Privacy Policy

1. Introduction and Who We Are

Welcome to the Iamgr8 Academy mobile application and website (collectively, the "Platform"). This Privacy Policy explains how REACTIV8 THE NATION LIMITED ("we", "us", or the "Company") collects, uses, discloses, and safeguards your personal data.

REACTIV8 THE NATION LIMITED is the Data Controller for the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018"). We are committed to protecting your privacy and processing your personal data fairly, lawfully, and transparently.

2. Scope of This Policy

This Privacy Policy applies to:

• All users of the Iamgr8 Academy mobile application (iOS and Android);
• All visitors to iamgr8.co.uk;
• Any individual who contacts us by email, form, or other means in connection with the Platform.

This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform.

3. Data We Collect

3.1 Data You Provide Directly

• Account Registration Data: Full name, email address, username, password (encrypted), date of birth, and profile photograph (if uploaded).
• Profile Information: Bio, interests, learning goals, and any other information you choose to add to your profile.
• Payment Information: Where you purchase courses or subscriptions, payment card details are processed by our third-party payment processor (Stripe). We do not store full card numbers on our servers. Apple Pay and Google Pay transactions are handled by the respective platform providers under their own privacy policies.
• Communications: Messages you send to us via email or in-app support features, including their content and metadata.
• User-Generated Content: Content you create, submit, or share on the Platform, including course progress notes, community posts, and responses to course materials.

3.2 Data Collected Automatically

• Device and Technical Data: Device type, operating system version, unique device identifiers, IP address, browser type, mobile network information, and app version.
• Usage Data: Pages and content viewed, features used, time spent on the Platform, course completion data, click-through paths, search queries, and error reports.
• Location Data: General location inferred from IP address. We do not collect precise GPS location data unless you explicitly grant permission for a specific feature.
• Cookies and Similar Technologies: Please see Section 11 (Cookies) for full details.

3.3 Data From Third Parties

• Social Login Providers: If you register or log in via Apple, Google, or another third-party provider, we receive basic profile data as permitted by your settings with that provider.
• Analytics Partners: Aggregated and anonymised usage statistics from analytics services we employ (see Section 9).

4. How We Use Your Data

We process your personal data only where we have a valid lawful basis under UK GDPR Article 6.

5. Children's Privacy — Important

5.1 Our Approach to Children's Data

We comply with the UK GDPR Article 8 and the ICO's Age Appropriate Design Code (Children's Code), the Children's Online Privacy Protection Act (COPPA) where applicable, and the Google Play Families Policy and Apple App Store Guidelines for apps directed at or likely to attract children.

5.2 Age of Digital Consent

Under UK GDPR, the age of digital consent is 13 years old. Users aged 13–15 may use the Platform with verifiable parental or guardian consent. Users aged 16 and over may consent independently. We do not knowingly permit children under 13 to create an account without verified parental consent.

5.3 Parental Consent Process

Where a prospective user indicates they are under 16, we will:

1. Request the name and email address of a parent or legal guardian
2. Send a consent request to the parent/guardian with full details of the data we collect and how it is used
3. Activate the account only upon receipt of verified parental consent

5.4 Restricted Data Practices for Child Accounts

For accounts belonging to users under 16, we apply the following enhanced protections:

• No behavioural advertising is served to child users;
• No data is shared with third-party advertising networks in connection with child accounts;
• Community and social features are restricted or subject to moderation;
• Profile information is not publicly visible by default;
• Data minimisation is applied — we collect only what is strictly necessary to provide the educational service.

5.5 Parental Rights

Parents and legal guardians have the right to review, correct, and request deletion of their child's data, and to withdraw consent at any time. To exercise these rights, please contact us at info@reactiv8.org.uk.

5.6 Discovery of Underage Users

If we discover that we have collected personal data from a child under 13 without verifiable parental consent, we will take prompt steps to delete that data and deactivate the associated account.

6. Sharing Your Personal Data

We do not sell your personal data. We may share your data with the following trusted processors who act on our instructions only:

We may also disclose personal data where required to do so by law, court order, or regulatory authority (including the ICO), or in the event of a merger or acquisition.

7. International Data Transfers

Where we transfer personal data outside the United Kingdom, we ensure appropriate safeguards are in place, including UK Adequacy Regulations, International Data Transfer Agreements (IDTAs), or Standard Contractual Clauses approved by the ICO. You may request a copy of relevant transfer safeguards by contacting info@reactiv8.org.uk.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected.

Upon deletion of your account, we will delete or anonymise your personal data within 30 days, except where required by law to retain it longer.

9. Analytics and Tracking

We use analytics tools to understand how our Platform is used and to improve the user experience. These tools may process device identifiers and usage data. Where analytics are used in connection with child accounts, data is either not collected or is fully anonymised. You may opt out of analytics tracking by adjusting your in-app privacy settings or your device's advertising identifier settings.

10. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

To exercise any of these rights, please contact us at info@reactiv8.org.uk. We will respond within one calendar month. You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

11. Cookies and Similar Technologies

We use cookies and similar tracking technologies on our Platform. A cookie is a small file placed on your device that allows us to recognise you and remember your preferences.

You can manage cookie preferences through our in-app settings or your device browser settings. Note that disabling certain cookies may affect Platform functionality.

12. Account Deletion

How to Delete Your Account

You may delete your Iamgr8 Academy account at any time:

In-App:

1. Open the Iamgr8 Academy app
2. Go to Profile → Settings → Account
3. Select "Delete My Account"
4. Confirm your decision when prompted

By Email: Send a deletion request to info@reactiv8.org.uk from your registered email address, with the subject line: "Account Deletion Request — [Your Username]".

What Happens When You Delete Your Account

• Your account will be deactivated immediately;
• Your personal data will be permanently deleted within 30 days;
• Financial records will be retained as required by law (7 years);
• Anonymised course completion data may be retained for research purposes;
• Community content may be retained in anonymised form where removal is technically impracticable.

13. Data Safety (Google Play) and App Privacy (Apple)

In accordance with Google Play's Data Safety requirements and Apple's App Privacy Nutrition Labels, we provide the following summary:

All data collected is used to provide and improve the educational service. We do not share personal data with advertisers or data brokers. Security practices include TLS encryption in transit and encryption at rest.

14. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Transport Layer Security (TLS) encryption for all data in transit;
• Encryption of sensitive data at rest;
• Role-based access controls limiting staff access to personal data;
• Regular security assessments and penetration testing;
• Incident response procedures compliant with UK GDPR breach notification requirements.

15. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email and/or a prominent in-app notification. The "Last Updated" date at the top of this Policy indicates when it was most recently revised. Continued use of the Platform following notification constitutes acceptance of the updated Policy.

17. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact: