Privacy notice

1.Who we are and how to contact us

BizTeach [registered legal name, company number and postal address to confirm], Donegal, Ireland, is responsible for the personal data described in this notice. Our founder is Wendy Smyth, a Business and Special Educational Needs teacher. For school-provisioned accounts, the respective responsibilities of BizTeach and the school must be explained in the school's information and agreement with BizTeach.

For questions about your data or to exercise your rights, email info@bizteach.ie. The responsible privacy contact and whether a Data Protection Officer is required remain to be confirmed.

2.What this notice covers

This notice describes the public website (bizteach.ie) and the BizTeach learning platform, where access is offered. Joining the early access list is separate from creating a platform account or buying a subscription.

It should be read alongside our Cookie information, Terms of use, Safeguarding statement and Acceptable use of AI, all linked from the footer.

3.The personal data we collect

On the website today:

• Early access form: first name, email address, whether you are a student, teacher or parent or guardian, your consent choice, and the date and time you joined.
• Feedback form: the message you write and the topic chip you pick. This form is anonymous; we do not ask for your name or email.
• Email and phone: whatever you choose to tell us when you contact us.
• Technical data: service and security records may include IP addresses, request times, device or browser information, account references and errors, depending on the service. Security logs are separate from optional website analytics and from AI conversations.
• Cookies and similar storage: strictly necessary items, plus Google Analytics (via Google Tag Manager) only if you opt in through the cookie banner. See our Cookie information for the full list.

When you use the platform, we process account and guardian details, date of birth, school or cohort details where applicable, learning progress, practice answers and feedback, project work, accessibility preferences, AI questions and replies, reports, and consent records as needed for the features you use. Stripe processes payments for paid plans; BizTeach keeps the subscription and payment references needed to manage access and billing.

4.Why we use it and our legal basis

The GDPR requires a lawful basis for each purpose. Ours are:

• Sending you the free resource pack and early access updates: your consent (Article 6(1)(a)). You can withdraw it at any time using the unsubscribe link or by emailing us.
• Replying to your feedback, questions and support requests: our legitimate interest in running and improving BizTeach (Article 6(1)(f)).
• Providing the platform once you have an account: performance of our contract with you (Article 6(1)(b)).
• Optional AI coaching: consent, where that is the applicable lawful basis. School-provisioned processing may use a different basis, which must be explained in the information provided for that account.
• Keeping the site secure and preventing abuse: our legitimate interests (Article 6(1)(f)).
• Keeping records we are legally required to keep, such as tax and accounting records: legal obligation (Article 6(1)(c)).
• Acting on a safeguarding concern: legal obligation and, where necessary, the vital interests of a child (Articles 6(1)(c) and 6(1)(d)).

We do not sell personal data, and we do not use it for advertising or to build marketing profiles.

5.Children and young people

BizTeach is built for Senior Cycle students, most of whom are aged 15 to 19. Where consent is the lawful basis for an online service offered directly to a child under 16 in Ireland, a parent or guardian must authorise that consent. This does not mean that every use of a school-provisioned account relies on consent. The relevant signup information must explain the basis and any guardian approval required.

Our approach is informed by the Data Protection Commission's Fundamentals for a Child-Oriented Approach to Data Processing: collect only what is needed, avoid advertising profiles, and explain data use in language students can understand.

If we learn that we have collected data from a child without the required consent, we will delete it. Parents and guardians can contact info@bizteach.ie about their child's data.

6.How Biz, our AI study coach, uses your data

When you ask Biz a question or paste in work for feedback, relevant text, conversation context and learning material are processed through Amazon Web Services' model services to generate a reply. Do not include names, contact details or sensitive information about yourself or others in prompts. We cannot promise that text you paste contains no personal data.

BizTeach does not use your work to train its own AI models. The exact model service configuration, provider retention and contractual training restrictions must be confirmed before a broader no-training or zero-retention promise can be made. Saved conversations and reported replies may be used to investigate safety concerns and errors; their approved retention periods and reviewer procedure remain to be confirmed.

Biz does not make decisions about you that have legal or similarly significant effects. Its feedback is study guidance, not a grade, and it never affects any official result. You always have the right to have a human at BizTeach review anything Biz has said.

Read our Acceptable use of AI page for what Biz will and will not do.

