TransferNI — Privacy Notice
1. Who we are and what this covers
1.1 Data Element Ltd is the data controller for the personal data described in this notice.
1.2 This notice explains what we collect when you and your child use the TransferNI app and website, why we collect it, how long we keep it, and the rights you have.
1.3 TransferNI is an independent transfer-test practice tool. One household account is created and managed by a Parent (18+), and used by a Child under that parent's supervision. Both people's data is described below.
2. The personal data we hold
We deliberately collect as little as the service can work with. There is no advertising, no tracking, no analytics SDK, and no third-party cookies — see §8.
About the Parent (account holder)
| Data | Why we have it |
|---|---|
| Email address | Identifies the account, sign-in, verification codes, service messages |
| Password | Stored only as a bcrypt hash — we cannot read it |
| Parent PIN | Stored only as a bcrypt hash; gates the in-app Parent Area |
| Subscription and promotional/referral records | To provide and manage paid access |
| Messages you send us | To answer support requests |
About the Child
| Data | Why we have it |
|---|---|
| Display name (a first name or nickname chosen by you) | Shown in the app so it feels like the child's own |
| Chosen avatar and colour theme | Personalisation |
| Answers given, whether each was correct, and how long each took | The core of the service — scoring, progress and weak-area analysis |
| Quizzes and mock tests taken, scores, dates | Progress tracking and history |
| Points, streaks, badges, percentile band | Motivation features |
| Practice targets | Parent-set goals |
Collected automatically
| Data | Why we have it |
|---|---|
| A "last seen" timestamp | Shows whether an account is currently active |
| Technical logs from our hosting provider (including IP address) | Security, fraud prevention, diagnosing faults |
We do not ask for a child's date of birth, school, address, photograph, or contact details. A child is identifiable to us only through the parent's account. We ask parents to choose a first name or nickname rather than a full name.
3. Where it comes from
Directly from you when you register and set up a profile; from your child's use of the app as they answer questions; and automatically from our hosting infrastructure (technical logs).
4. Why we process it, and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and running your account; delivering practice, scoring and progress features | Contract — necessary to provide the service you signed up for |
| Verifying your email; sending service and subscription notices | Contract |
| Keeping the service secure — rate limiting, PIN lockout, fraud and abuse prevention | Legitimate interests — protecting users and the service |
| Diagnosing faults and improving the service | Legitimate interests |
| Optional practice reminders and promotional emails | Consent — opt-in, withdrawable at any time |
4.1 Where we rely on legitimate interests, we have considered the impact on you and your child and do not use their data in ways they would not reasonably expect.
4.2 Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
5. Children's data
5.1 TransferNI is designed to be set up and controlled by a parent or guardian. The account is created by an adult (18+), who consents on the child's behalf where consent is the basis.
5.2 We follow the principles of the ICO's Age Appropriate Design Code: data minimisation by default, no behavioural advertising, no nudge techniques toward weaker privacy settings, and settings that default to the more protective option.
5.3 There is no child-to-child contact of any kind. Children cannot message, friend, find, or see each other. There is no chat, no profile discovery, and no public profile.
5.4 The leaderboard shows a percentile band only. A child sees their own standing — for example "Top 20%" — and nothing else. No other child's name, score, rank or existence is sent to the app. A parent can switch the leaderboard off entirely in settings.
5.5 A child's display name is whatever the parent enters. We ask for a first name or nickname.
6. Who we share it with
We do not sell personal data, and we do not share it for advertising. We use a small number of processors who act on our instructions:
| Processor | What they do | Where |
|---|---|---|
| Google Cloud Platform (Cloud Run, Cloud SQL, Cloud Storage) | Hosts the application and database, stores question images | europe-west2 (London) |
| Firebase Hosting (Google) | Serves the app and website | Google edge network |
| Resend | Sends transactional email — verification codes, account and service notices | United States |
We may also disclose data where required by law, or to establish, exercise or defend legal claims.
7. International transfers
Our application and database are hosted in the United Kingdom (europe-west2, London). Your account, your child's profile and all practice data stay there.
Email is the exception. Our email provider, Resend, stores account data, email metadata and delivery logs in the United States, whichever region an email is sent from. That means your email address and the subject lines of messages we send you are processed in the US. Resend transfers UK data under the UK Addendum to the EU Standard Contractual Clauses and participates in the UK Extension to the EU–U.S. Data Privacy Framework.
We do not send your child's name, answers, scores or any practice data to Resend.
8. Cookies and similar technologies
8.1 We use no advertising cookies, no analytics cookies, and no third-party trackers. There is no Google Analytics, no advertising pixel, and no behavioural profiling.
8.2 The app stores a small amount of information on your own device — your sign-in token, your colour theme, text-size preference, and an unfinished-quiz checkpoint so a quiz can be resumed. This stays on the device and is not used to track you across other sites.
9. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While the account is open |
| Quiz answers, scores and progress | While the account is open — this is the child's progress history |
| Support messages | 2 years from resolution |
| Security and technical logs | 90 days |
| Records needed for tax and accounting | 6 years, as UK law requires |
10. Security
Passwords and parent PINs are stored as bcrypt hashes. Access to the app requires a signed token, and parent-only areas require the PIN. We apply rate limiting to sign-in attempts and lock the parent PIN after five wrong tries. Data is encrypted in transit, and at rest by our hosting provider. Access to production data is limited to those who need it.
No service can promise perfect security, but we take these measures seriously and review them.
11. Your rights
You have the right to access the personal data we hold, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. These rights cover your child's data too, which you exercise on their behalf.
To exercise any of them, contact privacy@transferni.com. We will respond within one month.
Two of these rights are also built into the app, in the Parent Area (behind your parent PIN, because both are adult decisions):
- Request my data — files a request with us. We compile your household's data and email it to
you. We aim to do this within 7 working days, which is tighter than the one month the law allows us.
- Delete my account — closes the account and deletes your and your child's profile. It asks for
your password, your parent PIN, and for you to type DELETE, because it cannot be undone. Quiz and progress records are kept, but with the profile gone they are no longer linked to any identifiable person.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113 — though we would appreciate the chance to put it right first.
12. Changes to this notice
We may update this notice. We will change the version and effective date above and, for material changes, tell you in the app. The app records the version you accepted.
13. Contact
privacy@transferni.com · Data Element Ltd (NI742601), Northern Ireland.