Tyfu aims to help schools, learners and parents/guardians with assessment in the new Curriculum for Wales. Protecting your privacy is fundamental to us, and this Privacy Policy governs the use of Personal Information collected by our Tyfu system and our websites at www.tyfu.wales and www.tyfu.cymru. This includes, for example, personally identifiable information that we collect when you create an account, content added to learning journals, activities teachers create (“Activities”), and messages (“Messages”) sent via Tyfu. 

In order to use Tyfu, you must create an account and agree to this Privacy Policy. If you don’t agree with this Privacy Policy, you cannot use Tyfu. You can contact us anytime with questions about this policy at dataprotection@tyfu.wales.

For purposes of this Privacy Policy, “Personal Information” means any information about an identifiable individual or information that can be used to identify an individual, and includes “Personal Data” as that term is defined under the Data Protection Act 2018(“DPA”). “Learner Data” means any personal information, metadata, or content directly attributable to a student user.

Tyfu complies with the Data Protection Act 2018 and allows residents of the UK to exercise their rights described therein. The purposes for which Tyfu collects your information, the categories and specific types of information, and our practices and policies regarding the processing of your information are described in this Privacy Policy and our Data Processing Agreement. If you have specific questions about how Tyfu is compliant with the GDPR, contact dataprotection@tyfu.wales

We collect information from individuals who have accounts on Tyfu, which includes teachers, learners, and parents/guardians. 

We receive information from the information that schools, learners, teachers and parents provide. The categories of sources from which we collected or received information include:

• You: We collect the content, communications, and other information you provide when you use Tyfu.

• Other people/schools: We collect information that other people provide when they use Tyfu. This is primarily schools, who upload learner details from their existing systems. 

Account information: When you create an account on Tyfu we collect your name, email address, password. 

Learners cannot create their own accounts by themselves but must be added to a Tyfu class by a teacher or school administrator. Where learners are added to Tyfu, Tyfu collects personally identifiable information (Learner Data) that is necessary to provide the Service, including a learners’s name, email address, and optional all about me picture. In addition, standard information already collected by schools such as date of birth, gender, free school meal entitlement, ALN and EAL status can be entered into Tyfu by teachers or administrators.

Learning journal content: Tyfu collects content that is added to a learner journal. This content may include photos, audiovisual content (including from your device’s camera, microphone, or photo/video library), drawings, voice notes, files, notes, hyperlinks, and other ways of documenting student learning. 

Learning goals: Teachers may use Tyfu to create learning goals to use with their learners. Journal content may be linked to these goals, and both learners and teachers can mark when goals are met.

Progression steps: Teachers may use Tyfu to mark when learners have attained progression steps. Journal content may also be linked to these steips, and both learners and teachers can mark when steps are met. 

Communications: Tyfu collects any information you send to us directly, such as email, phone, or chat communications, or through your responses to our optional surveys.

Log data: When you use Tyfu we collect login time and date.

We use this information to:

• Allow learners, teachers, parents/guardians to access and use the Service by verifying your identity and storing Learning Journal Content.

• Provide support to teachers, school administrators, and parents/guardians.

• If you’ve enabled notifications, notify you about activity on and updates to your account or accounts of learners linked to your account.

• Investigate, prevent, and detect activities on our service that we believe may violate the law, applicable regulations, or Tyfu policies. We may, at the request of a school, investigate accounts to determine whether they comply with school policies.

You can withdraw consent for the collection of your Personal Information at any time, but you will no longer be able to use Tyfu. 

Special category data, as defined by the DPA, is data relating to: 

racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where used for identification purposes), health, a persons sex life or a person’s sexual orientation.

Tyfu does not collect special category data. Free text fields do exist within Tyfu to allow teachers, learners and parents to contribute to learning journals, but Tyfu’s terms of service exclude the use of these fields for the collection of any special category data.

In the event of a school’s agreement with Tyfu being terminated, Tyfu will delete all data within four weeks. Schools will be given an option of all tracking data being returned to them in usable format, and learning journal content will be deleted. If individual learners move schools to another school using Tyfu, data will be transferred only with the express consent of both schools. If this consent is not given, the learner’s data will be deleted within four weeks.

No. Tyfu does not allow third-party advertising or share data for that purpose. 

We share data with third parties in the limited circumstances detailed below:

• We use a third-party service provider in order to operate Tyfu – to store data, and generate push notifications or emails. These services need access to your Personal Information in order to work (e.g. your email address is required to send you an email), but they are contractually obliged to meet our strict security standards, maintain the accuracy of the data they collect, and must only use Personal Information in identifiable form for purposes of providing the Tyfu service. 

• We may disclose your information to a third party to comply with applicable laws or regulations, or a valid legal request - including to meet national security or law enforcement requirements. If we are compelled to release your data, we will do our best to provide you with advance notice by email, unless we are prohibited from doing so by law.

• We may disclose or transfer your Account Information and Journal Content in connection with the sale, merger, bankruptcy, sale of assets, or reorganization of our company. You will be notified via email or some other means as required by law of any change in ownership or uses of your Personal Information, as well as any choices you may have regarding your information (including the right to delete your information). The promises in this Privacy Policy will apply to your data as transferred to the new entity. If Tyfu goes out of business without a successor, Tyfu will delete your information.  

An individual’s learning journal is only visible to teachers, the learner themself and their parents/guardians (access for parents/guardians is controlled by the school). Teachers decide whether parents/guardians can view, or comment on a learner’s journal. Teachers have full moderation capabilities over learning journal entries, and it is not possible for learners to see any journals other than their own. Category information (gender, ALN status, etc) is only visible to teachers and school administrators.

School administrators can access all learning journals in their school.

No. Our website is purely for informational purposes, and we don’t use cookies.

You have the right to access, correct, or download for transport to a similar service any of your Personal Information collected by Tyfu, where permitted under applicable law. If you are an administrator, teacher, or parent/guardian you can update the information associated with your Tyfu account directly by logging into your Tyfu account and viewing the Account Settings tab on your profile. If you are a parent or guardian and want to correct, edit, download, or update information about your child, please work directly with your teacher or school, or you can contact us at help@Tyfu.me.

We take protecting your security and privacy extremely seriously and we've put a number of measures in place to protect the integrity of your information. Data is stored in access-controlled, ISO27001 certified data centres, no data is stored locally on devices, and all data is encrypted both in transit and at rest. Employees have restricted access to user information, with two factor authentication required for login. 

In the event of a security breach, Tyfu will notify affected account holders within the amount of time required by law so that you can take steps to keep your data safe. 

If you have any questions or feedback about this Privacy Policy, please contact dataprotection@tyfu.wales. You can reach Tyfu by post at:

Cradle Care Software,

Wrexham Enterprise Centre

11-13 Rhosddu Road

Wrexham

LL11 1AT

Website Complaint Submission: https://ico.org.uk/concerns/handling/