1. Who we are

This Privacy Policy applies to STEM UP LIMITED, trading as StemUp (“StemUp”, “we”, “us” or “our”).

STEM UP LIMITED is a company registered in England and Wales under company number 14597139.

Our registered office is:

For the personal information described in this policy, STEM UP LIMITED is generally the data controller. This means we decide why and how your personal information is used.

Privacy enquiries can be sent to sales@stemup.co.uk.

2. What this policy covers

This policy applies when you interact with StemUp, including when you:

• visit stemup.co.uk;
• purchase a digital revision resource;
• create or use a StemUp customer account;
• access a digital product or download;
• contact us by email, chat or another support channel;
• sign up to receive marketing from us;
• apply to a StemUp programme, including our Ambassador or Widening Participation programmes; or
• otherwise interact with our website, forms or services.

This policy does not control how independent third-party websites or services use your information. Where you use another service, you should also read that provider's own privacy information.

3. What personal information we collect

The information we collect depends on how you use StemUp. It may include the following.

Identity and contact information

This may include your name, email address, postal address, billing address and other contact details you provide to us.

Order and purchase information

This may include the products you purchase, your order number, order date, price paid, currency, discounts used, transaction status and your order history.

Customer account information

If you use a StemUp customer account, we may process information associated with that account, including your email address, account details and resources connected to your purchases.

Payment information

Payments are processed through Shopify and the payment providers available through our checkout.

StemUp does not normally receive or store your complete payment card number or card security code. Payment providers process the information necessary to complete your transaction.

Communications

If you contact us, we may collect your name, email address, order details and the contents of your message, together with any files or screenshots you choose to send.

Application information

If you apply to a StemUp programme, we may collect the information you submit in the application, such as your name, email address, application answers, social media handle where relevant and any supporting evidence requested as part of the application.

Technical and usage information

When you use our website, certain information may be collected automatically. This may include your IP address, browser type, device type, operating system, referring website, pages visited, approximate location derived from your IP address and information about how you interact with the website.

Marketing information

We may record whether you have chosen to receive marketing, whether you have unsubscribed and information relating to the emails we send, such as delivery or engagement information where permitted.

4. How we collect your information

We collect personal information in several ways.

Some information is provided directly by you, for example when you place an order, create an account, complete a form, apply to a programme or contact us.

Some information is collected automatically when you use our website through technologies such as cookies, server logs and similar technologies.

We may also receive information from services involved in providing StemUp to you, such as Shopify, payment providers, digital-delivery providers and other suppliers involved in processing an order or providing a service you have requested.

5. Why we use your information

UK data protection law requires us to have a lawful reason for processing personal information. The lawful basis we rely on depends on why the information is being used.

To process and fulfil your order

We use your information to accept payment, process your order, provide your digital resources, manage your account and provide support relating to your purchase.

Our lawful basis is generally that the processing is necessary to perform our contract with you.

To operate customer accounts

We use account information to provide account functionality and, where available, allow customers to access digital products associated with previous purchases.

Our lawful basis is generally performance of our contract with you and our legitimate interest in providing and managing our services.

To provide customer support

We use the information you provide when contacting us so that we can respond to questions, investigate problems and resolve issues with orders or digital products.

Depending on the request, our lawful basis may be performance of our contract with you or our legitimate interest in providing effective customer support.

To prevent fraud and protect StemUp

We may use order, account and technical information to prevent fraudulent activity, investigate misuse, protect our digital resources and identify unauthorised access or redistribution.

Our lawful basis is our legitimate interest in protecting our customers, services, intellectual property and business.

To comply with the law

We may process and retain information where necessary to meet tax, accounting, consumer protection, regulatory or other legal requirements.

Our lawful basis is compliance with a legal obligation.

To improve our website and services

We may use technical and usage information to understand how people use StemUp, identify problems and improve our website, resources and customer experience.

Depending on the technology used, we rely on our legitimate interests or your consent where consent is required for analytics or similar cookies.

To send marketing

We may use your contact information to send marketing where you have consented or where the law otherwise permits us to contact existing customers about similar StemUp products.

You can opt out of marketing at any time.

6. Applications and supporting evidence

StemUp operates programmes for which applicants may need to provide additional information so that we can assess eligibility or suitability.

This may include applications to our Ambassador programme or Widening Participation programme.

Where supporting evidence is requested, we use it only for the purposes for which it was provided, such as assessing an application, confirming eligibility and administering the relevant programme.

Some supporting evidence may reveal information about a person's financial circumstances, health or disability. Where this amounts to special category personal data, we will only process it where we have both a valid lawful basis and an appropriate additional condition under applicable data protection law.

Applicants should only provide information that is relevant to the application and should avoid sending unrelated personal information.

7. Payments

Our online store is operated using Shopify. Payments may be processed by Shopify Payments or another payment provider made available at checkout.

These providers process payment information in accordance with their own privacy and security obligations.

We receive the information we need to identify and administer your order, such as confirmation that payment has succeeded, but we do not normally receive your complete card details.

You can read Shopify's privacy information at shopify.com/legal/privacy .

