Privacy notice

Last updated: 14 August 2026

1. About this privacy notice

This privacy notice explains how Prepsted collects, uses, stores and shares personal information when you:

• visit the public Prepsted website;
• contact us with an enquiry;
• ask for information about Prepsted;
• request a demonstration;
• communicate with us about purchasing or using our services;
• subscribe to marketing or other communications; or
• otherwise interact with us through the public website.

This notice applies to the public website at https://prepsted.co.uk/ and to sales, enquiry, demonstration and pre-subscription information that Cappuccino Education Ltd manages through its internal Prepsted administration tools.

Personal information processed by subscribing schools, trusts and authorised users through the Prepsted application is covered by the separate Prepsted Application Privacy Notice. That notice also explains the security information used for mandatory email-based login verification and IP-bound authenticated sessions.

2. Who we are

Prepsted is operated by Cappuccino Education Ltd, trading as Prepsted.

Company number: 17379337

Registered office or principal business address:
41 Oakfield Crescent
Blaby
Leicester
LE8 4HS

For the purposes of UK data-protection law, Cappuccino Education Ltd is the controller of the personal information described in this notice. This means that we decide why and how that information is used.

You can contact us about privacy or data protection at:

Email: privacy@prepsted.co.uk
Postal address: 41 Oakfield Crescent, Blaby, Leicester, LE8 4HS

We are not currently required to appoint a Data Protection Officer. Responsibility for data protection is overseen by our designated privacy lead, who can be contacted at privacy@prepsted.co.uk.

3. The personal information we collect

The information we collect depends on how you use the website and communicate with us.

Information you provide directly

This may include:

• your name;
• the email address you use to make the initial enquiry;
• your telephone number;
• your job title or professional role;
• the name of your school, trust or organisation;
• information contained in an enquiry, demonstration request or other message;
• your communication and marketing preferences;
• a school or Trust email address supplied for a demonstration;
• information about a demonstration link, including when it was issued, when it expires and whether it was opened;
• where you ask to proceed, requestor and school details, billing contact details and a purchase order number or reference;
• information relating to a potential subscription or customer relationship; and
• any other information you choose to provide.

Please do not include pupil names, safeguarding information, health information or other sensitive personal information in a general website enquiry.

Information collected automatically

When you visit the website, our hosting, security and technical systems may collect information such as:

• your IP address;
• the date and time of your visit;
• the pages or resources requested;
• browser and device type;
• operating system;
• referring website or search engine;
• approximate location derived from an IP address;
• cookie preferences;
• diagnostic and security information; and
• server and error-log information.

Cookies and similar technologies

We may use cookies and similar technologies to operate, secure, understand and improve the website.

Strictly necessary technologies may be used where required for functions such as security, network management or remembering privacy choices.

We will not use non-essential cookies or similar technologies unless you have made an appropriate choice through our cookie controls.

Further information is available in our Cookie notice.

4. How we obtain personal information

We normally obtain personal information directly from you when you:

• complete a website form;
• contact us by email or telephone;
• request a demonstration;
• ask for information about Prepsted;
• subscribe to communications; or
• communicate with us about becoming a customer.

We may also receive professional contact information from:

• your school, trust or organisation;
• a colleague who refers or introduces you;
• publicly available school, trust or professional websites;
• professional networking platforms;
• public directories;
• events, conferences or professional meetings; or
• existing customers and professional contacts.

Where we obtain information from another source, we will use it only where we have a lawful and reasonable basis for doing so.

5. How and why we use personal information

We use personal information only where we have a lawful basis under UK data-protection law.

Responding to enquiries

We use your contact details, organisational information and the contents of your enquiry to respond to questions and provide requested information.

Our lawful basis is normally our legitimate interests in operating Prepsted, communicating with potential users and responding to professional enquiries.

Where you are personally the proposed contracting party, the lawful basis may also be that the processing is necessary to take steps at your request before entering into a contract. Where the proposed contract is with your school, trust or other organisation, we normally rely on our legitimate interests in responding to the professional enquiry and taking the requested steps with that organisation.

Arranging demonstrations and discussing subscriptions

We use professional contact and organisational information to manage demonstration requests in our internal Sales Demos register, request a school or Trust email where appropriate, issue private time-limited demonstration links, understand your requirements, provide proposals and discuss potential subscriptions.

Where you choose to proceed, we use the requestor, school, billing and purchase-order information you provide to take the requested steps towards setting up a subscription and to maintain appropriate business and financial records.

Our lawful basis is normally our legitimate interests in responding to requested professional demonstrations, developing and operating our business and taking proportionate steps towards a customer relationship. Where you are personally the proposed contracting party, processing necessary at your request before entering into that contract may also rely on the contractual lawful basis.

