Privacy policy

Master the Curriculum — www.masterthecurriculum.co.uk

Last updated: 8/9/26 Version 2.5 (interim)

1. Who we are

Master the Curriculum is owned and operated by Closing the Gap Ltd, a limited company registered in England and Wales under company number 11200931. Our registered office is at Hamilton Crescent, London, N13 5LN.

We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number A9081219.

If you have any questions about this policy or how we use your personal data, contact us at [email protected] or write to us at the address above.

2. What this policy covers

This policy explains how we collect, use, store and share personal data when you visit our website, create an account, buy a subscription or resource, contact us, or receive our emails. It applies to teachers, school staff, parents, tutors and anyone else who uses our site.

Our site may link to other websites. We are not responsible for how those sites handle your data, and we recommend you read their privacy policies.

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

3. The data we collect

Depending on how you use our site, we may collect:

Identity and contact data — your name, email address, telephone number, school or organisation name, and postal or billing address.
Account data — your username, password (stored in encrypted form), subscription type and membership status, and the resources you download or access.
Transaction data — details of the subscriptions and products you buy, order history, invoices and payment status. We do not see or store your full card details (see section 6).
Communications data — emails, contact-form messages and support requests you send us, and our replies.
Marketing data — whether you have opted in to our emails, and how you interact with them (opens and clicks).
Technical and usage data — your IP address, browser type and version, device and operating system, pages you visit, referring site, and the date and time of visits.

We do not knowingly collect personal data about children. Our resources are purchased and used by adults (teachers, parents and tutors). If you believe a child has provided us with personal data, please contact us and we will delete it.

We do not collect any special category data (such as health, ethnicity or religious data) through our site.

4. How we use your data and our lawful basis

UK GDPR requires us to have a lawful basis for each way we use your personal data. The table below sets these out.

What we use your data for

Lawful basis

Creating and managing your account, and giving you access to the resources you have subscribed to

Performance of a contract with you

Processing payments, issuing invoices and receipts, and managing renewals and cancellations

Performance of a contract; legal obligation (accounting and tax records)

Responding to your enquiries and providing customer support

Performance of a contract; legitimate interests (running our business well)

Sending service emails about your account, orders, renewals or changes to our terms

Performance of a contract

Sending marketing emails about new resources, offers and news

Consent — you can withdraw this at any time

Keeping our site secure, preventing fraud and misuse, and diagnosing technical problems

Legitimate interests (protecting our business and users)

Understanding how our site is used so we can improve it

Legitimate interests (improving our service); consent where non-essential cookies are used

Keeping records required by law and dealing with legal claims

Legal obligation; legitimate interests

Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and interests, and we believe they are not. You can ask us for more information about this assessment.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Marketing emails

We will only send you marketing emails if you have opted in, or if you are an existing customer and we are telling you about similar products or services (in which case we gave you the chance to opt out when we collected your details, as permitted under PECR).

You can unsubscribe at any time by clicking the link at the bottom of any email or by emailing [email protected]. Unsubscribing from marketing does not stop service emails about your account or orders.

Our email marketing is sent through MailerLite (see section 6). MailerLite records whether emails are opened and links are clicked so that we can understand which content is useful.

6. Who we share your data with

We do not sell your personal data. We share it only with trusted service providers who process it on our behalf under written contracts, and only as far as necessary for them to provide their service to us.

Provider

What they do for us

Where data is processed

SiteGround

Hosts our website and database, including account data

United Kingdom (London data centre)

Cloudflare

Provides SSL encryption, security and performance services. Visitor traffic to our site passes through Cloudflare's network, so Cloudflare processes technical data such as IP addresses

Cloudflare is a US company with UK and EU data centres — it is certified under the UK Extension to the EU–US Data Privacy Framework

WooCommerce (Automattic)

Runs our online shop, orders, subscriptions and account system on our WordPress site

Data stored on our SiteGround hosting; some WooCommerce services process data in the USA

Stripe

Processes card payments. Stripe receives your card details directly; we never see or store your full card number