8. Cookies and similar technologies

StemUp uses cookies and similar technologies to operate our website and, where permitted, understand how it is used.

These technologies may include:

• essential cookies needed for functions such as checkout, shopping baskets, security and customer accounts;
• preference cookies that help remember choices you make;
• analytics cookies that help us understand website usage and performance; and
• marketing technologies where these are used and you have given any consent required by law.

Where non-essential cookies require consent, you can accept, reject or manage them through the cookie controls provided on our website. Our Cookie Policy explains the cookies we use in more detail.

You can also control cookies through your browser settings, although disabling essential cookies may prevent some parts of the website from working correctly.

9. Marketing communications

We may send you information about StemUp products, resources, offers or other relevant updates where we are permitted to do so.

Where required, we will ask for your consent before sending marketing communications.

Where the law permits, we may also contact existing customers about similar products or services.

You can unsubscribe at any time by using the unsubscribe option included in a marketing email or by contacting us.

Opting out of marketing does not stop essential service messages such as order confirmations, download information, account messages or responses to support requests.

10. Who we share information with

We do not sell your personal information.

We may share information with trusted third parties where this is necessary to operate StemUp or provide a service to you. These may include:

• Shopify, which provides our ecommerce platform;
• payment providers used to process transactions;
• digital-delivery and file-hosting providers used to provide purchased resources;
• email providers used to send transactional or marketing emails;
• customer-support and chat providers;
• form providers used to receive applications or enquiries;
• analytics and website-service providers where applicable;
• professional advisers such as accountants, lawyers or insurers where necessary; and
• regulators, courts, law-enforcement bodies or other authorities where disclosure is required by law or reasonably necessary to establish, exercise or defend legal rights.

Service providers are given access only to the information needed for the relevant purpose and are expected to protect personal information appropriately.

11. International transfers

Some of the companies that provide services to StemUp may process or store personal information outside the United Kingdom.

Where UK data protection law treats this as a restricted international transfer, we take steps to ensure an appropriate level of protection is in place.

Depending on the circumstances, this may include relying on UK adequacy regulations or using appropriate contractual or other safeguards recognised under applicable data protection law.

12. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, tax and regulatory obligations.

Order and transaction records

We may retain order, payment and accounting records for up to six years, or for a longer period where required by law.

Customer account information

Account information may be retained while your account remains active and for as long as reasonably necessary to provide access to services or products associated with your account.

Customer support

Support correspondence is retained for as long as reasonably necessary to deal with the query, maintain appropriate records and resolve any later issue relating to it.

Applications and supporting evidence

Application information and supporting evidence will be retained only for as long as reasonably necessary to assess and administer the application or programme and to meet any applicable legal requirements.

Marketing

Marketing information may be retained while you remain subscribed. If you unsubscribe, we may retain limited information on a suppression list so that we can respect your preference not to receive further marketing.

Where information is no longer required, we will delete it, anonymise it or otherwise stop using it, subject to any legal requirement to retain it.

13. How we keep your information safe

We take reasonable technical and organisational measures designed to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.

These measures include using reputable service providers, restricting access to information where appropriate and using security measures available through our ecommerce and other technology providers.

However, no website, online transmission or electronic storage system can be guaranteed to be completely secure.

If a personal data breach occurs, we will assess it and notify affected individuals and the relevant regulator where required by law.

14. Your privacy rights

Depending on the circumstances, UK data protection law gives you a number of rights over your personal information.

These may include the right to:

• be informed about how your information is used;
• request access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information in certain circumstances;
• ask us to restrict how information is processed in certain circumstances;
• object to certain processing, including direct marketing;
• request data portability where that right applies;
• withdraw consent at any time where our processing relies on your consent; and
• exercise rights that apply to certain automated decisions or profiling.

These rights are not all absolute and may depend on why we are processing the information.

To exercise a privacy right, email sales@stemup.co.uk.

We may need to confirm your identity before acting on a request. We will normally respond within one month, subject to any extension permitted by law.

15. Children and young people

StemUp is an educational business and many people who use our resources are students.

Our services are intended for users aged 13 or over. If you are under 18, purchases and use of our services should take place with the permission of a parent or guardian.

We aim to collect only the personal information reasonably necessary to provide our products and services.

If you are a parent or guardian and believe that a child under 13 has provided personal information to us without appropriate permission, please contact us so that we can review the situation.

16. Third-party services and links

StemUp resources may include or interact with services operated by other companies, including services such as Quizlet, Anki-compatible applications, payment providers and other external websites.

Those organisations are responsible for their own processing of personal information where they act independently from StemUp.

Our website may also contain links to external websites. We are not responsible for the privacy practices of a third-party website simply because we link to it.

We recommend reading the privacy information provided by any external service you choose to use.

17. Complaints

If you have a concern about how we have used your personal information, please contact us first so that we have an opportunity to investigate and resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

You can find information about making a complaint at ico.org.uk .

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to StemUp, our technology, our service providers or applicable law.

The date shown at the top of this page indicates when the policy was last updated.

Where a change is significant, we may take additional steps to bring it to your attention where appropriate.