Managing customer and professional relationships

We may retain relevant correspondence and professional contact information to manage our relationship with a school, trust, supplier, adviser or other organisation.

Our lawful basis is our legitimate interests in administering professional relationships, maintaining appropriate records and providing an effective service.

Operating and securing the website

We use technical, device, server and security information to:

• deliver the website;
• identify and investigate technical problems;
• maintain website security;
• prevent misuse, fraud or unauthorised activity;
• maintain logs and backups; and
• protect Prepsted, our users and our systems.

Our lawful basis is our legitimate interests in providing a reliable and secure website and protecting our services and information.

Improving the website and our services

We may use website-use information, feedback and enquiry themes to understand how the website is used and improve its content, accessibility and performance.

Our lawful basis is our legitimate interests in improving Prepsted and understanding the needs of schools and trusts.

Where this involves non-essential cookies, analytics or similar technologies, we will obtain consent where required.

Marketing and professional communications

We may send information about Prepsted, product developments, articles, events or related services where:

• you have asked to receive it;
• you have given consent;
• the law permits us to contact you based on an existing customer relationship; or
• another lawful basis applies to a business-to-business communication.

You can unsubscribe or object to direct marketing at any time by using the unsubscribe option in the communication or contacting us.

You have an absolute right to object to the use of your personal information for direct marketing.

Meeting legal and regulatory obligations

We may use or disclose personal information where necessary to:

• comply with applicable law;
• respond to a lawful request from a regulator, court or public authority;
• establish, exercise or defend legal claims;
• maintain financial and business records; or
• investigate suspected unlawful activity.

The lawful basis may be compliance with a legal obligation or our legitimate interests in protecting our legal rights.

6. Our legitimate interests

Where we rely on legitimate interests, those interests may include:

• operating and developing Prepsted;
• responding to professional enquiries;
• communicating with schools, trusts and education professionals;
• providing an effective and secure website;
• maintaining appropriate business records;
• improving our services;
• preventing misuse and protecting our systems;
• promoting Prepsted appropriately to professional audiences; and
• establishing, exercising or defending legal rights.

Before relying on legitimate interests, we consider whether the use of personal information is necessary, proportionate and consistent with what an individual would reasonably expect.

7. Special-category and sensitive information

The public website is not designed to collect special-category personal information, including information about:

• health;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade-union membership;
• genetic or biometric identifiers;
• sex life; or
• sexual orientation.

It is also not intended to collect criminal-offence information, safeguarding records or identifiable pupil information.

Please do not provide this information through the public contact form or general website enquiries.

If sensitive information is provided unexpectedly, we will assess whether it is necessary to retain it and may delete or securely restrict it.

8. Children’s information

The public Prepsted website is intended for school, trust and education professionals. It is not directed at children and is not intended to collect personal information directly from children.

Please do not submit pupil names, pupil-level evidence or other identifiable information about children through the public website.

9. Who we share personal information with

We may share personal information with trusted organisations that help us operate Prepsted, such as:

• website and application hosting providers;
• email and communications providers;
• website developers and technical-support providers;
• security, backup and infrastructure providers;
• analytics and cookie-management providers;
• customer relationship or enquiry-management providers;
• payment, accounting and financial-service providers;
• professional advisers, including accountants, insurers and legal advisers;
• regulators, courts, public authorities or law-enforcement bodies where disclosure is lawful and necessary; and
• prospective purchasers, investors or advisers involved in a genuine business reorganisation, merger or sale.

These organisations may act as processors operating under our instructions or as independent controllers with their own legal responsibilities.

We require processors to protect personal information, use it only for authorised purposes and comply with applicable data-protection requirements.

We do not sell personal information to advertisers or data brokers.

Current principal providers

• Website hosting, application hosting and email: Fasthosts Internet Limited, 2 Cathedral Walk, The Forum, Gloucester, Gloucestershire.
• Search-performance information: Google LLC, through Google Search Console, 1600 Amphitheatre Parkway, Mountain View, California 94043, United States.

We use Google Search Console to understand how pages on our public website appear and perform in Google Search. This includes aggregated information such as search impressions, clicks, search terms and average position. Search Console does not require us to place Google Analytics tracking code on the website. Google processes information generated through its own search services under its own privacy arrangements.

10. International transfers

Some of our suppliers may process or allow access to personal information outside the United Kingdom.

Where personal information is transferred internationally, we take steps to ensure that the transfer is lawful and that an appropriate level of protection applies. Depending on the destination and provider, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s Standard Contractual Clauses; or
• another safeguard permitted by UK data-protection law.

