RobocodeUK Privacy Policy. Version 12, last reviewed 31 October 2026.
1. Who we are
RobocodeUK Limited runs Robocode's coding classes, holiday camps, the Luminary Tech Path, exams and events, and the websites and apps they use. We are the data controller for the personal information described in this policy.
- RobocodeUK Limited, registered in England and Wales, company number 17251049.
- Registered office: The Exchange, 26 Haslucks Green Road, Shirley, Solihull, B90 2EL.
- Registered with Ofsted as a childcare provider, URN 2715831.
- Registered with the Information Commissioner's Office, registration number ZB517337.
Some Robocode centres are run by other companies in our group or by franchise companies. They use our systems to run those centres for us, and we remain the data controller for the information this policy describes.
How to contact us about your information
In this policy "we" and "Robocode" mean RobocodeUK Limited. "Your child" means a child you have registered with us. We call the children we teach Robocoders.
2. What this policy covers
This policy covers the information we hold when you use:
- robocode.uk, our website. The addresses www.robocode.uk and ftc.robocode.uk lead to it.
- my.robocode.uk, where you sign in: your family account, and the system our staff use (the CRM).
- camps.robocode.uk, holiday camps, including funded (HAF) places.
- ltp.robocode.uk, the Luminary Tech Path.
- partners.robocode.uk and franchise.robocode.uk, for organisations and people interested in working with us.
- hr.robocode.uk/apply, when you apply for a job or a work experience place.
- Free Tech Assessment days, events, exams and our merchandise shop.
- Our phone lines, email, WhatsApp, Facebook and Instagram messages, and forms.
Our staff have a separate staff privacy notice on hr.robocode.uk.
3. The short version
- We hold what we need to teach your child, look after them safely, and run your account.
- Health, SEND and safeguarding information is used only to look after your child, and only the staff who need it can see it.
- We keep records. We do not delete them on a timetable, except where section 12.3 says so. You can still ask to see them, correct them, object to how we use them, or ask us to delete them, and we look at every request (section 13).
- We never sell your information.
- Advertising cookies from Google, Meta and TikTok load on robocode.uk only if you say yes. When you book a Free Tech Assessment, book a place at an event, enrol in a class on its own page, book a holiday camp after arriving from one of our Facebook or Instagram adverts, or send a Luminary Tech Path enquiry, our server sends Meta a scrambled copy of your email address and phone number so we can tell which adverts work (section 9).
- An AI system, Claude by Anthropic, writes the Free Tech Assessment report from your child's answers. A member of staff sends it to you; it is never sent automatically (section 8).
- Calls to our phone lines are recorded, and callers are told. Recordings are transcribed and analysed (section 4.7).
For Robocoders. We keep your name, age, what you are learning and how you are getting on, so your Mentor can teach you. If you have told us about something that makes learning harder, or about your health, only the grown-ups who look after you in class can see it. If you do the Tech Assessment, a computer program helps write a report about what you enjoy and what to learn first. Your parent can ask us what we know about you at any time, and from the age of 16 you can ask us yourself.
4. The information we collect
4.1 Parents and carers
- Name, email address, phone number, home address.
- A second parent or carer's name, relationship, phone and email, if you give them (they do not get their own login).
- Your sign-in details (your password is stored only as a scrambled hash).
- How you heard about us, and who at Robocode helped you join.
- Your enrolments, payment plans, payment history, arrears and payment reminders, invoices and receipts, and funding you use (Tax-Free Childcare, Universal Credit childcare, Childcare Grant). We never see or store full card or bank details: Stripe handles them.
- The terms you agreed to, with the version and the date (for example the customer contract version 2026-09-29), and for the Luminary Tech Path your typed name and drawn signature.
- Your marketing choices, your email preferences, and whether you asked for WhatsApp booking messages.
- Messages you send us through your account, by email or through our help desk, including attachments.
- Reviews and feedback you give us, and your reasons if you leave.
4.2 Children
- Name, date of birth, gender, and your relationship to the child.
- Emergency contacts, who may collect your child, whether they may leave alone, and notes about collection.
