TMGCL Ed: Universal Privacy Policy

Covers: cZeus Launchpad, cZeus Planet, and cZeus School League
Last Modified: March 2026

This Privacy Policy applies to the use of the TMGCL Ed website (https://ed.tmgcl.com) and the mobile applications cZeus Launchpad, cZeus Planet, and cZeus School League (collectively "cZeus Apps"), and all related services provided by The Mathematical Games Company Limited (“TMGCL”).

1. Our Role and Definitions

• TMGCL: The Mathematical Games Company Limited (Company No: 8093051), 1-7 Park Road, Caterham, Surrey, CR3 5TB, UK.
• Data Controller: For individual users of Launchpad and Planet, TMGCL is the Controller. For cZeus School League, the School is the Data Controller, and TMGCL acts as the Data Processor.
• Legislation: This policy complies with the UK GDPR, the Data Protection Act 2018, and the ICO Children’s Code.

2. Data We Collect

We collect only the minimum data required to provide a functional and secure educational experience.

A. Provided by You (Teachers & Individuals)

• Teachers: Full Name, School Name, Academic Email, and Encrypted Password.
• Individual Users: Name and Email (for account recovery and newsletters).

B. Managed by Schools (cZeus School League)

• Pupils: Full Name (or ID), Class, and Username.
• Nicknames: Students may choose a nickname to remain anonymous on inter-school leaderboards.

C. Automatically Collected (Technical Data)

• Identifiers: IP Address and Device ID.
• Usage: Game attempts, progression, session duration, and crash reports.
• Hardware: Operating system version and web browser type.

3. How We Use Your Data

We process data for the following purposes:

1. Operation: To manage accounts and track game progress.
2. Competition: To generate "Closed-Loop" rankings within a school and nickname-only leaderboards for public leagues.
3. Communication: To send technical alerts and newsletters via Brevo (No third-party marketing).
4. Security: To monitor system health and prevent unauthorized access using IP/Device logs.

4. Safeguarding & Privacy by Design

5. Data Storage & Recipients

• Location: All data is hosted on AWS London (eu-west-2). No personal data is transferred outside the UK/EEA.
• Sub-Processors:
  • AWS: Infrastructure provider.
  • Brevo: Email delivery (Servers in France/EEA).
  • Proxima.si: Our development team in Slovenia (EEA). They access the environment via secure SSH with MFA under strict NDAs.
• No Sale of Data: We never sell or rent user data to third parties.

6. Data Retention

• Active Accounts: Data is kept while the account is active.
• Inactive Schools: Records are purged 24 months after a subscription ends.
• Deactivation/Deletion: Teachers can deactivate accounts instantly. Permanent deletion is performed by TMGCL upon formal request.
• Logs: System logs (including IP addresses) are deleted after 12 months.

7. Security Measures

We implement "Security by Design":

• Encryption: All passwords are salted and hashed. Data in transit is protected via TLS 1.3.
• Access Control: IAM users with Multi-Factor Authentication (MFA).
• Backups: Weekly snapshots are maintained for disaster recovery.

8. Children’s Privacy

For users under 13:

• School League: The school is responsible for obtaining parental consent as the Data Controller.
• Individual Use: We require parental/guardian consent before collecting personal data from children under 13.

9. Your Rights

Under the UK GDPR, you have the right to:

• Request a copy of your data (Subject Access Request).
• Correct inaccurate data or request erasure.
• Object to or restrict processing.

Contact: To exercise these rights, email [email protected] or write to Dr. Shohreh Blank at our registered address.

10. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.