Privacy Policy

Who we are

Tyfu is provided by Intelligent Analytical Solutions Ltd, company number 09491408. In this policy, “Tyfu”, “we”, “us” and “our” refer to Intelligent Analytical Solutions Ltd.

For privacy questions or requests, email dataprotection@tyfu.wales. You can also write to Intelligent Analytical Solutions Ltd, c/o Walker Begley Ltd, 207 Knutsford Road, Warrington, WA4 2QL.

What this policy covers

This policy explains how personal information is handled when you visit our public marketing website at www.tyfu.wales, contact us, explore our interactive demonstration, or use the Tyfu school application. The sections below distinguish those activities because they involve different information and responsibilities.

The interactive demonstration uses fictional school and pupil records. It is separate from the systems schools use to manage real pupil information. Please do not enter real pupil information into the public demonstration or our marketing enquiry forms.

Website enquiries and business communications

When you submit an enquiry, we collect your school name, contact name, email address and message. If you contact us directly, we also receive the information you choose to include in your communication.

We use this information to respond, discuss your requirements, arrange conversations or workshops and maintain a record of the enquiry. Please provide enough information for us to reply, but do not include pupil names, pupil records or other sensitive personal information.

For these activities, Intelligent Analytical Solutions Ltd acts as the data controller. Our lawful basis is legitimate interests: responding to requests about our services and managing business relationships. Where a different lawful basis applies to a particular activity, we will explain it.

How the enquiry is delivered

The enquiry form sends the details to a Firebase Cloud Function operated for Tyfu through Google’s services. Microsoft 365, using Microsoft Graph, handles email delivery to Matthew Young and Andrew Bramhall at their Tyfu email addresses. Your email address is used as the Reply-To address so we can respond directly.

The form includes a hidden field to help identify automated spam. The enquiry process does not create a school application account or a paid subscription.

How long we keep enquiries

We retain enquiries that do not lead to a customer relationship for up to 12 months after our last contact, then delete them. If an enquiry leads to a customer relationship, relevant correspondence becomes part of our customer records and is retained for that purpose. We may retain relevant information longer where necessary to meet a legal obligation or establish, exercise or defend a legal claim.

Website operation, cookies and analytics

Our main website is hosted using Without Code. Hosting and delivery of a website involve processing connection information, such as an IP address and browser request details, so pages can be delivered and the service operated and protected.

We have not configured Google Analytics in the main website’s Without Code settings. The separate interactive demonstration uses optional analytics as described below.

Interactive demonstration and optional analytics

The demonstration is hosted through Firebase Hosting. With your analytics consent, it uses Google Analytics 4 to help us understand which demonstration modules visitors explore and whether an enquiry is successfully submitted. Analytics may process online identifiers, device and browser information, approximate location and interaction information.

Our lawful basis for optional demonstration analytics is consent. You can explore the demonstration without accepting analytics. Declining analytics does not prevent you from submitting an enquiry; enquiry processing is separate from optional analytics. You can withdraw consent at any time. Contact dataprotection@tyfu.wales for help with analytics-related requests.

Information in the Tyfu school application

This section concerns the live school service. It is separate from the fictional records in the public demonstration and the marketing enquiry process.

Schools choose the information they record in Tyfu and the purposes for which it is used. For school-controlled pupil, family and staff records, the school is normally the data controller and Intelligent Analytical Solutions Ltd processes the information on its documented instructions.

Depending on the school’s configuration and use, records may include pupil identifiers and class details; assessment, progression and planning records; contextual information such as ALN, EAL or free-school-meal status; intervention records; reports; and learning evidence such as photographs, recordings, documents and comments. User account and access information is also processed to provide the service.

The school is responsible for deciding what information is appropriate and necessary, establishing its lawful basis and any required special-category condition, providing its own privacy information, and managing permissions and retention instructions. Where the school records information revealing health, disability or other special-category information, that processing must be covered by its lawful instructions and the agreed data processing arrangements.

Tyfu’s responsibilities include processing school-controlled information on documented instructions, maintaining appropriate technical and organisational security measures, restricting access to authorised people, and assisting the school with its data protection obligations as required by the applicable agreement and law. These responsibilities are not transferred to the school.

Access to school information

Access depends on the school’s configuration, assigned roles and permissions. Schools manage staff access and any enabled pupil or parent/guardian access. Tyfu personnel may access information where authorised and necessary to provide support, maintain or secure the service, or meet legal obligations.

Retention and leaving the service

The school determines how long its records should be retained and gives instructions for deletion, return or transfer under its data processing agreement. At the end of service, return or deletion of school-controlled personal data and remaining copies is handled under that agreement and applicable legal requirements.

Providers, disclosures and international processing

Provider processing and access locations depend on the services and account configurations used. A database hosting region does not by itself establish the location of all processing. Contact dataprotection@tyfu.wales for details of the arrangements and safeguards applicable to your information.

We use service providers to deliver hosting, application infrastructure and communications. The Service providers and subprocessors page distinguishes school-application providers from marketing website and demonstration providers.

Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims. Any transfer of school-controlled information must follow the applicable data processing agreement and lawful instructions.

Security and confidentiality

We use appropriate technical and organisational measures to protect the personal information we process, taking account of its nature and the risks involved. Schools must manage their own users, permissions and devices. No internet service can promise absolute security.

If a personal data breach affects school-controlled information, we will notify the relevant school without undue delay after becoming aware of it and provide assistance under the applicable data processing agreement and law. The school decides on notifications it must make as controller. For information we control, we manage any required notifications ourselves.

Your rights and how to contact us

Depending on the circumstances and lawful basis, you may have rights to access, correct or erase personal information, restrict its use, obtain a portable copy, or object to processing. These rights are subject to the conditions and exceptions in applicable law.

Right to object: where we rely on legitimate interests, you can object to processing on grounds relating to your particular situation. Contact dataprotection@tyfu.wales so we can consider your request.

Where processing relies on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

For school-controlled records, please contact your school first. If you contact Tyfu, we will assist or refer the request to the relevant school as appropriate. For website enquiries or other information we control, contact dataprotection@tyfu.wales.

You can complain to the UK Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint/ for details.

Changes to this policy

We will update this policy when our processing changes and identify the date of the current version. Where required, we will bring significant changes to the attention of the people affected.