Privacy Notice
Last updated: July 2026
1. Introduction
This privacy notice explains how the Play Pedagogy Award (PPA) platform collects, uses, stores, and shares your personal data. It applies to all users of the platform, including school staff who register for the award programme, visitors who use our website, and anyone who interacts with our AI chatbot, Gargi. We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data Controller
The data controller for the personal data processed through this platform is:
Play Scotland
Registered charity (Scottish Charity Number SC029167)
Hopetoun Gate, 8b McDonald Road, Edinburgh EH7 4LZ
3. Data Protection Contact
If you have any questions about this privacy notice or how we handle your personal data, please contact our Data Protection Lead:
Email: fiona@playscotland.org
4. Personal Data We Collect
We collect and process the following categories of personal data, depending on how you interact with the platform:
4.1 School Registration Data
When a school registers for the Play Pedagogy Award, we collect:
- School name
- Contact name (the staff member submitting the registration)
- Contact email address
- Local authority
- Role or position within the school
- A short message explaining why the school wishes to join the programme
4.2 Member Account Data
When a member account is created following approval, we store:
- Email address
- Password (stored in hashed form only; we cannot read your password)
- Name
- Role
4.3 Contact Messages
If you send us a message through the platform's contact feature, we collect your user identifier and the content of your message.
4.4 AI Chatbot Conversations
When you use our AI assistant, Gargi, the messages you send are processed in real time to generate responses. Your most recent messages (up to the last three) are retained temporarily within your session to maintain conversational context. These messages are sent to a third-party AI provider (Groq Inc.) for processing. Please see Section 7 (AI-Specific Transparency) and Section 9 (Data Recipients) for further details.
4.5 Analytics and Browsing Data
We use Google Analytics (measurement ID: G-DDYD0EZPJ6) to understand how visitors use our website. This may include data such as pages visited, time spent on the site, referring URLs, browser type, device type, and approximate geographic location. Google Analytics uses cookies to collect this information. Please see Section 12 (Cookies) for more details.
5. Lawful Basis for Processing
Under the UK GDPR, we must have a lawful basis for each processing activity. The table below sets out the lawful basis we rely on for each purpose:
| Processing Activity | Lawful Basis |
|---|---|
| Processing school registrations and managing the award programme | Contract— necessary for the performance of the agreement between the school and Play Scotland to participate in the award programme |
| Creating and managing member accounts, including authentication via magic-link emails | Contract— necessary to provide the platform services you have registered for |
| Responding to contact messages and enquiries | Legitimate interest— it is in our legitimate interest and yours to respond to enquiries about the platform and award programme |
| Processing AI chatbot conversations to generate responses | Legitimate interest— providing an AI assistant to support educators in accessing play pedagogy guidance |
| Website analytics and improving the platform | Consent— analytics cookies are only set with your consent, managed through our cookie consent mechanism |
| Sending marketing communications or newsletters about Play Scotland activities | Consent— we will only send marketing communications where you have given your explicit consent, which you may withdraw at any time |
6. How We Use Your Data
We use the personal data we collect for the following purposes:
- To process and administer school registrations for the Play Pedagogy Award
- To create and manage member accounts and provide access to platform resources
- To send magic-link authentication emails so members can securely log in
- To respond to messages and enquiries submitted through the platform
- To provide AI-powered guidance through the Gargi chatbot, including optional web search functionality
- To analyse website usage and improve the platform through aggregated analytics
- To send marketing or newsletter communications where consent has been given
7. AI-Specific Transparency
The Play Pedagogy Award platform includes an AI chatbot called Gargi, designed to support educators with information and guidance about play pedagogy. We want to be transparent about how this feature works:
- Third-party AI processing: When you send a message to Gargi, your message is transmitted to Groq Inc., a third-party AI provider based in the United States. Groq processes your message using a large language model (LLaMA) to generate a response.
- Optional web search: If the web search feature is enabled in the chat interface, your query may also be sent to Tavily (a third-party web search API, also based in the United States) to retrieve relevant web content that informs the AI response.
- Conversation context: To maintain conversational continuity, up to your last three messages are included when sending a request to the AI provider. These are not stored permanently and exist only for the duration of your session.
- No automated decision-making: The chatbot does not make decisions that have legal or similarly significant effects on you. Responses are informational only and should not be treated as professional advice.
- Recommendation: Please do not share sensitive personal information, confidential data about pupils, or any special category data within the chatbot. The chatbot is designed for general play pedagogy queries only.
