Privacy notice

01Who we are

FirstDay is provided by legal name of the company to be confirmed, registered at registered address to be confirmed.

• KRS: KRS number to be confirmed
• NIP: NIP to be confirmed
• REGON: REGON to be confirmed

For anything about this notice or your personal data, write to privacy contact email address to be confirmed.

Data Protection Officer: data protection officer details to be confirmed.

02Two roles: controller and processor

On this website and in our own business, we are the controller. That covers enquiries sent through our forms, our relationship with the schools we work with, and the accounts and billing contacts that relationship needs.

In the platform, your school is the controller and we are its processor. A school decides what it records about pupils, families, applicants, visitors and staff, who on its team can see it, and how long it keeps it. We process that data only on the school's instructions, under a data processing agreement with the school.

If you are a parent, pupil, applicant or member of staff and your question is about information your school holds, please contact the school first. It is responsible for that data and can act on your request directly; we will help the school do so.

03What we collect on this website

• Enquiries. When you register interest we receive your name, your work email and, if you give it, your school's name. We record it as an enquiry in our own FirstDay account so we can reply.
• Abuse protection. Our forms are protected against automated submissions and repeated requests. For rate limiting we keep only a salted, one-way hash of your IP address, never the address itself, and expired records are deleted daily.
• Cookies. This website does not use analytics or advertising cookies.

04What the platform holds for a school

What is held depends on what a school records and which modules it switches on. Typically it includes:

• Enquiries and admissions: family and applicant contact details, tour and open-day bookings, notes and documents families upload.
• Pupil records: year group, class, attendance and, where used, timetable, assessments, clubs and transport details.
• Fees: payers, fee agreements, invoices and payment status.
• Staff: user accounts, roles and, where used, absence and leave records.
• Site safety: visitor records and fire-drill roll calls, where those modules are used.
• An audit log of changes, so a school can see who changed what and when.

Some modules let a school record more sensitive information, such as wellbeing notes. The school decides whether to use them and which roles can see that information.

05Why we use personal data, and our lawful bases

Where we are the controller, we rely on the following lawful bases under the UK GDPR and the EU GDPR:

Where we are a processor, the school is responsible for the lawful basis for its own processing; we act on its instructions.

06How long we keep data

• Enquiries sent through this website: how long enquiries are kept to be confirmed.
• Rate-limiting records: deleted automatically once they expire, in a daily sweep.
• Platform data: kept for as long as the school decides. The platform gives schools tools to enforce their own policy. For example, a school can set a window after which documents uploaded for an enquiry that was lost or deleted are removed automatically, and a window after which visitor records are anonymised. Both are off until the school sets them.
• When a school's agreement ends: data return and deletion on exit to be confirmed.

07How we protect data

• Each school's data is kept separate from every other school's.
• Access inside a school is governed by roles and permissions the school controls.
• Changes are written to an audit log.
• Uploaded files are held in private storage and opened only through short-lived links.
• Public forms are protected against automated and repeated submissions.

08Your rights

Under the UK GDPR and the EU GDPR you can ask to:

• access the personal data held about you;
• have inaccurate data corrected;
• have data erased, or its use restricted;
• object to processing based on legitimate interests;
• receive data you provided in a portable format;
• withdraw consent, where processing relies on it.

Write to privacy contact email address to be confirmed. If your request concerns data a school holds in the platform, we will pass it to the school, which decides how to respond.

You can also complain to a data protection authority: in Poland, the President of the Personal Data Protection Office (UODO); in the UK, the Information Commissioner's Office (ICO); elsewhere in the EEA, the authority where you live or work.

09Recipients of personal data and international transfers

We do not sell personal data, and we disclose it only where this is necessary for the purposes described in this notice, where the law requires or permits it, or, in respect of data we process on a school's behalf, where the school has instructed us to do so.

Within those limits, personal data may be disclosed to the following categories of recipient: our authorised personnel, who are bound by obligations of confidentiality; professional advisers, auditors and insurers, where reasonably necessary; courts, public authorities and law enforcement bodies, where we are legally obliged to do so; a successor to all or part of our business, subject to equivalent protections; and the service providers that host, operate and support the website and the platform on our behalf.

Where a service provider processes personal data on our behalf, it acts as our processor or, in respect of data we process for a school, as our sub-processor within the meaning of Article 28 of the UK GDPR and the EU GDPR. Each is engaged under a written agreement requiring it to act only on our documented instructions, to keep the data confidential, to implement appropriate technical and organisational measures, and to assist us in meeting our obligations. Schools are informed of sub-processors in accordance with their data processing agreement.

At the date of this notice, and subject to confirmation in its final form (confirmed sub-processor list to be confirmed), the service providers so engaged are: Vercel Inc. (application hosting and protection of public forms against automated submissions); Neon, Inc. (database hosting); Cloudflare, Inc. (file storage); Resend (delivery of email sent by the platform); Trigger.dev (execution of scheduled and queued tasks); Stripe (subscription billing and, where a school enables it, collection of tuition payments); Functional Software, Inc. trading as Sentry (error monitoring); Anthropic, PBC (optional AI-assisted features); Expo (push notifications to the staff mobile app); the OpenStreetMap Foundation's Nominatim service (address and postcode lookup for map and transport features, where used); and Google (optional sign-in with a Google account).

Some of these providers, or their own sub-processors, may process personal data outside the United Kingdom or the European Economic Area. Where they do, we ensure the transfer is subject to appropriate safeguards, such as an adequacy decision or regulations, the European Commission's standard contractual clauses or the UK International Data Transfer Addendum, together with any supplementary measures that are required. Hosting locations and the safeguards relied on: hosting locations and transfer safeguards to be confirmed. A copy of the relevant safeguards may be requested by writing to privacy contact email address to be confirmed.

10Children

This website is meant for school staff and is not directed at children. Pupils' data reaches the platform only because their school records it, and the school is responsible for it.

11Changes to this notice

We will update this notice when how we handle data changes, and show the date it takes effect here: effective date to be confirmed. Questions are always welcome at privacy contact email address to be confirmed. Our general terms are on the terms page.