1. Privacy Policy

1.1 Who we are

Talamo Limited (“Talamo”, “we”, “us”) provides digital assessments to help identify potential specific learning difficulties and cognitive profiles.

When we work directly with parents, Talamo Limited is the controller of the personal data processed through the Talamo platform.

When we work with schools, the school or education provider is usually the controller, and Talamo acts as their processor, processing personal data only on their documented instructions.

Talamo Limited is registered in England and Wales (company number: 13714418) with its registered office at 3 Buckland House, William Prance Road, Plymouth, United Kingdom, PL6 5WR.

You can contact us about data protection at: hello@talamo.co.uk.

If you wish to contact our data protection lead / Data Protection Officer, please use the same email address and mark your message “FAO: Data Protection”.

1.2 Personal data we collect

Depending on how you use the Service (school or parent), we may collect:

• Student details

  • First name and surname.

  • Date of birth.

  • School year or class, and school name (for school users).

• Assessment data

  • Responses to assessment tasks (e.g. answers, time taken).

  • Derived scores and indicators (e.g. reading/spelling scores, cognitive/composite scores, dyslexia risk scores).
    
    

• Supporting information

  • Non-identifiable educational context such as school performance indicators or information provided by teachers or parents to help interpret results.

  • Optional notes added by teachers or parents within the platform.
    
    

• Parent / user account details (for direct-to-parent use)

  • Parent or guardian contact details (such as email address).

  • Login and account details for access to the platform.
    
    

• Technical information and cookies

  • Device and browser information, IP address, and activity logs related to use of the Service.

  • Cookies and similar technologies to maintain sessions and track progress through the Service.
    
    

We do not require detailed medical histories to use Talamo.

1.3 Where we get your data from

We obtain personal data from:

• The school or education provider that has chosen to use Talamo with its students;

• The parent or legal guardian who creates an account and provides details about their child (for direct-to-parent use);

• The student’s own interactions with our assessments and platform.
  
  

We do not collect personal data about students from publicly available sources or from data brokers.

1.4 Special category data

Our assessments generate information about learning profiles and potential specific learning difficulties such as dyslexia. On its own, this is educational performance data, not a medical diagnosis.

However, because this information may be used in a way that relates to an individual’s health or learning difficulty status, we treat it as having a similar level of sensitivity to health-related (special category) data under Article 9 UK GDPR and apply appropriate safeguards.

Where Article 9 applies, we may rely on conditions such as:

• Article 9(2)(g): substantial public interest, in particular supporting individuals with learning difficulties; and/or

• Article 9(2)(h): assessment of an individual’s educational and support needs in an education context.
  
  

We do not collect detailed medical histories within the Talamo platform.

1.5 Purposes and lawful bases for processing

We process personal data for the following purposes:

(a) Providing assessments and reports

To deliver dyslexia and cognitive assessments, calculate scores, and generate reports for schools, teachers, and parents.

• For school use:

  • The school determines the lawful basis (typically public task and/or legitimate interests).

  • Talamo acts as a processor, processing data on the school’s documented instructions, under a written Data Processing Agreement.
    
    

• For direct-to-parent use:

  • Article 6(1)(b) - Contract: providing the assessment and report you have requested.

  • Article 6(1)(f) - Legitimate interests: our interests in operating and improving the Service.
    
    

Where special category data is engaged, we rely on the Article 9 conditions described in section 1.4.

(b) Service operation, improvement and analytics

To operate, maintain and improve the platform, including:

• Monitoring performance and reliability;

• Analysing aggregated and anonymised data to improve test accuracy and design;

• Understanding how features are used to guide development.
  
  

• Lawful basis:

  • Article 6(1)(f) - Legitimate interests in developing, securing and improving our services.

  • Where special category data is involved, we apply Article 9(2)(g)/(h) with appropriate safeguards, using anonymised or pseudonymised data wherever possible.
    
    

Where we rely on Article 6(1)(f), we carry out Legitimate Interests Assessments (LIAs) to ensure our interests do not override individuals’ rights, and can provide further information on these on request.

(c) Support, communication and administration

To respond to support requests, manage accounts, and communicate about service changes.

• Lawful basis:

  • Article 6(1)(b) - Contract (where communication is necessary to provide the Service).

  • Article 6(1)(f) - Legitimate interests (for general service administration and support).
    
    

Where we send marketing emails to parents or professionals, we will do so in line with UK PECR rules and, where required, on the basis of consent (Article 6(1)(a)) or legitimate interests (Article 6(1)(f)).

1.6 Automated decision-making and profiling

Talamo uses automated scoring and profiling to:

• Mark assessment responses;

• Generate numerical scores and risk indicators;

• Present information in reports (e.g. areas of strength and difficulty).
  
  

We do not make decisions that have legal or similarly significant effects on a student purely by automated means. Any decisions about diagnosis, access arrangements or support are taken by humans (for example, schools, assessors, parents and external professionals).