- Your child's HMRC Tax-Free Childcare reference, if you pay that way.
- Your answers on photos and videos, first aid, and giving medication.
- How your child learns best, and notes the centre keeps.
- Classes, attendance and lateness, progress, lesson notes, behaviour and effort ratings, homework, rewards, course completions and certificates.
- Photos of your child's work, shared in class files and messages.
- Behaviour records, kept on our behaviour ladder, and when you were told.
- Exam entries: legal name, date of birth, gender, candidate number, previous exam centre, and access arrangements.
- Ratings and comments your child gives about their lessons and their teacher.
- Holiday camps also hold: school and year group, ethnicity, free school meals or HAF eligibility and codes, off-site trip consent, interests, and the camp's attendance, incidents, concerns and medication records.
- The Luminary Tech Path also holds: school year, and the name and phone number of your child's GP.
4.3 Health, SEND and safeguarding information
This is the most sensitive information we hold, and the law gives it extra protection.
- Medical conditions, allergies, dietary needs, medication and GP details.
- Special educational needs and disabilities (SEND), and whether your child has an EHCP. We do not ask for the EHCP document itself.
- Records of medication given at a centre: medicine, dose, time, who gave it and who witnessed it.
- Court orders and other safeguarding notes about your child.
- Safeguarding incidents and concerns, complaints, and the actions taken.
- Accessibility needs for exams.
4.4 The Free Tech Assessment
When your child does the Free Tech Assessment on a centre tablet we collect: their first name and age; 19 answers, including two short pieces of writing (instructions for a task, and what they dream of building); any support they ask for (help with reading, noise, sitting still, new people, writing, or "tell my Mentor"); how long each question took; whether they want to join; the Mentor's name and notes; the scores and the suggested first course; and the finished report.
When you book an assessment or an event we collect your name, email and phone, your children's names and ages, and any needs you tell us about.
4.5 When you use our websites and apps
- Analytics. Pages visited, the buttons and links clicked, the page address, and browser and device details, sent to PostHog (section 10). Codes and record numbers are taken out of page addresses before anything is sent. The words on buttons and links are kept only on our public pages; on the pages of your family account and on our staff pages they are removed. When you are signed in to my.robocode.uk, PostHog receives your account number and nothing else about you: never your name or your email address. PostHog never records your screen on robocode.uk or my.robocode.uk. On camps.robocode.uk, ltp.robocode.uk, partners.robocode.uk and franchise.robocode.uk, PostHog keeps a random number on your device only if you say yes on the cookie banner.
- Advertising cookies on robocode.uk, only if you say yes (section 9 and the Cookie Policy).
- Server records. Our servers record the address of each page requested, your IP address and your browser, to keep the service running and secure.
- The nearest-centre search. A postcode you type is looked up by Google to find where it is. If you use your location instead, it goes only to our own server.
- Advert details. If you come from an advert, the Free Tech Assessment booking, a class's own page and the Luminary Tech Path enquiry form keep the advert's click reference and campaign name with your booking or enquiry.
4.6 Messages we send
- Our emails are sent through Microsoft 365, and some of our newsletters through Mailchimp. For the emails our system sends automatically we keep a record of who we emailed, the subject and whether it arrived, but not the text. Messages written in your family account or through our help desk are kept in full.
- Every email my.robocode.uk sends to one person carries a tiny picture of our own. When your email app loads it, we record that the email was opened. Some email apps load pictures for everyone and some block them, so this tells us only roughly whether an email was read. Marketing emails from our holiday camps do the same, and also record which links are clicked.
- If you tick the newsletter box when you book a holiday camp, your email address is added to our camps newsletter list, which is kept in Mailchimp. Every newsletter has an unsubscribe link, and unsubscribing never affects a booking.
- If you tick the box, we send a booking confirmation, a reminder the day before and a note if we miss you on the day by WhatsApp. They name your children and the centre. You can reply: Codi, our AI helper (Claude, made by Anthropic), reads your reply and answers from our own records, or passes it to your centre's team. We keep a copy of each message and reply.
