Last updated: October 2026

In plain English

• We collect only what we need to run our website, Learning Lab and workshops.

• We collect children's feedback anonymously wherever we can, and we never sell personal data.

• We photograph or record people only with the right permission, and you can withdraw it at any time.

• Funders see anonymised or combined results, not information about individual children.

• You can ask to see, correct or delete your data at any time by emailing hello@thethreadpoint.org.

1. Who we are
Our website, www.thethreadpoint.org, and ThreadPoint Learning Lab are operated by The Thread Point Studio Ltd, a company registered in England and Wales (company number 16365885), registered office 27 Old Gloucester Street, London, WC1N 3AX. In this policy, "ThreadPoint", "we", "us" and "our" mean The Thread Point Studio Ltd.

The Thread Point Studio Ltd is the data controller for personal data collected through our website, Learning Lab, purchases and licences.

The Thread Point Foundation CIC (company number 16401333) is a separate organisation. Whichever of the two organisations delivers a workshop or activity is responsible for the personal data collected for it, and we will make clear who that is when you book or take part. Where the two work together, we will set out who is responsible for what.

This policy covers visitors to our website, Learning Lab users, customers, and the adults and children who take part in our workshops. If you work or volunteer with us as a facilitator, you will receive a separate notice explaining how we handle your information.

2. What personal data we collect

2.1 Website visitors and enquiries

• Name and email address

• Organisation, role or job title, where provided

• Details of enquiries and correspondence

• Newsletter subscriptions and communication preferences

• Technical information, such as IP address, browser, device and pages visited

2.2 Learning Lab users
Learning Lab is designed for educators, facilitators, schools, libraries and other authorised organisations. When you register, we may collect your name, email address, school or organisation, role, login details, licence information, the resources you access, and technical information needed to run and secure the platform. Children do not need to create accounts.

2.3 Purchases, licences and payments
Name and contact details, billing address, order and transaction records, invoices, licence periods and renewal dates. Payments are processed by third-party providers, and we do not store full payment card numbers.

2.4 Workshops and community activities
Depending on the activity, we may collect:

• names and contact details of teachers, organisers and other responsible adults

• school, library or organisation details

• participant numbers and age groups

• registration or attendance information, where needed

• feedback and evaluation responses, and learning outcomes

• photographs, video or audio, where permission is in place (see section 5)

• information about accessibility, reasonable adjustments or safeguarding, where necessary

We collect children's learning feedback anonymously wherever practical, and we do not routinely need children's full names to evaluate their learning.

3. How we use personal data and why
We process personal data only where we have a lawful basis under UK data protection law.

• Providing our services (contract or legitimate interests): creating accounts, giving access to free and licensed resources, checking eligibility, managing purchases and licences, and sending service messages about your account or access.

• Responding to enquiries (legitimate interests, or steps before a contract): answering schools, organisations, partners and prospective customers.

• Delivering and evaluating workshops (legitimate interests, contract or consent, depending on the activity): organising sessions, working with schools, measuring learning outcomes, improving our materials, and producing monitoring and evaluation reports. We use anonymous or combined information wherever possible.

• News and updates (consent, or another basis where electronic marketing rules allow): newsletters and information about our programmes, resources and events. You can unsubscribe at any time.

• Photographs and recordings (consent): see section 5.

• Running and securing our website (legitimate interests, legal obligation or consent): keeping our website and platform working, protecting accounts, investigating misuse and understanding how the site is used.

• Legal and financial duties (legal obligation): accounting, tax and other legal requirements.

We do not use children's personal data for profiling, targeted advertising or direct marketing. Where we process special category data, we will identify and record an appropriate additional legal condition before doing so.

4. Children's privacy
Our website and Learning Lab are intended for adults. Where children take part in our workshops, we collect as little information about them as we can.

4.1 Working with schools and organisations. Schools, libraries and community organisations may give us the information we need to organise a session. Responsibility for children's data depends on who decides how and why it is used. We do not assume that a host organisation's involvement transfers all responsibility for children's data to that organisation. Where needed, we put data-sharing or data-processing arrangements in place.

4.2 Sensitive information. Where necessary, we may handle limited information about accessibility, reasonable adjustments, health or safeguarding. We handle it with extra care, restrict access to it, and collect only what the activity or safeguarding duty requires.

4.3 No selling or marketing. We do not sell children's personal information.

5. Photographs, video and audio
Taking part in a ThreadPoint activity does not mean someone agrees to be photographed or recorded.

• Consent first. Where we rely on consent, we obtain it before we capture or use identifiable images or recordings. For children, permission must come from a parent, guardian or other person legally able to give it. Where a school or host organisation arranges consent, we ask them to confirm it covers ThreadPoint's intended use. General school photography consent is not treated as permission for us to publish images.

• How we may use them. For the purposes explained when consent is given, such as our website and social media channels, educational publications, impact reports, presentations to schools, funders and partners, and promotional materials about our work. Consent for one purpose does not cover every other use. We do not sell identifiable images or recordings of children.

• Choosing not to be photographed. Participants can decline without losing access to the activity. We offer arrangements so children without permission are not identifiable in published material, and we often use non-identifiable images, such as hands, LEGO builds or learning materials.