1.7 Children’s data

Many of the individuals using Talamo assessments are children. We design our platform and processes with children’s privacy in mind:

• For school use, the school is responsible for ensuring it has an appropriate lawful basis and parental engagement/consent where required. Talamo acts only on the school’s instructions.

• For direct-to-parent use, a parent or legal guardian is expected to create the account and provide information about their child.
  
  
  

We minimise the data we collect and use strong technical and organisational measures to protect children’s data.

1.8 How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this policy or as required by law.

By default:

• Active school accounts:
  Personal data is retained for the duration of the contract and for up to 1 year after the account is deactivated, unless the school instructs us to delete it sooner.

• Deactivated school accounts:
  Data is deleted or anonymised within 1 year of deactivation, unless a different period is agreed with the school or required by law.

• Parent accounts (direct-to-parent use):
  We retain data while the account is active and for up to 1 year, unless you ask us to delete it sooner.
  
  

After these periods, personal data is securely deleted or irreversibly anonymised.

1.9 Where your data is stored and international transfers

All personal data processed by our core platform is stored on secure servers located in the United Kingdom or European Economic Area (EEA).

We use carefully selected third-party service providers (for example, cloud hosting, analytics, email and customer support tools). These providers act as processors and only process personal data on our instructions. We have written Data Processing Agreements (DPAs) with them.

If we ever need to use a provider based outside the UK or EEA, we will:

• Only do so where appropriate safeguards are in place (such as an adequacy decision or Standard Contractual Clauses); and

• Ensure that data subjects continue to have enforceable rights and effective legal remedies.
  
  

If our international transfer arrangements change in a material way, we will update this policy and, where appropriate, notify customers.

1.10 Who we share your data with

We do not sell or trade personal data.

We may share personal data with:

• The school or education provider that arranged the assessment (for school-based use);

• Service providers who host our platform, store data, provide analytics, email, customer support and (for parent payments) payment processing;

• Professional advisers (such as lawyers or auditors) where necessary;

• Authorities or other parties where required by law or to protect someone’s vital interests.
  
  

Service providers can only use the data to provide services to us, must keep it confidential, and must protect it under a written DPA.

1.11 How we protect your information

We use a combination of technical and organisational measures to keep personal data secure, including:

• Encryption of data in transit and at rest;

• Role-based access controls and authentication;

• Logging and monitoring of access to systems;

• Secure development practices and regular review of security controls;

• Procedures to detect, investigate and respond to suspected data incidents or breaches.
  
  

Where a data breach is likely to result in a risk to individuals’ rights and freedoms, we will work with the relevant controller (e.g. the school) to notify the appropriate supervisory authority and, where required, the affected individuals.

1.12 Your rights

Subject to certain legal limitations, students (through their school or parent/guardian, as appropriate), parents and other users have the right to:

• Access a copy of their personal data;

• Request correction of inaccurate or incomplete data;

• Request deletion of their data;

• Restrict or object to our processing of their data;

• Request that we transfer their data to another organisation (data portability) where applicable;

• Withdraw consent where we rely on consent (this will not affect processing already carried out).
  
  

To exercise any of these rights, please contact us at hello@talamo.co.uk. We may need to verify your identity and, for school-based assessments, confirm any request with the school.

1.13 Complaints and the ICO

If you have concerns about how we use your data, we encourage you to contact us first at hello@talamo.co.uk so we can try to resolve the issue.

You also have the right to complain to the UK data protection regulator:

Information Commissioner’s Office (ICO)

Website: www.ico.org.uk

Telephone: 0303 123 1113

1.14 Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. We will update the “last updated” date at the top of this page and, where appropriate, notify schools or users of significant changes.

By continuing to use the Service after changes are made, you accept the updated policy.

2. Data Protection Policy (Schools & DPIA Support)

This section is intended to provide additional detail for schools, trusts and their advisers (including DPIA reviewers) on how Talamo supports GDPR compliance.

2.1 Overview

Talamo provides a digital dyslexia and cognitive profiling tool. When used by schools, we typically act as a data processor, processing student data on the school’s instructions and under a written Data Processing Agreement.

We are committed to:

• Data minimisation and purpose limitation;

• Strong technical and organisational security;

• Transparency around our processing and use of sub-processors;

• Supporting schools in meeting their obligations under UK GDPR and the Data Protection Act 2018.
  
  

2.2 Personal data processed

For each student, we process:

• First name and surname;

• Date of birth;

• School, class or year group;

• Assessment responses and performance (including time taken and behaviour within tasks);

• Derived cognitive and literacy scores, and dyslexia risk indicators;

• Optional contextual information provided by the school (e.g. performance summaries or teacher notes).
  
  

We do not require detailed addresses, national insurance numbers, or detailed medical histories to use the platform.

2.3 Roles and lawful bases

• Schools / education providers act as controllers and determine the lawful basis for using Talamo with their pupils. For any pupil special category data, the school, as controller, relies on the relevant Schedule 1 conditions under the Data Protection Act 2018, and Talamo applies equivalent safeguards as their processor.