7.Who we share data with

The following services and recipients support BizTeach. Their exact contracting entities, applicable agreements and service-specific processing arrangements must be recorded in the final provider schedule:

• Amazon Web Services (AWS): website delivery, application hosting, PostgreSQL database storage, encrypted backups, authentication, operational logs and model services. The database and recovery storage are hosted in Ireland; CloudFront uses a global delivery network. Ireland hosting does not mean that all service processing or support access stays in the EU.
• Zoho services: mailboxes, transactional email and mailing-list communications where configured. EU account hosting and any support access, tracking and retention arrangements need service-specific confirmation.
• Cloudflare: DNS for bizteach.ie. Any additional proxy, analytics or security processing must be disclosed if enabled; DNS alone must not be treated as evidence of the configuration of every Cloudflare service.
• AI inference through AWS: the active model, any fallback model, processing locations and retention settings must be verified in the provider schedule. A model publisher is not necessarily a direct recipient of prompts.
• Stripe: hosted payment collection and subscription management. BizTeach receives billing and subscription references rather than collecting your full card details itself.
• Google Analytics, through Google Tag Manager, for optional website analytics if you consent. This is separate from the learning platform's operational logging.
• Authorised school personnel, where your account is linked to a school, receive only the information allowed by their role and the applicable school arrangement.
• Professional advisers such as accountants and solicitors, where necessary.

We will disclose data to An Garda Síochána, Tusla, the courts or a regulator where the law requires it, or where it is necessary to protect a child or another person from harm. See our Safeguarding statement.

8.International transfers

Our core database and recovery storage are hosted in Ireland. Global delivery, provider support and some service configurations may involve processing outside the European Economic Area. These arrangements require an applicable transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, and any necessary additional safeguards. The account-specific agreements and transfer assessment remain subject to verification; we do not claim that all information stays in the EU. Contact info@bizteach.ie for details.

9.How long we keep data

• Early access, feedback and support records: their approved retention periods and deletion arrangements remain to be confirmed. You can unsubscribe from marketing or request erasure separately.
• Platform accounts, learning history, AI conversations, project work and guardian records: the final approved retention schedule remains to be confirmed. We do not currently promise a universal automatic expiry for these records.
• Operational and application logs: retention depends on the configured service and log group; there is no single 30-day period for every log. Logs may contain personal data and are subject to access controls.
• AWS CloudTrail security audit objects: currently scheduled for expiry after 400 days. These record infrastructure activity and are not a record of every student conversation or bucket request.
• PostgreSQL backup objects: currently scheduled for expiry after 30 days, with superseded object versions scheduled for expiry after one day. Disk snapshots use a separate policy retaining seven daily snapshot sets. Protected initial recovery snapshots may remain longer until safe replacement conditions are met.
• Billing records: retained for the applicable accounting and tax obligations; the final schedule must distinguish BizTeach's records from Stripe's own retention responsibilities.

Expiry is scheduled rather than guaranteed at an exact hour. Deleting an account or withdrawing consent does not immediately remove copies already held in protected backups. Backup copies remain subject to their recovery retention cycle. Before a restored database is returned to user traffic, erasures and withdrawn permissions must be re-applied; the durable replay and verification procedure still requires completion and approval.

10.How we protect it

The site is served over HTTPS. Administrative access is protected by access controls, and application database connections verify TLS certificates and use role-specific permissions. Provider contracts and security arrangements remain subject to the verification described above. We will notify the Data Protection Commission and affected people where the applicable breach-notification duties require it.

Encrypted database backups and coordinated disk snapshots support recovery. An isolated recovery rehearsal has verified database restoration in another Availability Zone. These controls reduce recovery risk but do not provide automatic database failover or guarantee uninterrupted service. Security monitoring is separate from reviewing AI conversations for safeguarding.

11.Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you (access);
• correct anything inaccurate or incomplete (rectification);
• delete your data (erasure), where there is no overriding reason to keep it;
• limit how we use it (restriction);
• give you your data in a portable format (portability);
• stop processing based on legitimate interests (objection);
• withdraw consent at any time, without affecting anything done before you withdrew.

Email info@bizteach.ie to exercise any of these. We will reply within one month, free of charge, and may ask you to confirm your identity first.

If you are unhappy with how we handle your data, you have the right to complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, www.dataprotection.ie. We would appreciate the chance to resolve it first.

12.Changes to this notice

We will update this notice when our processing changes. The date at the top records the latest revision; it is not evidence of legal approval or a change to the terms accepted in your platform account. Significant changes will be communicated through the applicable account or mailing-list channels.