available natively in English and Welsh).

Data Protection Officer (DPO) Contact

If you are a Multi-Academy Trust DPO, a Local Authority safeguarding lead, or a parent seeking further information regarding our DPIA (Data Protection Impact Assessment) or technical infrastructure, please contact our compliance team directly.

Email: compliance@cimotatech.co.uk

Registered Office: CimotaTech Limited, Unit F1 Intec, Parc Menai, Bangor, Gwynedd, Wales, LL57 4FG