USA and EU — Stripe uses the UK International Data Transfer Addendum and standard contractual clauses

MailerLite

Sends our marketing and newsletter emails and manages subscriptions

EU (Lithuania)

Xero

Our accounting software, used for invoicing, bookkeeping and tax records

Global — Xero uses appropriate safeguards for international transfers

Google Analytics (Google LLC)

Measures how visitors use our site so we can improve it — for example which pages are popular and how people found us. Data is pseudonymised and only collected if you accept analytics cookies

USA — Google is certified under the UK Extension to the EU–US Data Privacy Framework

Metorik

Reporting and analytics for our online shop. Metorik syncs our order and customer records so we can understand sales, subscriptions and where customers come from

USA — Metorik uses standard contractual clauses with the UK Addendum

We may also share personal data:

with professional advisers such as accountants, solicitors and insurers where necessary;
with HMRC, regulators, courts or law enforcement where we are legally required to do so;
with a buyer or prospective buyer if we sell or transfer all or part of our business. We would tell you in advance, and the new owner could only use your data for the purposes set out in this policy.

We may compile anonymised statistics about the use of our site (such as visitor numbers and popular resources). These cannot be used to identify you and may be shared with partners or advisers.

7. International transfers

Some of the providers listed in section 6 store or process data outside the United Kingdom, including in the European Economic Area and the United States. Whenever we transfer personal data outside the UK, we make sure it is protected by one of the following safeguards:

the destination country has been assessed by the UK government as providing adequate protection (this includes all EEA countries);
the provider has signed the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
the provider is certified under the UK Extension to the EU–US Data Privacy Framework.

You can ask us for more information about the safeguards that apply to a particular transfer.

8. How long we keep your data

We keep personal data only for as long as we need it for the purposes it was collected for, or as required by law. Our standard retention periods are:

Type of data

How long we keep it

Account and subscription data

For as long as your account is active, then 2 years after your subscription ends or your last login, unless you ask us to delete it sooner

Orders, invoices and payment records

6 years from the end of the financial year they relate to (required by HMRC)

Marketing consent and email data

Until you unsubscribe, then we keep a record of your unsubscribe request so we do not contact you again

Customer support emails

2 years after the query is closed

Website technical logs

30 days

When we no longer need your data we will securely delete or anonymise it.

9. How we keep your data secure

We take appropriate technical and organisational measures to protect your personal data, including:

encrypting all traffic between your browser and our site with SSL, provided through Cloudflare;
using a PCI DSS-compliant payment provider (Stripe) so that card details never touch our servers;
storing passwords in hashed form so they cannot be read by us or anyone else;
hosting on SiteGround's secure UK servers with firewalls, malware scanning and regular backups;
limiting access to personal data to staff who need it, protected by strong passwords and two-factor authentication;
keeping our website software and plugins up to date.

No system is completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will tell you and the ICO as required by law.

10. Cookies

Our site uses cookies and similar technologies. A cookie is a small text file placed on your device when you visit a website.

Strictly necessary cookies are essential for the site to work — for example, keeping you logged in, remembering the items in your basket and keeping the site secure. These do not require your consent.

We also use analytics cookies, including Google Analytics and Metorik, to help us understand how visitors use our site. A cookie banner allows you to accept or reject these cookies, and you can change your choice at any time using the cookie settings icon on our site.

11. Your rights

Under UK GDPR you have the right to:

be informed about how we use your data (this policy);
access a copy of the personal data we hold about you;
have inaccurate or incomplete data corrected;
have your data erased in certain circumstances;
restrict how we use your data in certain circumstances;
receive your data in a portable, machine-readable format;
object to processing based on legitimate interests, and to direct marketing at any time;
withdraw consent at any time where we rely on it, without affecting processing already carried out.

To exercise any of these rights, email [email protected]. We will respond within one month and will not charge a fee unless a request is clearly excessive. We may ask you to confirm your identity first.

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

12. Changes to this policy

We may update this policy from time to time, for example if the law or our services change. We will post the new version on this page and update the date at the top. If the changes are significant, we will let you know by email or a notice on our site.