Privacy Policy
Effective date: 5 October 2026 · Version 1.1
Taner Ltd (company number 17492661), trading as "TanersPlace" ("we", "us" or "our") provides a compliance self-assessment and tracking platform at tanersplace.com (the "Service") for Multi-Academy Trusts, schools and businesses. This policy explains what personal data we collect, why, how we protect it, and the rights you have over it.
We are a UK-based service, and this policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
TanersPlace is a trading name of Taner Ltd, a private limited company registered in England and Wales (company number 17492661), Where we act as a data controller (see Section 3), Taner Ltd is the party responsible for that processing under UK GDPR.
Data protection contact: privacy@tanersplace.com (or Taner@TanersPlace.com if that address is not yet active). [INSERT ICO REGISTRATION NUMBER once registered — see Section 12.]
2. The short version
- We collect the account details you and your colleagues give us (name, email, role), plus what you enter into the platform to track your organisation's compliance progress.
- We do not sell your data, and we do not use advertising or tracking cookies — there is exactly one cookie, and it exists purely to keep you logged in.
- All hosting is in the UK. We don't transfer your data outside the UK, except where a school chooses to sign in with Google or Microsoft, whose sign-in services are covered by their own privacy policies.
- You can ask for a copy of your data, ask us to correct or delete it, or raise a concern with the ICO, at any time — see Section 9.
- This product is used by school and business staff. We do not knowingly collect data about pupils — see Section 8.
3. Two roles we play: controller and processor
Because of what the Service does, we hold two different roles under data protection law, and it matters which one applies to a given piece of data:
- Data controller — for the account and platform-usage data described in Section 4 (who has an account, how they use the Service, billing and support communications). We decide why and how this data is processed, and this Privacy Policy governs it directly.
- Data processor — for the content your organisation enters or uploads into the platform as part of your own compliance work: assessment notes, evidence documents, DPIA files, and any names or details you choose to record about your staff or third-party service contacts (Section 5). Here, your organisation is the data controller, and we process this content only on your instructions, under a data processing agreement available on request (Section 11). If any of this content includes personal data about your staff, pupils, or other individuals, you are responsible for having a lawful basis to enter it into the Service.
4. Data we collect as controller (account & platform data)
| Category | Examples |
|---|---|
| Account details | Name, email address, role (e.g. Trust Lead, Academy Lead), organisation name and type, password (stored as a one-way cryptographic hash — we never see or store your actual password), optional profile picture |
| Sign-in & security data | Login timestamps, IP address, multi-factor authentication status, records of login attempts (used only to detect and block automated abuse) |
| SSO identifiers | If you choose "Continue with Google" or "Continue with Microsoft": the stable account identifier, name and email address those providers share with us (scope: openid email profile only — we never request access to your email inbox, files, calendar or contacts) |
| Usage & activity data | An audit trail of actions taken in the Service (e.g. "X marked item Y complete"), used for your own organisation's audit trail and to help us support you |
| Technical & log data | IP address, browser user-agent, pages visited and timestamps, for security monitoring and diagnosing faults |
| Communications | Support requests and any other correspondence you send us |
5. Data we process as processor (your organisation's content)
When you use the Service to carry out your own compliance work, you may enter or upload:
- Self-assessment answers, progress notes, and blockers recorded against a security or compliance framework;
- Evidence files and DPIA documents you upload as proof of compliance;
- Names, job titles and contact details of your staff (e.g. "SME/Admin" fields against a third-party service), where you choose to record them;
- Details of the third-party services and suppliers your organisation uses.
We store and process this content only to provide the Service to you, and we do not use it for any other purpose (including, for the avoidance of doubt, training any AI/ML model). See Section 3 for how responsibility for this content is split between us and your organisation.
6. Where your data is hosted, and who we share it with
All application hosting and database storage is located in the United Kingdom. We do not transfer your personal data outside the UK, with one exception: if you choose to sign in with Google or Microsoft, those companies process the sign-in exchange under their own privacy policies and may process data outside the UK as part of that.
We use a small number of service providers ("sub-processors") to run the Service, each engaged only to the extent needed to provide it to you:
| Provider | Purpose |
|---|---|
| Fasthosts (UK) | Web application hosting |
| ProSiteHosting (UK) | Database hosting |
| Our email delivery provider | Sending account verification, password reset, and notification emails |
| Google / Microsoft | Only if you choose "Continue with Google/Microsoft" to sign in |
| HackerTarget.com | Only if you actively use the optional Traceroute network diagnostic tool in a hosting environment where our primary method is unavailable — the destination address you're testing is sent to their API for that single lookup |
We do not sell, rent, or share your personal data with any third party for their own marketing purposes. We will only disclose personal data beyond the above where required by law, to protect our legal rights, or with your consent.
7. Cookies
The Service uses exactly one cookie: a session cookie (named appsession) that keeps you signed in. It is strictly necessary for the Service to function, is set to expire when you close your browser, and is never used for tracking, analytics or advertising. Because it is strictly necessary, UK law (PECR) does not require a cookie consent banner for it, and we don't show one. We do not use any third-party advertising, analytics, or tracking cookies or scripts.
8. Children's data
The Service is designed for use by adult staff at schools, academy trusts and businesses — not by pupils, and not directly by children. We do not knowingly collect personal data about pupils. If your organisation includes information about pupils within evidence you upload (Section 5), we process it solely as your processor, under your instructions and your organisation's own safeguarding and data protection obligations.
9. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), subject to any legal obligation we have to retain it;
- Restrict or object to certain processing;
- Port your data to another provider in a structured, commonly-used format;
- Withdraw consent at any time, where processing is based on consent;
- Complain to the Information Commissioner's Office (ICO) — ico.org.uk — if you believe we have not handled your data properly.
We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you.
If your organisation's Trust Lead/administrator manages your account, some requests (particularly relating to organisation-owned content under Section 5) may need to be directed to them, since they control that data. For anything we hold as controller (Section 4), contact us directly using the details in Section 1.
10. Data retention
We retain account data for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting and security obligations, after which it is deleted or anonymised. Security and audit logs are retained for a bounded period sufficient for their security purpose and no longer. Where you or your organisation delete content within the Service, we remove it from active systems promptly, though a copy may briefly persist in backups until those backups are, in turn, rotated out.
11. Data Processing Agreement
If your organisation requires a formal Data Processing Agreement (DPA) covering the content described in Section 5 — standard practice for schools and trusts under UK GDPR — please contact us and we will provide one.
12. Regulatory registration
[INSERT: confirmation of ICO registration status and registration number once registered — see ico.org.uk/for-organisations/register/. Organisations processing personal data as a controller are generally required to register with, and pay a data protection fee to, the ICO unless a specific exemption applies.]
13. Changes to this policy
We may update this policy from time to time — for example as the Service changes, or to reflect changes in the law. If we make a material change, we will take reasonable steps to notify account holders (such as an in-product notice or an email) before it takes effect. The "Effective date" and "Version" at the top of this page always show when it was last updated.
14. Contact us
Questions about this policy, or about how we handle your personal data, can be sent to privacy@tanersplace.com (or Taner@TanersPlace.com).
See also our Terms of Service.