Privacy Policy

At Itza Media Limited (“Itza”) we want to be completely transparent about why we need the personal details we request when you engage with us and how we will use them.

As you browse our websites and whenever you communicate with us, we collect information relating to you, which can be used to personally identify you (either directly or indirectly) (“Personal Information”). It deepens our understanding of what works and what doesn’t, which helps make our communications with you more effective. The more we understand about our users and the people we engage with, the more efficiently we are able to provide you with a personalised experience when browsing our sites.

We take protecting your privacy very seriously and will always take all reasonable steps within our power to make sure your information is safe.

This Privacy Policy applies to all Personal Information we collect or process about you. It also describes how we collect and use your Personal Information and your rights in relation to that Personal Information, in accordance with the Data Protection Act 2018 (“DPA”) and the UK General Data Protection Regulation (“UK GDPR”).

‍Please read this Policy carefully, along with our website Terms of Use and any other documents referred to in this policy, to understand how we collect, use and store your Personal Information.

‍We may update this Policy from time to time and we will give you notice of any changes. However, please also check it regularly, particularly if you are sending Personal Information to us.

‍If you have any questions please contact our team by writing to us at Itza Media Limited, Forth House, 28 Dundas St, Edinburgh EH3 6JN, Scotland or email us at support@itza.io.

1. Who are we

Itza Media Limited is a privately registered company in England and Wales with company number 11005147. Throughout this policy, whenever you encounter the terms 'Itza,' 'we,' 'us,' or 'our,' they refer to this company. We serve as a “controller” of your Personal Information. This means that we are responsible for deciding how we hold and use Personal Information about you. We are required under data protection legislation to notify you of the information contained in this Privacy Notice.

We may gather Personal Information each time you engage with us. The nature and amount of information we collect, as well as how we utilize it, vary based on the purpose for which it is provided and the age of the person providing it.

2. When we collect information from you

We gather information from the various interactions we have with you, including by way of example when you:

Sign up for services and challenges on our websites.
Register for our online teacher portal if you're a teacher.
Visit our websites or social media pages, utilizing tools like cookies and online identifiers. This includes activities such as commenting on our message boards or discussion forums.
Engage with our website through learning content or quizzes.
Order an item for delivery from our Yakka Store.
Reach out to us or participate in any other form of interaction not explicitly mentioned above.
Apply for a job opportunity with us.
Request information from us.

3. What we collect

The Personal Information we collect depends on whether or not you are a teacher or a learner. We may collect, store and/or use the following types of Personal Information, depending on how you interact with us:

a. For Teachers

Your name, email address, school name, and school address along with preferences as to how we should contact you in the future.

b. For Learners

Your email address, school (optional, via a school code, although you will need to provide details of your school to take part in school-based competitions).
We also ask for a learner’s age to determine whether they are over thirteen years of age or not. All learners under thirteen years are asked to provide an email address for a parent, guardian or teacher that we can communicate with to ensure that they approve of the learner’s use of our website and to contact us if not.
Other Personal Information can be requested in particular circumstances, for example information voluntarily provided to enable delivery and fulfilment of orders from the Itza Yakka Store.

c. Usage Data

We gather data on learner activities on our site to enhance our products and deliver personalized learning experiences. This can include tracking:
Page visits, time spent on site, responses to questions, and viewed content.
Technical details of a user’s website visit, such as IP address, device, browser type, and version.

4. How we collect information about you

We can use different methods to collect Personal Information from you, including:

a. Direct Interaction
We request information from you directly, for example when you sign up on one of our websites. For information about when we may collect data, see the section When We Collect Information above. If you are under thirteen years of age when you sign up on www.itza.io we will ask you to provide the email address of a parent or guardian so we can let them know that you have registered with Itza and we can request their approval of our Terms & Conditions and Privacy Policy on your behalf and for other activities you may participate in with Itza.

b. Automated Technologies or Interactions
We collect information on our communications with teachers and parents via email, such as email opens, link clicks, and website browsing, to analyse the popularity of our communications and to improve customer experience.

his data helps us understand visitor demographics and target communications effectively. By accepting cookies, you enable us to gather this information. You can choose to decline cookies by adjusting your browser settings, but please note that this may impact website functionality. For more details, refer to our separate Cookies Policy for more information.

c. Third parties
When you sign up for a third-party service, you may have consented to the sharing of your data with organizations like ours. We ensure compliance with data protection regulations by reviewing the privacy notice of the third party to confirm that it notifies individuals about potential data sharing. For instance, if you join a teacher database, you agree to share your information with other organisations. We may use this data to contact you regarding our schools, youth programs, or teacher resources aligned with our mission.