8. Children's Data
The Play Pedagogy Award platform is designed for use by school staff and educators. It is not intended for children, and we do not knowingly collect personal data from children.
If, in the course of using the platform (for example, through the chatbot or contact features), a user inadvertently shares personal data relating to a child, we will take the following steps:
- Delete the data as soon as we become aware of it, where technically feasible
- Not use the data for any purpose other than deletion
- Notify the user and, where appropriate, the school's data protection lead
We strongly advise school staff not to share any personally identifiable information about pupils or other children when using the platform, including in chatbot conversations or contact messages.
9. Data Recipients and Processors
We share your personal data with the following third-party service providers who act as data processors on our behalf. Each processor is bound by contractual obligations to handle your data securely and only for the purposes we specify:
| Processor | Purpose | Location |
|---|---|---|
| MongoDB Atlas | Database hosting for all platform data (registrations, accounts, messages, content) | United States |
| Groq Inc. | AI chatbot processing (generating responses to user queries via LLaMA language model) | United States |
| Tavily | Web search API for chatbot (retrieving relevant web content when search is enabled) | United States |
| Resend | Transactional email delivery (magic-link authentication emails) | United States |
| Google (Analytics) | Website analytics and usage measurement (measurement ID: G-DDYD0EZPJ6) | United States |
| Vercel | Website hosting and application deployment | United States / Global |
10. International Data Transfers
As set out in Section 9, several of our data processors are based in the United States. This means your personal data is transferred outside the United Kingdom.
Where personal data is transferred to the United States or other countries outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements. These safeguards may include:
- UK adequacy regulations: where the UK government has determined that a country provides an adequate level of data protection
- International Data Transfer Agreement (IDTA): the UK-approved standard contractual clauses that provide appropriate safeguards for international transfers
- UK Addendum to EU Standard Contractual Clauses: where processors use EU SCCs supplemented by the UK Addendum approved by the ICO
If you would like more information about the specific safeguards applied to transfers of your data, please contact us using the details in Section 3.
11. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:
| Data Type | Retention Period |
|---|---|
| School registration data | For the duration of the school's participation in the award programme, plus 12 months after the school withdraws or the programme concludes |
| Member accounts | Until the account holder requests deletion or the account has been inactive for 24 months, whichever occurs first |
| Contact messages | Up to 12 months from the date of the message, unless the message relates to an ongoing matter |
| AI chatbot conversations | Not permanently stored. Session-level context (last three messages) is held in memory only for the duration of the active session and is discarded when the session ends |
| Analytics data (Google Analytics) | Retained by Google in accordance with their data retention settings. We have configured a retention period of 14 months for user-level data |
When personal data is no longer required, it is securely deleted or anonymised. Retention periods are reviewed periodically and may be updated.
12. Cookies
Our website uses cookies — small text files placed on your device — to help the site function properly and to understand how visitors use it.
We use the following types of cookies:
- Strictly necessary cookies: These are essential for the website to function (for example, session cookies for authentication). They do not require your consent.
- Analytics cookies: Google Analytics cookies are used to collect anonymised data about how visitors use the site. These cookies are only set with your consent, which you can provide or withdraw through our cookie consent mechanism.
You can manage your cookie preferences at any time through your browser settings or through our cookie consent tool. Disabling analytics cookies will not affect the functionality of the platform.
13. Your Rights Under UK GDPR
Under the UK GDPR, you have the following rights in relation to your personal data:
- Right of access: You have the right to request a copy of the personal data we hold about you.
- Right to rectification: You have the right to ask us to correct any personal data that is inaccurate or incomplete.
- Right to erasure: You have the right to ask us to delete your personal data where there is no compelling reason for us to continue processing it.
- Right to restriction of processing: You have the right to ask us to limit how we use your personal data in certain circumstances.
- Right to data portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
- Right to object: You have the right to object to the processing of your personal data where we are relying on legitimate interest as the lawful basis, including for direct marketing purposes.
- Right to withdraw consent: Where we rely on your consent to process your data (for example, for analytics cookies or marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at fiona@playscotland.org. We will respond to your request within one month.
14. Right to Complain
If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the UK's supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
We encourage you to contact us first so that we can try to resolve your concern directly.
15. Changes to This Privacy Notice
We may update this privacy notice from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify registered users by email. We encourage you to review this notice periodically.
16. Contact Us
If you have any questions about this privacy notice or wish to exercise your data protection rights, please contact:
Play Scotland
Email: fiona@playscotland.org
You may also wish to review our Terms of Service.