Privacy Policy

This Privacy Policy explains how ULEARNA TECHNOLOGY LTD (Company Number: 16128306) ("we", "us", "our") collects, uses, discloses, and protects personal data when you use CLAST.io (the "Platform"), a cloud-based education ERP and AI-enabled system.

This policy is drafted in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Processor / Service Provider:

For most data processed on the Platform, educational institutions are the Data Controller, and ULEARNA TECHNOLOGY LTD acts as a Data Processor.

This Privacy Policy applies to:

• Visitors to the CLAST.io website
• Institutional customers
• Authorised users (administrators, staff, teachers)

Student and learner data is processed only on behalf of institutions and governed primarily by the relevant institution's privacy notices and our Data Processing Agreement (DPA).

Depending on your role and use of the Platform, we may process:

We do not intentionally collect biometric data or special-category data unless required by the institution and legally permitted.

We process personal data to:

• Provide and operate the Platform
• Authenticate users and manage accounts
• Deliver customer support
• Improve performance, security, and reliability
• Comply with legal obligations

AI-powered features may process data to provide automation or assistance but do not make legally binding or autonomous decisions.

Under UK GDPR, we rely on the following lawful bases:

• Contract – to deliver services to institutions
• Legal obligation – regulatory and compliance requirements
• Legitimate interests – security, fraud prevention, service improvement
• Consent – where explicitly required

CLAST.io is designed for educational use. Children's data:

• Is processed strictly on the instructions of institutions
• Is not used for marketing or profiling
• Is protected by technical and organisational safeguards

Parents or guardians should contact the relevant institution for rights requests.

We may share data with:

• Cloud hosting and infrastructure providers
• Payment processors (institution-level only)
• Analytics and monitoring providers

All third parties are contractually bound to confidentiality and data protection obligations.

We do not sell personal data.

Where data is transferred outside the UK:

• Appropriate safeguards are applied (e.g. UK SCCs)
• Transfers comply with UK GDPR requirements

• Data is retained only as long as necessary to provide services
• Upon contract termination, data is returned or deleted in accordance with the DPA
• Backup retention follows industry best practices

We implement appropriate safeguards, including:

• Encryption in transit and at rest
• Access controls and role-based permissions
• Regular security monitoring and testing

No system is 100% secure, but we take reasonable measures to protect data.

Individuals have the right to:

• Access personal data
• Rectify inaccurate data
• Erase data (where applicable)
• Restrict or object to processing
• Data portability
• Lodge a complaint with the ICO

Requests should be directed to the relevant institution or to us where appropriate.

CLAST.io uses essential cookies and similar technologies necessary for platform functionality. Optional analytics cookies may be used with consent.

We may update this Privacy Policy periodically. Material changes will be communicated through the Platform or website.

For privacy-related questions:

Email: legal@clast.io