5. What we use your information for

Your Personal Information serves various processing purposes, including but not limited to:

Fulfilling the services you have requested.
Maintaining records of your interactions with us.
Managing your communication preferences, including marketing preferences.
Enhancing and refining our services, products, or information.
Sending customised communications tailored to your interests.
Distributing marketing materials, including updates on company events and developments.
Extending invitations to events, campaigns, and opportunities to support our initiatives.
Analysing our database for statistical insights and to improve communication effectiveness.
Analysing usage patterns and trends to personalize and enhance the service and your user experience.
Administering and operating Itza's global educational competitions for students.

6. Children's privacy and age-appropriate design

Itza Media Limited is committed to protecting the privacy and rights of young people who use our services. We comply with the UK Information Commissioner’s Office (ICO) Age-Appropriate Design Code, which means we uphold the best interests of the child when collecting or using personal data.

We have designed our platforms to be suitable for children and young people aged 13–18, applying a high standard of privacy protection for all users under 18. While we do not tailor services by individual age group, we ensure that:

Children under 13 must provide a parent or guardian’s contact details, and we will request parental consent before processing their personal data.
All child users are given high privacy settings by default, and we do not profile them for marketing or use unnecessary tracking.
Our explanations of how we use data are written in a clear, accessible way.
We avoid using design techniques that might encourage children to share more information than they need to.
We limit the amount of Personal Information we collect and retain it only as long as necessary.

We regularly review our systems and practices to ensure we meet the standards of the Children’s Code and support a safe, respectful experience for all young users.

7. Our legal basis for processing data

Our utilization of Personal Information adheres to UK law, and in particular the UK Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR), requiring a valid legal basis for processing. We primarily process Personal Information under the following circumstances:

Legitimate Interests: When necessary for our legitimate interests, provided your interests and fundamental rights do not supersede those interests.
Legal Compliance: When required to comply with legal or regulatory obligations, such as reporting to Companies House and other regulatory bodies to fulfil legal, regulatory, and compliance requirements.

We typically do not rely on consent as the legal basis for processing personal data, except for sending email, phone, and direct marketing communications about campaigns and events. You retain the right to withdraw consent for marketing at any time by contacting us or utilizing the unsubscribe link provided in our email communications.

Itza’s Legitimate Interests

Administration of the Company: We need to undertake certain processing activities to govern and administer our company. Examples include:

Recording communication and marketing preferences.
Maintaining suppression files to respect opt-out requests.
Keeping records of user interactions and website usage history.
Reviewing user data for organizational improvement.

2. To contact you by email, post and phone: Contact with our users is key to the way we operate – when you sign up on one of our websites it enables us to keep in touch with you and keep you up to date with the numerous activities you can get involved with.

Specific examples of processing activities under this legitimate interest include:

Invitations to try new products or services.
Participation in surveys and product development support.
Event invitations and activity notifications by email, post, and phone.

3. Understanding our Users: Understanding our users enables us to communicate meaningfully and engage effectively. Examples include:

Analyzing database performance to develop products and services.
Researching user interests to deliver relevant and personalized content.
Customizing user experiences and displaying relevant content or information.

If you would like more information on our uses of legitimate interests or to change our use of your Personal Information in this manner, please contact us at support@itza.io.

8. What we communicate with you about

We communicate with you to provide the products or services you requested. For instance, if you signed up on a specific website, we keep you informed about its developments.

In addition to updates on our work, we may contact you about:

Development: Updates on our product and service development, inviting you to participate in activities, questionnaires, focus groups, or join the Itza Club.
Events: Invitations to various events such as Live Learning Challenges, online competitions, and special teacher events.

We respect your communication preferences and offer different options based on your consent:

Email Communications: We always seek your consent before contacting you via email.
Telephone and Postal Communications: While we don't typically seek consent for these channels, you can opt-out at any time if you prefer not to receive them.
You'll always know how we intend to use your details, and you can easily opt-out of communications via phone and post. You can unsubscribe from emails by contacting us directly or clicking the unsubscribe link provided. We include opt-out options in all communications.

If you've provided your telephone number, we may use it to contact you unless you're registered with the Telephone Preference Service (TPS). You can update your preferences anytime by contacting us.