- If you message one of our Facebook Pages or Instagram accounts, we receive your message, the name on your Facebook or Instagram account and the id Meta gives you for that Page. Codi, our AI helper (Claude, made by Anthropic), reads it and answers with general information about our classes and camps, or passes it to your centre's team, who may reply from our system. We keep a copy of each message and reply. If a message looks like it comes from a child, Codi does not carry on the chat: it asks for a parent or carer to message us, and anything about a child's safety goes to our safeguarding lead.
- Phone codes to confirm your number are sent by WhatsApp or text message through Twilio.
4.7 Phone calls
Calls to and from our phone lines are recorded, and callers are told that calls are recorded. Tollring, our phone provider, keeps the recordings in the UK. Recordings are transcribed by OpenAI's speech service and analysed by Anthropic's Claude, so we can see how well we answer families and what they ask for.
4.8 Merchandise
Your name, email address and delivery address, and what you ordered. The order is passed to Shopify, where our merchandise is stocked.
4.9 Job and work experience applicants
- Jobs: name, contact details, CV, answers on the application, and the results of our checks if we offer you a role. We use an AI tool to compare a CV with the role (a match score, strengths and gaps); a person decides who is invited.
- Work experience for school students: name, date of birth, school, year group, postcode, a parent's contact details and consent. We share an application with the placement partner running the placement.
Once you work for us, our staff privacy notice on hr.robocode.uk covers you.
4.10 Partners, franchise enquirers and schools
Your name, organisation, contact details, where you are, and what you tell us about your plans. On franchise.robocode.uk and partners.robocode.uk, any figures and scenarios you save.
4.11 Reviews on Google
We copy the public Google reviews of our centres onto our website, with the reviewer's display name and profile photo.
5. Where the information comes from
- From you, and from your child (their assessment answers, lesson ratings and feedback).
- From our staff and Mentors, and the centre your child attends.
- From local councils that fund HAF holiday places, and HMRC for Tax-Free Childcare payments.
- From Meta, when you answer one of our adverts with a Facebook or Instagram lead form.
- From Google, for the public reviews in section 4.11.
- From another family who refers you to us.
- From our older forms on JotForm, while they are still in use (section 10).
6. Why we use it, and the law that allows it
| What we do | Lawful basis (UK GDPR Article 6) |
|---|
| Enrolling your child, teaching, registers, progress, certificates | Contract with you |
| Keeping your child safe: collection, emergency contacts, first aid, medication | Legal obligation (our Ofsted registration); vital interests in an emergency; contract |
| Safeguarding records and referrals | Legal obligation |
| Payments, collections, arrears, funding and accounts | Contract; legal obligation (tax records) |
| Booking confirmations, reminders and service messages | Contract |
| WhatsApp booking messages | Consent (the tick box) |
| Answering Facebook and Instagram messages | Legitimate interests (you wrote to us) |
| Marketing emails | Consent; for existing families, legitimate interests with an opt-out (PECR) |
| Knowing whether an email was opened | Legitimate interests |
| Advertising cookies | Consent |
| Measuring adverts with hashed details sent to Meta when you book a Free Tech Assessment, book a place at an event, enrol in a class on its own page, book a holiday camp after arriving from one of our Facebook or Instagram adverts, or send a Luminary Tech Path enquiry (section 9.2) | Legitimate interests; you can object at any time |
| Website and app analytics | Legitimate interests; consent where the site stores an identifier on your device |
| The Free Tech Assessment and its report | Steps you asked for before a contract; legitimate interests |
| Recording and analysing phone calls | Legitimate interests |
| Photos and videos of your child | Consent |
| Exams | Contract; the exam boards' rules |
| Recruitment and work experience | Steps before a contract; legitimate interests; legal obligation for pre-employment checks |
| Complaints, disputes and legal claims | Legitimate interests; legal obligation |
Health, SEND, safeguarding and ethnicity need a second condition (UK GDPR Article 9 and the Data Protection Act 2018, Schedule 1). We rely on: safeguarding of children and of individuals at risk (Schedule 1, paragraph 18) for health, SEND and safeguarding information; your explicit consent before we give your child medication; equality of opportunity or treatment (Schedule 1, paragraph 8) for ethnicity on funded holiday camps; and the establishment, exercise or defence of legal claims.