You can contact us for further information about the safeguards applicable to a particular transfer.

Google LLC is based in the United States. We use Google Search Console to understand how pages on our public website appear and perform in Google Search. Google processes information generated through its own search services under its own privacy arrangements.

11. How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, security and record-keeping requirements.

Our expected retention periods are:

• General enquiries that do not lead to a customer relationship: six months after the last meaningful contact.
• Private demonstration access: a demonstration link is usable for 120 hours from creation. The access credential is invalid after that point and is removed by the next available housekeeping run, unless a controlled legal or security hold requires the non-usable record to be preserved.
• School/Trust-email request links: up to seven days, after which the access credential is invalid and removed by housekeeping.
• Demonstration and prospective-customer records: 12 months after the last meaningful contact.
• Customer and contractual correspondence: for the duration of the customer relationship and up to six years afterwards, where required for contractual, tax or legal purposes.
• Marketing records: until you unsubscribe, withdraw consent or object, subject to retaining limited suppression information so that we can respect your preference.
• Cookie-consent records: 30 days, when used.
• Website and server security logs: website and server logs generated by our hosting provider are generally retained for between a few days and 90 days, depending on operational and security requirements. Security and fraud-prevention information may be retained for up to six months, or longer where necessary for a specific investigation, legal obligation or security purpose.
• General contact-form submissions held in the website or email system: six months where they remain general enquiries. Demonstration/prospect records follow the 12-month period above, and information that becomes part of a customer or contractual record follows the applicable customer/contractual period.
• Records needed for legal claims: for the relevant statutory limitation period or for as long as the claim remains active.

We may retain information for a longer period where required by law, where a dispute is ongoing or where it is necessary to establish, exercise or defend legal rights.

12. How we protect personal information

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental or unlawful loss;
• misuse;
• alteration;
• destruction; and
• unauthorised disclosure.

These measures may include access controls, encrypted connections, password protection, restricted administration access, secure hosting, backups, software maintenance and procedures for responding to security incidents.

No internet-based service can be guaranteed to be completely secure. You should avoid sending unnecessary or highly sensitive information through general website forms or ordinary email.

13. Whether you must provide information

You are not generally under a legal obligation to provide personal information through the public website.

However, where information is marked as required on a form, we need it to respond to your enquiry or provide the requested service. If you do not provide the required information, we may be unable to respond fully, arrange a demonstration or take steps towards providing a subscription.

14. Automated decision-making and profiling

We do not use information collected through the public website for behavioural profiling, automated eligibility decisions or solely automated decisions that produce legal or similarly significant effects on individuals.

15. Your data-protection rights

Depending on the circumstances and lawful basis, you may have the following rights.

Access

You may ask us for confirmation that we process your personal information and request a copy of that information.

Rectification

You may ask us to correct inaccurate information or complete information that is incomplete.

Erasure

You may ask us to delete your personal information in certain circumstances.

Restriction

You may ask us to restrict how we use your personal information in certain circumstances.

Objection

You may object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

You have an absolute right to object to direct marketing at any time.

Data portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive information you provided in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation.

Withdrawal of consent

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights relating to automated decisions

You have rights relating to certain decisions made solely through automated processing. We do not currently make such decisions using information collected through the public website.

These rights are not absolute and may not apply in every circumstance. We may need to verify your identity before responding to a request.

We will normally respond within one month. We will tell you if a legal exception applies or if additional time is required.

To exercise a right, contact privacy@prepsted.co.uk.

16. Complaints

We encourage you to contact us first if you have a concern about how we use personal information. We will consider your concern and try to resolve it.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk

You may also contact the supervisory authority in the country where you live or work, where applicable.

17. Links to other websites

The website may contain links to websites or services operated by other organisations.

We are not responsible for the privacy practices of external websites. You should review the privacy information provided by the relevant organisation before submitting personal information to it.

18. Changes to this privacy notice

We may update this notice when:

• our website or services change;
• we introduce new suppliers or technologies;
• our data-processing activities change; or
• legal or regulatory requirements change.

The latest version will be published on this page with an updated review date.

Where a change materially affects how we use existing personal information, we will take reasonable steps to bring it to the attention of affected individuals before beginning the new processing.

19. Related information

You may also wish to read:

• the Prepsted Cookie Notice;
• the Prepsted Accessibility Statement; and
• the Prepsted Application Privacy Notice, covering authorised-user accounts, application data and login security;

20. Contact us

For questions about this notice or how Prepsted uses personal information, contact:

Cappuccino Education Ltd
Email: privacy@prepsted.co.uk
Postal address: 41 Oakfield Crescent, Blaby, Leicester, LE8 4HS