• Talamo acts as a processor, processing personal data only on the school’s documented instructions and in accordance with the contract and DPA.
  
  

In practice, schools typically rely on:

• Article 6(1)(e) - Public task (educating and supporting pupils); and/or

• Article 6(1)(c) - Legal obligation (where relevant education law applies); and/or

• Article 6(1)(f) - Legitimate interests (supporting pupils’ educational needs).
  
  

Where special category data is engaged, schools may rely on Article 9(2)(g)/(h) and the relevant conditions in Schedule 1 of the Data Protection Act 2018.

Talamo’s own limited controller processing (e.g. for service improvement, analytics and platform security) is carried out under Article 6(1)(f) - legitimate interests - and, where relevant, Article 9(2)(g)/(h). Where we rely on Article 6(1)(f), we carry out Legitimate Interests Assessments (LIAs) to ensure our interests do not override individuals’ rights, and can provide further information on these on request.

2.4 Children’s data and data protection 

Because many data subjects are children, we apply data protection by design and by default, including:

• Data minimisation in the design of assessments and platform fields;

• Clear role separation between school users and Talamo staff;

• Strong access controls and least-privilege permissions;

• Use of pseudonymisation or anonymisation wherever reasonably possible and consistent with the purposes described in this policy (e.g. in analytics and research).
  
  

For school use, it is the school’s responsibility to ensure appropriate parental communication or consent, where required. Talamo supports schools with documentation and technical measures but does not replace the school’s own obligations.

2.5 Special category data

As noted in the Privacy Policy:

• Our data primarily consists of educational performance information.

• Where that information is used to indicate a possible specific learning difficulty or need, it may fall within “data concerning health” in practice.
  
  

We therefore apply safeguards consistent with special category processing, including:

• Minimisation of collected data;

• Restricted access to assessment results;

• Use of anonymised or pseudonymised data for analytics and research wherever possible;

• Technical and organisational measures proportionate to the sensitivity of the data.
  
  

2.6 Purpose limitation

For school-based use, we process student data for the following purposes, as directed by the school:

• Delivering assessments and generating individual and cohort reports;

• Supporting teachers and SENCOs to identify pupils who may benefit from further support or assessment;

• Providing management information to the school (e.g. year-group or class-level trends);

• Supporting internal product improvement, analytics and research in line with our policies, using anonymised or pseudonymised data.
  
  

We do not use identifiable student data for unrelated purposes such as general marketing.

2.7 Data retention

For school-based use:

• Data is retained for the duration of the school’s contract with Talamo.

• After the contract ends or the account is deactivated, data is deleted or anonymised within two years, unless a different period is agreed with the school or required by law.

• Schools can request deletion of data earlier, and Talamo will comply unless retention is required by law or is necessary for the establishment, exercise or defence of legal claims.

• For parent accounts (direct-to-parent use): we retain data while the account is active and for up to three years afterwards, unless you ask us to delete it sooner.
  
  

2.8 Sub-processors and third-party recipients

Talamo uses sub-processors to provide infrastructure and services such as:

• Cloud hosting and data storage;

• Analytics tools;

• Email and customer support systems;

• (For direct-to-parent use) payment processing.
  
  

For all sub-processors:

• We perform due diligence before onboarding;

• We have written Data Processing Agreements in place;

• Sub-processors are required to implement appropriate technical and organisational measures;

• Sub-processors may only process personal data in accordance with our written instructions.
  
  

We can provide schools with a list of current sub-processor categories (and, where required, names) on request.

2.9 International transfers

Our core infrastructure is located in the UK/EEA.

If any sub-processor or support service operates outside the UK/EEA, we ensure that:

• Appropriate safeguards are in place (such as an adequacy decision or Standard Contractual Clauses);

• Data subjects have enforceable rights and effective legal remedies;

• Transfers are documented and reviewed as part of our data protection governance.
  
  

Where there are no non-UK/EEA transfers for student data, schools can record this in their DPIA.

2.10 Security measures

Talamo implements a range of technical and organisational measures, including:

• Encryption of data at rest and in transit;

• Segregation of production and test environments;

• Role-based access control, with access granted on a least-privilege basis;

• Logging and monitoring of access and key actions;

• Staff training on data protection and information security;

• Vendor due diligence and contractual security obligations;

• Documented incident-response procedures and breach management.
  
  

We periodically review and update our security measures in light of risk, technology and regulatory expectations.

2.11 Data subject rights (schools)

For school-based processing:

• Talamo supports schools in responding to data subject rights requests (access, rectification, erasure, restriction, objection, portability), in line with the DPA and contract.

• Where Talamo receives a rights request directly from a student or parent in relation to school-controlled data, we will, where appropriate, refer the request to the relevant school and cooperate with their handling of it.
  
  

2.12 Contact for DPIA and data protection queries

For DPIA-related queries, sub-processor details or security information, schools and their advisers can contact:

Talamo Limited

Email: hello@talamo.co.uk (mark “FAO: Data Protection / DPIA”)