Privacy Policy

1. Who We Are and How to Contact Us

Wings of Hope Angels is a UK registered charity dedicated to helping children and young people develop entrepreneurship skills and confidence. We operate the Wings of Hope Angels Entrepreneurship AI Platform (the “Platform”), an artificial intelligence based learning and training tool designed specifically for young users.

If you have any questions about how we handle personal data, or wish to exercise your rights, please contact us at the email or address above.

2. About This Privacy Policy

This Privacy Policy explains how Wings of Hope Angels collects, uses, stores, and protects personal data when children and young people (aged 13 and over), their parents or guardians, and other users access or use the Platform.

We are committed to complying with:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018
• The ICO Age Appropriate Design Code (Children’s Code)
• The Privacy and Electronic Communications Regulations (PECR)

3. Children’s Data and Parental Consent

3.1 Our Commitment to Children’s Privacy

The Platform is designed for use by young people aged 13 and over. We take our responsibilities under the ICO Age Appropriate Design Code extremely seriously. This means:

• We apply the highest privacy settings by default — children are not required to share more information than is necessary to use the Platform.
• We do not use children’s data for profiling, behavioural advertising, or commercial purposes of any kind.
• We communicate in clear, age-appropriate language.
• We give children and their parents genuine control over their data.
• We do not design features that encourage children to share personal information unnecessarily.

3.2 Parental or Guardian Consent

For users aged 13 to 15, we require verified parental or guardian consent before a young person can create an account and access the Platform. For users aged 16 and 17, we collect parental or guardian consent as a best practice safeguarding measure, even though UK GDPR does not strictly require it for this age group.

Parental consent records we collect include:

• Parent or guardian name and relationship to the child
• Parent or guardian email address
• Date and record of consent given
• Any conditions or restrictions noted by the parent or guardian

Parents and guardians may withdraw consent at any time by contacting us. Withdrawal of consent will result in the child’s account being suspended or deleted, in accordance with the parent’s or guardian’s instructions.

4. What Personal Data We Collect

4.1 Account and Registration Data

When a young person registers on the Platform, we collect:

• First name and, optionally, surname or preferred display name
• Date of birth (to verify age and apply appropriate protections)
• Email address (or parent/guardian email address for younger users)
• School or organisation name (optional)
• Password (stored in encrypted form — we never store passwords in plain text)
• Country and region (to comply with applicable laws)

4.2 Project Content and Uploads

As users work on their entrepreneurship projects through the Platform, we collect and store:

• Business ideas, plans, and project descriptions created by the user
• Documents, images, and files uploaded by the user in connection with their project
• Feedback and assessments provided by the AI on the user’s project work
• Project progress data and milestones achieved

Project content belongs to the young person who creates it. We do not use individual project content to train AI models without explicit, separate informed consent from the user and their parent or guardian.

4.3 AI Interaction and Chat History

When a young person interacts with the AI on the Platform, we record:

• Conversations between the user and the AI assistant
• Prompts and questions submitted by the user
• AI responses and recommendations generated
• Date, time, and duration of AI sessions

AI interaction history is stored to enable the Platform to provide continuity of support, personalise learning, and allow users and parents to review past sessions. This data is retained only for as long as the account remains active, plus a defined retention period thereafter (see Section 9).

4.4 Technical and Usage Data

We automatically collect limited technical data to operate the Platform securely:

• IP address (anonymised or pseudonymised where possible)
• Browser type and device type
• Pages visited and features used within the Platform
• Login and logout times
• Error logs and performance data

This data is used solely for Platform operation, security, and improvement. We do not use it to build behavioural profiles of child users.

4.5 Data We Do Not Collect

We do not collect or process the following:

• Biometric data
• Government-issued identification numbers
• Financial or payment information (the Platform is provided free of charge)
• Social media profile data
• Location data beyond country and region

5. How We Use Personal Data

Where we rely on legitimate interests as our legal basis, we have conducted a balancing test and concluded that our interests do not override the rights and freedoms of child users.

6. Sharing Personal Data

We take a strict approach to sharing personal data. We do not sell, rent, or trade personal data. We share data only in the following limited circumstances:

6.1 Service Providers

We use carefully selected third-party service providers who process data on our behalf, including cloud hosting providers, email service providers, and AI technology providers. All such providers are bound by data processing agreements and are required to comply with UK GDPR. Where providers are based outside the UK or EEA, we ensure appropriate safeguards are in place (see Section 7).

6.2 Parents and Guardians

Parents and guardians who have provided consent have the right to access information about their child’s account and, subject to the child’s own rights, to review AI interaction history and project content.

6.3 Safeguarding and Legal Obligations

We may share data with statutory authorities, including child protection services or law enforcement, where we are legally required to do so or where disclosure is necessary to protect the vital interests of a child or another person.

6.4 Organisational Partners

If Wings of Hope Angels works with schools, youth organisations, or other charities in delivering the Platform, limited data may be shared with those partners to the extent necessary to administer participation, subject to appropriate data sharing agreements.

7. International Data Transfers

We aim to keep personal data within the UK wherever possible. Where we use third-party technology providers — including AI providers — that process data outside the UK, we ensure transfers comply with UK GDPR by:

• Relying on adequacy decisions made by the UK Secretary of State, where applicable
• Implementing UK-approved Standard Contractual Clauses (SCCs) or equivalent measures
• Conducting Transfer Impact Assessments where required

A list of our key technology partners and the countries in which they process data is available on request by contacting us at the address in Section 1.

8. How We Protect Personal Data

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Access controls — only authorised staff and contractors can access personal data, on a need-to-know basis
• Regular security assessments and penetration testing
• Staff training on data protection and child safeguarding
• Incident response procedures, including breach notification protocols
• Pseudonymisation of data where appropriate

No system is completely secure. In the event of a data breach that poses a risk to individuals, we will notify the ICO within 72 hours and, where required, inform affected users and parents as soon as reasonably practicable.

9. How Long We Keep Personal Data

At the end of the applicable retention period, personal data is securely deleted or anonymised. Users (and parents or guardians on their behalf) may request earlier deletion — see Section 10.

10. Your Rights and Children’s Rights

Under UK GDPR, users and their parents or guardians have the following rights in respect of personal data. Children have their own data rights which are separate from their parents’ rights — we will always consider what is in the child’s best interests when responding to any request.

To exercise any of these rights, please contact us at info@thewingsofhope.org. We will respond within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11. Safeguarding

The safety and wellbeing of young people is our highest priority. We have the following safeguarding measures in place on the Platform:

• AI interactions are subject to content filtering designed to detect and prevent harmful, inappropriate, or distressing content being generated or received.
• Where AI monitoring detects content that may indicate a child is in distress, at risk, or experiencing harm, this will be flagged to our designated safeguarding lead for review.
• Our designated safeguarding lead is trained in child protection and will follow our Safeguarding Policy, which may include referral to statutory authorities.
• We do not rely solely on automated systems for safeguarding — human review is a component of our process.

Our Safeguarding Policy is available in full on request. If you have an immediate safeguarding concern, please contact the relevant emergency services or the NSPCC helpline: 0808 800 5000.

12. Cookies and Tracking

The Platform uses essential cookies and similar technologies to operate correctly — for example, to keep you logged in during a session. We do not use advertising cookies, tracking pixels, or third-party analytics that profile child users. A detailed Cookie Policy is available separately on the Platform.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users and parents or guardians by email, display a prominent notice on the Platform, and where required, seek fresh consent. The date at the top of this Policy indicates when it was last updated.