Where we rely on legitimate interests we have weighed them against your interests and your child's, and you can object (section 13).
7. How we protect children's information
- Staff see only what their role needs. A Mentor sees the children in their own classes. A centre sees only its own families.
- A Mentor sees the SEND, medical, allergy, dietary and medication details of their pupils, because they need them in class. Money is hidden from Mentors.
- Court orders and safeguarding notes are for the centre's managers and safeguarding leads.
- Searching or sorting families by health or SEND details needs a separate permission for each centre, and every use is logged.
- Safeguarding records are seen only by the centre's named safeguarding lead and deputy, and head office. A concern about an adult is never shown to that adult. Our safeguarding alert emails never name the child.
- Every change to a child's name, date of birth, health, SEND, emergency contacts, collection or photo answers is recorded, with who made it and what it was before.
- Staff sign in through one staff login with single-use tokens. Sign-ins time out, and we can sign anyone out everywhere at once.
- The servers that hold children's records, and their backups, are in London (Amazon Web Services). Backups are copied every night to separate storage that the server itself cannot read or delete.
- Everything travels over an encrypted connection.
8. Computers that help us decide
The Free Tech Assessment report. Fixed rules score your child's answers and suggest a first course. Claude, an AI system made by Anthropic, marks one written answer and writes the report. We send Claude your child's first name and age, their answers and any support they asked for, the centre and the Mentor's name. We do not send their surname, date of birth, your details, or their medical or SEND records. The report is kept on our system. A member of staff sends it to you; the Mentor decides what to recommend, and you can ask a person to look again.
Payments. Our system follows the payment terms you agreed to. It counts missed payments, and a child whose account is two payments behind is stopped at the register. For the Luminary Tech Path it follows the LTP Payment Policy: it sends the notices, suspends attendance after 15 business days, and adds the policy's £10 charge, which the centre can waive. For every programme, a place that has stayed blocked for 30 days is closed automatically. If one of these steps affects you, you can ask a person at the centre to look at it again, and they can reverse it. Any other late fee is only ever added by a person.
Other simple rules. We use rules to set membership tiers, to offer free places at centres that choose to, and to show staff which families may need a call (for example after two missed lessons or a failed payment). A person decides what to do.
Recruitment and calls. AI tools compare CVs with a role and summarise phone calls. A person makes every decision.
9. Advertising and measuring our adverts
9.1 Cookies
On robocode.uk, advertising tags from Google (Tag Manager, Google Ads and Google Analytics), Meta and TikTok load only if you say "Yes, that is fine" on our cookie banner, and only on our public pages: never in your family account on my.robocode.uk, and never on our SEND and EHCP page. They tell us which adverts brought families to us. Meta's and TikTok's tags are set to read the contact details you type into a form on a page where they run (your email address, phone number, name and address) and to send them to Meta or TikTok in scrambled form, so they can match your visit to their users. You can change your mind at any time on our Cookie Policy page, robocode.uk/cookies, where the full details are.
9.2 Details sent from our server
When you book a Free Tech Assessment on robocode.uk, book a place at an event on robocode.uk, enrol and pay on a class's own page on robocode.uk or join its waiting list, book and pay for a holiday camp on camps.robocode.uk after arriving from one of our Facebook or Instagram adverts, or send a Luminary Tech Path enquiry, our server sends Meta: your email address, phone number, first name and last name, each hashed (turned into a scrambled code), the country, the reference Meta gave the advert click that brought you (if any), your browser's type, the page address and the campaign name; for a class enrolment, also your IP address, a scrambled form of your account number and the amount paid; and, for a camp, the amount paid. This is our server, not a cookie, so it happens whatever you chose on our cookie banner. Meta compares the codes with its own users to tell us whether the booking or enquiry came from one of our adverts, and to show our adverts to people more likely to book. We never tell Meta about a free (HAF) camp place. Meta does not receive your child's details.
Where a booking is made or attendance is recorded, we may share an associated transaction value with our advertising partners, together with the information described above, solely for the purpose of measuring the effectiveness of our advertising. No personal data relating to any child is shared for this purpose.