• Withdrawing consent. You can withdraw consent at any time by contacting us. We will stop the relevant use and remove or delete material where reasonably possible. We may not be able to retrieve copies already lawfully distributed, downloaded or republished by others, and we will explain any limits when we respond.

• Storage. Images and recordings are stored securely, accessed only by authorised people who need them, and reviewed periodically. We delete them when they are no longer needed.

6. Who we share personal data with
We do not sell personal data. We share it only where necessary to run our services or deliver agreed activities, including with:

• website hosting, learning platform and membership service providers

• email and newsletter providers

• payment processors

• accounting and invoicing providers

• website analytics providers

• IT support and security providers

• authorised facilitators and delivery partners

• schools, libraries and other organisations involved in a specific activity, where necessary and lawful

Where providers process data on our behalf, we aim to have appropriate contracts and security measures in place. Some organisations act as independent controllers, and their responsibilities depend on the arrangement.

6.1 Funders and partners. Organisations may fund access to our resources, workshops and programmes. Funders and partners normally receive anonymised or combined reporting only, such as the number of participants reached, workshops delivered, schools or settings supported, changes in learning outcomes, anonymous feedback and general evaluation findings. We do not routinely give funders identifiable information about children. Where identifiable information must be shared, we will make sure there is a lawful basis, clear information for the people involved and any necessary agreement.

6.2 Legal requirements. We may disclose personal data where the law requires it, or where needed to establish, exercise or defend legal claims.

7. International transfers
Some of our service providers may process or store data outside the UK. Where that happens, we take steps to make sure the transfer complies with UK data protection law, for example by relying on UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about the safeguards that apply.

8. How long we keep personal data
We keep personal data only as long as reasonably necessary for the purpose it was collected, including legal, contractual, safeguarding and accounting needs. Our usual periods are:

• Account and licence information: for the life of the account or licence, then normally up to 2 years after closure or expiry

• Enquiries and correspondence: normally up to 12 months after the enquiry is resolved

• Invoices, payment and accounting records: normally 6 years after the end of the relevant financial year, or longer where the law requires

• Newsletter subscriptions: until you unsubscribe or we remove your details

• Marketing consent records: as long as reasonably needed to show compliance, including after withdrawal

• Workshop feedback: anonymised on collection wherever possible, or normally within 3 months

• Anonymised evaluation findings: may be kept for research, reporting and improving our programmes

• Photographs, video and audio: for the period explained when permission is given, reviewed at least every 2 years

• Website and platform usage logs: normally up to 24 months, depending on provider settings and operational needs

• Safeguarding information: in line with applicable safeguarding, legal and organisational requirements

These periods may be shorter or longer where necessary and lawful. When data is no longer needed, we securely delete it or anonymise it. Data that has been genuinely anonymised is no longer personal data.

9. Your rights
Depending on the circumstances, you have the right to:

• access a copy of the personal data we hold about you

• correct inaccurate or incomplete data

• erase your data in certain circumstances

• restrict how we use your data in certain circumstances

• object to certain processing, including processing based on legitimate interests and direct marketing

• portability, meaning to receive data you gave us in a structured, commonly used, machine-readable format in certain circumstances

• withdraw consent at any time where we rely on it, without affecting processing before withdrawal

We do not currently intend to make solely automated decisions with legal or similarly significant effects about Learning Lab users or workshop participants.

To use any of these rights, email hello@thethreadpoint.org. We may need to check your identity first, and we will respond within the timescales the law requires. You also have the right to complain to the Information Commissioner's Office at ico.org.uk. We would welcome the chance to address any concern first.

10. Cookies and website analytics
Our website and Learning Lab may use cookies and similar technologies, which are small files stored on your device.

• Essential cookies are needed for login, security, sessions and basic site functions. They generally do not need consent.

• Analytics and other non-essential cookies help us understand how our website is used. Where the law requires consent, they are not switched on until you give it. You can decline them and still use the website.

You can accept, reject or change your preferences through our cookie controls where available, or through your browser settings. Our providers may also set cookies under their own policies.

11. How we protect personal data
We take appropriate technical and organisational steps to protect personal data against unauthorised access, loss, misuse, alteration or disclosure, including:

• limiting access to authorised people who need it

• using password-protected accounts, and additional verification where available

• using reputable providers with suitable security arrangements

• collecting only the personal data we need

• taking extra care with children's information

No online system is completely secure. If a personal data breach occurs, we will assess the risk and notify the Information Commissioner's Office and affected individuals where the law requires.

12. Third-party websites and services
Our website may link to external sites and services run by others. They have their own privacy policies, and we are not responsible for their practices. We encourage you to read their privacy information before you give them personal data.

13. Changes to this policy
We may update this policy as our services, technology or legal obligations change. The latest version will always be on our website with its date. Where changes significantly affect how we use personal data, we will give additional notice where appropriate or required.

14. Contact us
The Thread Point Studio Ltd
Company number: 16365885
Registered office: 27 Old Gloucester Street, London, WC1N 3AX
Email: hello@thethreadpoint.org
Website: www.thethreadpoint.org

© 2026 The Thread Point Studio Ltd. All rights reserved.