Read our...

RACE
ACADEMY

INTRODUCTION

This Privacy Policy explains how Espire Education Group Limited ("Espire", "we", "us") collects and uses personal data through the Race Academy app and the STEM On Track programme, and how parents and guardians give permission for this on behalf of their child. It is shown to parents at the point they are asked to give consent.

WHO WE ARE

Data controller: Espire Education Group Limited.

Data protection contact: James Foster Le-Grys, acting Data Protection Officer — james@espireeducation.co.uk

General enquiries: support@espireeducation.co.uk

Management: Adam Sirett, adam@espireeducation.co.uk, 07814 274241

1. HOW CONSENT WORKS IN RACE ACADEMY

When a teacher registers a student, we ask for the parent's or guardian's email address. We send the parent a link to complete a single online consent journey in Race Academy, which covers everything described in this policy. Each permission is requested clearly and separately within that journey, and you choose what to agree to before your child's account is activated.

Within that single journey, two different things are happening, and it matters which is which:

Some information is necessary for your child to take part at all (their name, school email and date of birth). We ask you to acknowledge this rather than "consent" to it in the legal sense, because we could not run the programme without it.

Everything else is genuinely optional, and is based on your explicit consent. You can say no to any of these and your child can still take part in full.

This distinction is explained at each step of the journey, and is reflected in the lawful bases set out in Section 4.

2. WHAT INFORMATION WE COLLECT
Necessary for participation: your child's full name, school email address, and date of birth.

Character & diversity (special category) [Optional]: ethnicity. Used, where you consent, to personalise your child's on-screen character and, in anonymised aggregate form, to monitor the diversity of our participants.

Other demographic information [Optional]: gender and year group.

Driver medical declaration (special category) [Optional]: a declaration that your child has no underlying medical condition preventing them from safely taking part as a driver.

Photographs [Optional]: images that may include your child, used to promote the programme.

Date of birth is collected, rather than age alone, because we need it to apply the correct consent rules for children under 13 and to check driver eligibility (drivers must be 16 or under by 1 June 2027). We do not use it for any other purpose.

3. HOW WE USE YOUR CHILDREN'S INFORMATION
Service Delivery: to give your child access to the Race Academy platform.

Event Management: to run race day activities safely and in line with insurance requirements.
Driver Safety: where your child takes part as a driver, we request a medical declaration from their parent with explicit consent, and to share that declaration with on-site medical providers in a genuine emergency.
Character Personalisation: to let your child design an on-screen character that reflects them, using ethnicity information where you have consented.
Equality, Diversity and Inclusion (EDI) Monitoring: to understand the diversity of the students we work with, using anonymised, aggregated information only — never to identify your child.
Communication: to share programme updates and administrative information with your child's school.
Marketing and Promotion: to promote the programme using photographs, where you have consented.

4. OUR LAWFUL BASIS FOR PROCESSING

Legitimate Interest: Name, school email, date of birth: processed under our legitimate interests, because they are necessary for your child to take part. This is not consent and cannot be "withdrawn" while your child remains enrolled, though you may ask us to delete it when they leave the programme.

Consent: Gender, year group: processed with your consent.
Consent: Marketing photographs: processed with your explicit consent.
Explicit Consent (Art. 9(2)(a)): Ethnicity (for character personalisation) and the driver medical/fitness declaration: these are special category data. We rely on your explicit consent (Article 9(2)(a) UK GDPR) in addition to a general lawful basis. The driver medical declaration, including the medical information provided, is retained until the National Finals (see Section 7) and then deleted. In a genuine medical emergency, we may also rely on the vital interests condition (Article 9(2)(c)) to share the driver medical declaration with on-site medical providers if it is not possible to confirm consent at that moment.
Equality Condition: For understanding the diversity of our participants in aggregate, we additionally rely on the equality of opportunity condition under the Data Protection Act 2018 (Schedule 1, Part 2, paragraph 8). Our Appropriate Policy Document sets out how we meet the requirements of that condition.
Legal Obligation: For race day safety and insurance compliance.

Optional and special category consent is never a condition of taking part. If you do not consent to a particular item, your child takes part normally and, where relevant, receives the generic version of that feature (for example, a freely designed character with no ethnicity recorded).

5. WHO WE SHARE INFORMATION WITH

Marca Media: Our UK-based technical partner for the Race Academy platform. Limited to two authorised staff for troubleshooting; they do not retain personal data.
Hosting Circuits: No personal data is shared with the venue hosting a race day (e.g. Whilton Mill, Silverstone). Safety and insurance compliance are managed directly by Espire.
Private Paramedics (e.g. MediTechGlobal): On-site medical providers may access your child's driver medical declaration in a genuine medical emergency during race day activities, limited to drivers for whom this consent has been given.
Event Management Agency: Supports the operational delivery of events.

We do not sell personal data, and we do not share special category data with any other third party, or for any other purpose, without your explicit consent or a legal requirement to do so.

6. WHERE AND HOW INFORMATION IS STORED

Personal data is stored securely on Google Cloud and AWS, hosted in the UK/EEA, with encryption in transit and at rest, restricted access, and compliance with ISO 27001 and SOC 2 standards. Special category data is stored only where consent has been recorded. Aggregated diversity reporting is anonymised, with small group counts suppressed so no individual can be identified. No personal data is transferred outside the UK/EEA.

7. How long we keep information

Student data: Academic year of participation, plus 3 months.
EDI data: Held only with your consent; deleted with the student record, or sooner if you withdraw consent. Anonymised, aggregated diversity data is not personal data and may be kept indefinitely.
Driver medical declaration: The completed medical declaration form, including the underlying medical information provided, is retained until the National Finals race event and then securely deleted, including from backups, within 30 days of that date.
Marketing photographs: Kept only while consent lasts; removed from future use on withdrawal. Material already printed or published cannot always be recalled.
Backups: Backups are removed within 30 days of the end of the relevant retention period, or upon a valid deletion request.

8. YOUR RIGHTS

Right to Access: Access a copy of your child's personal data.
Right to Rectification: Correct inaccurate data.
Right to Erasure: Request deletion of your child's data, subject to legal obligations.
Right to Restriction: Restrict processing in certain circumstances.
Right to Object: Object to processing based on legitimate interest.
Right to Data Portability: Request your child's data in a structured, machine-readable format.
Right to Withdraw Consent: Withdraw any consent at any time, as easily as you gave it, without affecting anything done beforehand.
Right to Complain to the ICO: If you are unhappy with how we have handled your child's data, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any right, contact info@espireeducation.co.uk.

9. CHILDREN'S POLICY

Race Academy is used by children, primarily aged 11–16, and we take extra care with their information in line with the ICO's Age Appropriate Design Code. We collect only what is necessary, explain things in plain language at the point of consent, and ensure optional and special category processing always depends on a parent's or guardian's explicit consent, verified through the parent's own email address.

10. CHANGES TO THIS POLICY

We may update this policy to reflect changes in our practices or in the law. Where a change is significant, we will tell parents directly, not just update the website.

At STEM On Track, operated by Espire Education, we are steadfast in our commitment to protecting your personal data and ensuring compliance with the UK Data Protection Act 2018 and UK GDPR. We strive to process your information transparently, securely, and only as necessary to deliver our educational programme.

Should you have any questions, wish to exercise your data protection rights, or seek further information about our practices, please contact us at:

support@espireeducation.co.uk

We value your trust and are dedicated to maintaining the highest standards of data protection in all our activities.