When you answered one of our adverts through a Facebook or Instagram lead form, we tell Meta, in the same scrambled form, when you book and when you buy.
When Luminary Tech Path registration moves into my.robocode.uk, my.robocode.uk will send Meta the same details in the same way.
You can object at any time by emailing info@robocode.uk, and we will stop sending your details to Meta for this purpose.
10. Who we share information with
We never sell personal information. These companies process it for us, under contract:
| Company | What for | What they receive | Where |
|---|
| Amazon Web Services | Our servers, database and backups | Everything we hold | London |
| Microsoft (Microsoft 365) | Sending email; our centres' mailboxes and help desk; our document storage | Emails, attachments, documents | UK |
| Stripe | Card and Direct Debit payments | Your name and email; the product line, which names your child | UK, EU and USA |
| Meta (WhatsApp) | Booking confirmations and reminders, and your replies | Your phone number and first name; your children's names; the booking and centre; your replies | EU and USA |
| Meta (Facebook and Instagram) | Receiving and answering messages you send us | Your name and Meta id for our Page; your messages and our replies | EU and USA |
| Meta (adverts) | Measuring our adverts | See section 9 | EU and USA |
| Google | Tag Manager, Google Ads, Google Analytics (only with your yes); maps and postcode look-ups; videos on course pages | See sections 4.5 and 9 | USA and elsewhere |
| TikTok | Measuring our adverts (only with your yes) | Browser and page details, and the scrambled contact details in section 9.1 | Outside the UK |
| Twilio | Phone codes by WhatsApp or text; invitation texts | Your phone number; your first name and centre on invitations | USA |
| Anthropic (Claude) | Writing the Tech Assessment report; call summaries; recruitment tools; picking anonymous camp feedback; answering WhatsApp, Facebook and Instagram messages (Codi) | See sections 4.7, 4.9 and 8 | USA |
| OpenAI | Transcribing recorded phone calls | Call recordings | USA |
| Tollring (HiHi) | Our phone system and call recordings | Calls | UK |
| PostHog | Website and app analytics | See section 4.5 | European Union |
| Supabase | Databases for the HR, sales, partners and franchise apps | Applicant, lead and enquiry details | European Union (HR: Ireland) |
| Shopify | Merchandise orders | Your name, email and delivery address | Outside the UK |
| JotForm | Older forms not yet moved to our own apps | What you entered in the form | European Union |
| Mailchimp | Some of our newsletters, and the camps newsletter list | Your email address, your name where you gave it, and that you booked a camp | USA |
JotForm is being closed. When it closes, all its submissions are exported to our Microsoft 365 document storage and the JotForm account is closed or downgraded.
We also share information, only when needed, with:
- the centre your child attends, including centres run by franchise companies;
- exam boards (such as BCS, AQA and Pearson), when we enter your child for an exam;
- a camp venue's kitchen or caterer, who receives the names of that day's children with allergies or dietary needs, and what those needs are, only after the caterer has confirmed their email address;
- local councils, for funded HAF places, and HMRC for Tax-Free Childcare;
- the placement partner for a work experience application;
- safeguarding partners: the local authority, the police, the Local Authority Designated Officer, Ofsted, and other agencies when the law or a child's safety requires it;
- our professional advisers and insurers, and a court or regulator where the law requires it;
- a buyer of all or part of our business, who would have to use your information in the same way.
11. Information that leaves the UK
Some of the companies in section 10 process information outside the UK. Where a country does not have UK "adequacy" status, the company's terms with us include one of the safeguards the law allows: the UK Extension to the EU-US Data Privacy Framework for certified US companies, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us which one applies to a company. Our own servers and their backups are in London; the HR, sales, partners and franchise apps keep their databases with Supabase in the European Union.
12. How long we keep information
12.1 We keep records
We keep the records of families, children, bookings, payments and our work with them. We do not delete them on a timetable. We keep them because:
- families come back, and brothers and sisters join, often years later;
- a child's progress, certificates and exam results may be needed long after they finish with us;
- safeguarding records must be available for many years after a child leaves;
- tax and accounting law requires financial records for at least six years;
- we need them to answer questions, complaints or claims about a child's time with us.