Please note, changing your marketing preferences won't affect essential service communications. For example, if you're an Itza Club member but opt-out of specific product or website information, you'll still receive club updates until you choose to end your membership.

9. Who we share our information with

We prioritize safeguarding your personal details and do not sell or share them with third parties for marketing purposes. Additionally, our licensing partners do not retain any Personal Information on registered users of Itza educational resources.

While we handle many processing activities internally, we may engage suppliers to assist us in certain tasks. For example, if you participate in a Live Learning Challenge, we may share your login details with our partners to authenticate you on their platform. We also utilize third-party systems like Microsoft Azure and Amazon Web Services to store our data securely in the cloud. In such cases, we ensure that we have contractual agreements with these third-party suppliers, outlining their obligation to uphold the security and legal standards for handling your personal data. We only authorize suppliers to process your Personal Information for specific purposes and in accordance with our instructions.

For more information about our third-party processors, please feel free to contact us.

‍i) International transfers of personal data

‍Under certain circumstances, your Personal Information may be transferred outside of the UK.

When we transfer Personal Information outside of the UK (e.g., to our contracted service providers), we ensure that it is adequately protected in line with this privacy policy and applicable data protection laws. We do this through various means, such as:

Ensuring the recipient country has an adequate level of protection approved by the Information Commissioner’s Office; or
Implementing contracts with recipients based on “model contractual clauses” approved by the Information Commissioner’s Office, which mandate the protection of your personal data.
In some cases, the law may allow us to transfer your Personal Information outside the UK under specific circumstances. However, we always ensure that any transfer complies with applicable data protection legislation.

‍ii) Social media

‍Depending on your settings and the privacy policies of social media and messaging services like Facebook and Twitter, you may grant us permission to access information from those accounts or services. For instance, we may provide Personal Information such as your email address to Facebook to verify your account status. Subsequently, our adverts or promotions may appear on your Facebook feed. Your data is transmitted in an encrypted format and is deleted by Facebook if it does not match with a registered Facebook account.

For more information please see the Facebook’s Data Policy available here:
https://en-gb.facebook.com/policy.php

‍iii) Where required

‍We prioritize safeguarding your personal data. We only disclose it in accordance with this policy, with your explicit permission, or in special circumstances mandated by law. This may include situations where disclosure is necessary to protect the rights, property, or safety of Itza, or others. Such disclosures may be made to law enforcement agencies, regulatory bodies, or legal advisors as required.

10. How we keep our data safe

We implement robust physical, technical, and managerial controls to safeguard your personal details. Access to your information within our premises or on our systems is restricted to authorized personnel with a legitimate business need and who are trained in data handling protocols.

We employ appropriate security measures to prevent unauthorized access, alteration, disclosure, or loss of your personal data. We will notify you and relevant regulators of any breaches as required by law.

Please note that our website may contain links to third-party websites, each with its own privacy policies. We do not accept responsibility for the privacy practices of these websites. Before providing any personal data, please review their privacy policies.

While we take stringent measures to protect your Personal Information, we cannot guarantee the absolute security of data transmitted over the internet. Therefore, we advise you to exercise caution when disclosing Personal Information online and understand that such disclosures are made at your own risk.

If you have been provided with a password to access specific parts of our site, please ensure its confidentiality and refrain from sharing it with others.

11. How long we keep your data for

We retain your Personal Information only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. If you request to stop receiving communications from us, we maintain a record of your contact details to honour your preference.

‍Retention:

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Specifically:

Contact Information : Retained for five years after the last interaction with our services.
Transaction Records : Retained for seven years to comply with financial regulations.
Marketing Data : Retained until the user opts out of receiving marketing communications or for a maximum of two years from the date of collection.
After the retention period has expired, we will securely delete or anonymise your personal data in accordance with our data protection policies. You are deemed an active user if you have engaged with us within the preceding two years by opening our communications or interacting with our services.

Support period:

‍If you cease to be an active user, we continue sending communications for a limited period - up to two years for email, postal, and phone communications.

‍Other data:

‍Our data retention policy outlines retention periods for various data types. Please contact us for further details on data retention in such circumstances.

‍Anonymization or Deletion:

‍Upon anonymization or deletion of your data, we ensure it is no longer identifiable to you. Anonymized data may be retained indefinitely for research or statistical purposes without further notice.

