Privacy Notice

Our approach is built around clear governance, robust security and continual improvement. From the way we develop our platform to the suppliers we choose and the policies we follow, protecting information is embedded in how we work.

This Privacy Notice explains:

• what information we collect;
• why we collect it;
• how we use and protect it;
• when we share it;
• your rights under UK data protection law; and
• how to contact us if you have any questions.

We aim to be open, transparent and easy to understand. If anything isn’t clear, please get in touch. We’re always happy to help.

This Privacy Notice explains how Steps Along the Way Ltd, trading as Motional, collects, uses, stores and protects personal information.

Website: www.motional.io

Email: support@motional.io

Depending on the circumstances, Steps Along the Way Ltd acts as either a Data Controller or a Data Processor.

When we are the Data Controller

We are the Data Controller when processing information relating to:

• website visitors;
• enquiries;
• customers;
• suppliers;
• employees and contractors;
• marketing communications; and
• the operation of our business.

When we are the Data Processor

When schools, trusts, local authorities and other organisations use Motional, they remain the Data Controller.

They decide what information is collected, why it is collected, how long it is retained and who it is shared with. Our role is to process that information only on their documented instructions and in accordance with our contractual Data Processing Agreement.

Depending on how you interact with us, we may collect:

• contact information, such as your name, organisation, job title, email address and telephone number;
• account information, including user account and authentication details;
• technical information, including IP address, browser, operating system and device information;
• website and platform usage information; and
• where customers use Motional, the categories of personal information described within our Data Processing Agreement, including educational and wellbeing information where chosen by the customer.

We use personal information to:

• provide and support our services;
• administer customer accounts;
• respond to enquiries;
• communicate with customers;
• improve our products and services;
• maintain the security of our systems;
• meet legal and contractual obligations; and
• support the safe and effective use of Motional.

Where Steps Along the Way Ltd acts as the Data Controller, we process personal information using one or more of the lawful bases set out in Article 6 of the UK GDPR, including:

• Contract – to provide our services and fulfil our contractual obligations.
• Legal Obligation – where processing is required by law.
• Legitimate Interests – where processing is necessary for our legitimate business interests and those interests are not overridden by the rights and freedoms of individuals.
• Consent – where consent is required and has been freely given.

Where we rely on Legitimate Interests, we complete and maintain a documented Legitimate Interests Assessment.

Where we act as the Data Processor, the lawful basis for processing is determined by the relevant Data Controller.

Protecting information is fundamental to how Motional operates.

We maintain a comprehensive information governance framework supported by documented policies, risk assessments and security controls designed to protect information throughout its lifecycle.

Our security measures include:

• encryption in transit and at rest;
• secure cloud infrastructure;
• role-based access controls;
• strong authentication and Multi-Factor Authentication where appropriate;
• supplier due diligence;
• information classification;
• asset management;
• security monitoring; and
• regular reviews of our security and governance arrangements.

We only share personal information where necessary to provide our services, comply with legal obligations or support our business operations.

Where third parties process information on our behalf, they do so under appropriate contractual and security obligations.

Some approved service providers operate outside the UK. Where personal information is transferred internationally, appropriate safeguards are applied in accordance with UK GDPR.

Details of our approved sub-processors are available on request and form part of our customer contractual documentation

We keep personal information only for as long as necessary to fulfil the purposes for which it was collected and to meet our legal and contractual obligations.

For customer data held within Motional:

• information is retained for the duration of the customer’s subscription;
• a 90-day transfer window applies by default when a subscription ends, or a participant is removed, helping schools support transitions between settings;
• customers can amend this transfer window within their account settings; and
• once the transfer window expires, information is securely and permanently deleted.

Where appropriate, we may contact organisations about products or services that we believe are relevant to their role. We do this in accordance with UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

Every marketing email includes a simple way to unsubscribe, and you can opt out at any time.

Under UK GDPR you may have the right to:

• access your personal information;
• correct inaccurate information;
• request deletion of your information;
• restrict or object to processing;
• request a portable copy of your information;
• withdraw consent where consent is the lawful basis; and
• complain to the Information Commissioner’s Office (ICO).

If you have any questions about this Privacy Notice, or would like to exercise any of your privacy rights, we’d be pleased to help.

Email: [email protected]

We aim to respond promptly and will always seek to resolve concerns openly, fairly and transparently.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).

Website: www.ico.org.uk

Telephone: 0303 123 1113

Protecting personal information is an ongoing responsibility. We regularly review our privacy practices, security controls and governance arrangements to ensure they remain effective, proportionate and aligned with changes in legislation, technology and the evolving needs of our customers.

Trust is built over time. We’ll continue to review and improve our approach to privacy so that the organisations and individuals who use Motional can remain confident that their information is being handled responsibly and with care.