Keeping records does not mean using them for anything new. A family that has left is not contacted for marketing unless they agreed to it, and the rights in section 13 still apply to everything we keep.
12.2 What does not last
- Form answers saved on your own device while you fill in a Luminary Tech Path form are removed when you finish, or after a day.
- Backups are kept for 400 days.
- PostHog keeps analytics events for seven years, the period our PostHog plan sets.
- Sign-in details stored in your browser are cleared when you sign out.
12.3 Where we remove details after 24 months
- Holiday camps: 24 months after a camp ends, a child's name, date of birth, ethnicity, gender, EHCP, allergy and diet details, HAF code, school and trip notes are anonymised. We keep a record that cannot identify the child, for our funding and attendance figures.
- Job applications: an application that does not lead to a job is anonymised 24 months after it closes.
- Partner and franchise enquiries: kept for 24 months after our last contact with you.
13. Your rights
You have the right to:
- see the information we hold about you or your child, and get a copy;
- correct anything that is wrong or incomplete (you can change many details yourself in your family account);
- object to how we use it, including to marketing (we always stop marketing when asked), to analytics, and to the advert measurement in section 9.2;
- ask us to delete it. Because we keep records (section 12), we look at every request on its own facts. We delete what we can. Where we must keep something, for example a safeguarding record, a financial record or something needed for a claim, we tell you what we are keeping and why, and we can restrict how it is used;
- restrict how we use it while a question is being settled;
- take information you gave us to another provider in a common computer format;
- withdraw consent at any time, where we rely on it (photos, WhatsApp messages, marketing, cookies). This does not affect what we did before;
- ask a person to review a decision made by a computer (section 8);
- complain to the Information Commissioner's Office (section 19).
How to ask. Email info@robocode.uk (or ltp@robocode.uk) or our Data Protection Lead. You do not have to use a form, but our Subject Access Request Form on the Policies page may help. We record every request in our GDPR request log, check who is asking so we do not give your child's information to the wrong person, and reply within one month. If a request is complex we may take up to two more months and will tell you why. There is normally no charge.
14. Children and their own rights
The information is about your child, so the rights belong to your child. We accept a child's own request from the age of 16, and we answer them in words they understand. For a child under 16, a parent makes the request for them. We will not give a parent information where doing so could put a child at risk.
15. Marketing, and your choices
- We send newsletters and offers only if you asked for them (for example the newsletter box, or "I'd like news and offers from Robocode"), or, for existing families, about similar classes, with a way to stop in every email.
- Every marketing email has an unsubscribe link. In your family account you can switch reminders, feedback requests, marketing and announcements on or off separately.
- Messages about your bookings, payments and your child's safety are not marketing and are still sent.
- Refusing marketing never affects your child's place.
16. Photos and videos
We ask for your consent at enrolment: on my.robocode.uk one yes or no covers progress reports, the centre's updates and Robocode's own posts. Holiday camps and the Luminary Tech Path ask their own photo question when you book. You can change your answer at any time in your family account or by telling the centre, and we stop new use straight away. Published photos never carry a child's full name, school or contact details. Children with a safeguarding flag are never published. Our Photography and Image Consent Policy has the details.
17. Security, and if something goes wrong
Section 7 describes how we protect children's information. Staff are trained, and bound by confidentiality. If a breach is likely to put you at risk, we tell the ICO within 72 hours and tell you without undue delay if the risk is high.
18. Cookies
Our Cookie Policy, at robocode.uk/cookies, explains what each of our websites stores on your device and how to choose.
19. Changes, contact and complaints
We will update this policy when what we do changes, and tell families by email if the change matters to them.
Questions or requests: info@robocode.uk, or our Data Protection Lead, Ahmed Ayad, A.Ayad@robocode.uk, RobocodeUK Limited, The Exchange, 26 Haslucks Green Road, Shirley, Solihull, B90 2EL.
If you are unhappy with how we have used your information, please tell us first. You can also complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, ico.org.uk.