12. Accessing your personal information

To facilitate access to your Personal Information, follow these steps:

Contact Us: Reach out to us to request details of the Personal Information we hold about you.
Provide Information: Send a description of the information you wish to access and proof of your identity.
Further Clarification: We may request additional information to fulfill your request, such as identity confirmation or specific data preferences. We may provide a form to assist you in this process.
Response Time: We aim to respond to your request within one month of receipt. There is no fee associated with accessing your personal data. However, we reserve the right to refuse unfounded, repetitive, or excessive requests.

13. How to change your contact prefrences

You have the right to request changes to how we contact you at any time. You can opt out of receiving communications by contacting us directly or by using the opt-out links provided in our email messages.

If you wish to update your contact preferences (such as email, phone, or post), please reach out to us via email.

We will only email you if we have your consent to do so. Each email we send includes instructions on how to unsubscribe.

Please note that due to the timing of our communications, there may be a delay of up to two weeks before your request is processed. During this period, you may still receive communications from us. If you continue to receive communications after two weeks, please contact us again.

If you request to stop receiving communications, we will retain a record of your contact details for up to five years to ensure compliance with your request.

14. How to control the information we process about you

If you prefer not to have information collected as you browse our websites, you can adjust your browser settings to receive notifications about cookies and choose to decline them.

If you wish for us not to retain other personal details about you, simply refrain from providing them to us. Should you wish to cease information collection or processing by Itza, please inform us accordingly.

Objecting to Processing:

If you object to any of the processing activities outlined in this privacy policy, you have the right to object under certain circumstances. Please note that this may impact our ability to continue processing your data or providing specific information or services.
Where appropriate we will maintain a record of your name, postcode, and email address to ensure your preferences are respected, and you are not contacted further or subjected to processing you've objected to.

15. Your data rights

Under data protection laws, you have various rights regarding your personal data. If you wish to exercise any of these rights, please reach out to us.

Right to Access: You have the right to request access to your personal data, known as a 'subject access request'. This allows you to obtain a copy of the Personal Information we hold about you.
Right to Rectification: You can request that we correct any incomplete or inaccurate Personal Information we hold about you. We may need to verify the accuracy of the new data you provide.
Right to Erasure: You have the right to request the deletion of your Personal Information in certain circumstances. However, there may be legal obligations or rights that allow us to retain your Personal Information.
Right to Object and Restrict Processing: If we process your Personal Information based on legitimate interests, you can object to this processing or request restrictions if it impacts your fundamental rights and freedoms. We may still process your Personal Information if we have compelling legitimate grounds that override your rights.
Right to Data Portability: Under certain circumstances, you can request the transfer of your Personal Information from one service provider to another.
Right to Withdraw Consent: If we process your Personal Information based on consent, you can withdraw this consent at any time. However, we may still process your Personal Information if we have another legitimate reason for doing so.

Please note that we may have compelling reasons to continue processing your Personal Information despite your requests. If you have any concerns about how we handle your Personal Information,please contact us for further assistance.

16. Changes to this policy

This policy was last updated in April 2025. We may amend or update this policy at any time to take account of any changes to data protection law or other legislation. When further updates to the policy are made they will be posted on this page, so please check back here regularly. Any significant changes will be notified to you.

17. Further information

The laws that dictate how your Personal Information can be used are:

The UK Data Protection Act 2018
The Privacy and Electronic Communications Regulations 2003
UK General Data Protection Regulation (GDPR)

Complaints

‍We are dedicated to resolving any privacy-related complaints or concerns in a fair manner.

For comprehensive details on our complaints procedure and how to lodge a complaint, please get in touch with us.

If you have a complaint, please reach out to us initially, as we aim to address and resolve your concerns. However, if you feel that we have not adequately addressed your complaint, you have the right to escalate it to the UK's data protection authority, the Information Commissioner.

You can contact the Information Commissioner’s Office at ico.org.uk for further information or to report any concerns. As the UK’s independent authority, they are tasked with safeguarding information rights and ensuring data privacy for individuals. We collaborate with them to ensure that your information is handled appropriately, maintaining transparency and privacy standards.

18. Contacting us

If you require additional information regarding the collection, use, disclosure, transfer, or processing of your personal data, or if you wish to exercise any of the rights listed above, please reach out to our team. You can contact us by mail at:

Itza Media Limited
28 Dundas St
Edinburgh EH3 6JN
Scotland

You can also email us at: support@itza.io.

This document was last updated in June 2025.