Claytheapp Ltd, a company registered in England and Wales under number 11870733 whose registered address is at Kemp House 160 City Road, London, EC1V 2NX hereinafter referred to as (‘Clay’ ‘We’, ‘Us’ or ‘Our’), have created this privacy statement (‘Statement’) in order to demonstrate Our firm commitment to the privacy of the details that You provide to Us when using the Site or the App to access Our Services. 


We are committed to protecting and respecting Your privacy and Your Personal Data. For the purpose of the Data Protection Legislation, We are the Data Controller (ICO registration number: 06710005844). 

For all matters relating to privacy and data protection, please contact Leonardo Vano, Data Protection Manager (DPM) by email to or by telephone to +44 2031953955.

We are regulated by the Independent Commissioners Office (ICO). 

In this Privacy Statement, references to ‘You’, ‘Your’ and Member are references to our registered users, including school administrators, parents, students and teachers who use the Site or the App.

We aim to be as clear as possible in this Privacy Statement in respect of Your Personal Data. This Privacy Statement applies to Your Personal Data that We collect about You when You use the Site or the App, how and when it is used, how We protect it and who has access to it (the ‘Terms’). 

This Privacy Statement incorporates Our Site, and the App, Clay policies and as applicable by this reference; unless otherwise stated, any defined terms in here shall have the meaning set out in the Terms and Conditions.

● Your Acceptance of this Privacy Statement

● What Personal Data is collected & how?

● How is Your Personal Data used?

● Who has access to Your Personal Data?

● How do We protect Your Personal Data and for how long?

● Do We use cookies?

● Complaints or queries

● Your rights under Data Protection Legislation?

● Definitions & Interpretations

● Changes to this Privacy Statement


  1. This Privacy Statement governs Your use of Our Services, including any dispute concerning privacy. By using Our Services, You accept this Privacy Statement in full. You should read the Statement carefully and ensure that You understand its effect before proceeding to use the Site or the App to access Our Services.  

  2. We reserve the right to make reasonable changes to any of the Terms at any time. Any changes We do make will be posted on this page and, where appropriate, notified to You by email, or, when You next log in, the new Terms may be displayed on-screen and You may be required to read and accept them to continue. 

  3. Personal Data and Special Category Personal Data are defined in accordance with the Data Protection Legislation. In this Privacy Statement, Personal Data shall include the meaning of Special Category Personal Data.




  1. In order for Us to provide You with Our Services, We collect two main types of Personal Data – personal information and anonymous information – and We may use personal and anonymous information to create aggregate information (which does not identify and cannot reasonably be used to identify an individual student).

  2. We are committed to ensuring that the information We collect and use is appropriate, relevant and proportionate for the stated purpose. Some types of Personal Data may be voluntarily provided by You which is to be shared with Us (and Our Service Providers as applicable) in respect of Yourself (or in respect of one or more other individuals where lawful authority is granted to You by those other individuals) which shall include as follows:


What Personal Data is processed?

  • Source:  Where is it collected from/ via?

  • What is the ‘purpose’ of processing? 

  • What is the lawful basis (Article 6) for processing?

  • What is the ‘purpose’ of processing? 

  • What is the lawful basis (Article 9) for processing?


Retention: For how long is it held?

  • Based upon your status i.e. prospective, registered or verified member, we may collect information such as Your email, name, date of birth, phone number, location, and school community.

  • We may also collect details of other interactions that you have with us, together with any other information that you choose to provide us with, for example, through your interactions with our customer and technical support teams.

  • Via the school or Parents and Teachers Association database,

  1. or 

  • Via a Clay employee at a school or local community event.

  • To invite you to join the Clay community, verify you as Member permitted to enter a schools’ in-app community, send notifications, provide updates, respond to your enquiries and verify your linked accounts on the grounds set out at Article 6(1)(b) .

  • To take steps at the request of the data subject prior to entering into a contract, which are necessary for the performance of a contract to which the data subject may wish to become a party to or is a party to.

  • The period for which the personal data is stored is dependent on Your status.  and our statutory legal requirements in the UK. As a prospective member, information may be kept for 6 months As a registered or verified member, information may be held for up to 12 months after You cease to be a registered member.

  • Based upon your status i.e. prospective, registered or verified member, we may collect information about Your child’s allergies.

  • You 

  • To enable Members to be informed of the allergies had by a child they may offer or request help for.

Allergies are special category data. We lawfully process this data on the grounds set out at Article 6 6(1)(d) vital interests & 9(2)(h) health.

  • The period for which the personal data is stored dependent on Your status and our statutory legal requirements in the UK. As a prospective member, allergy information may be kept for 6 months. As a registered or a verified member, allergy information may be held for up to 12 months after You cease to be a registered member.


  1. Some of the information collected in the table above is essential for Us to provide You with Our Services but it is Your choice whether You provide all the information We request. Not providing information may affect Our ability to provide all of Our Services to You.

  2. We will retain Your Personal Data only for as long as is necessary to provide Our Services which You request and in accordance with the retention periods set out in this Privacy Statement. We shall then delete it unless you ask Us not to, or We have a legitimate reason to retain it. We need to retain sufficient information about You in compliance with certain legal or statutory requirements, for example, in the event of a legal or insurance claim in the future so that We can identify You. 

  3. We may from time to time offer a range of additional services. We may need to collect additional information about You as part of this. This may include but is not limited to introducing useful third-party products and services to you, promotions, prize draws, competitions and surveys. Additional notices about the information that We collect and how We will use it will be provided to You at the point that You are invited to make use of these additional services. 

  4. Where We state that We rely on consent under Article 6(1)(a) to process Your Personal Data for a particular purpose as per column 3 of the table at Clause 2.1, You have the right to withdraw Your consent at any time. This will not affect the lawfulness of processing carried out by Us which was based on consent before its withdrawal.


  1. As part of the process of using Our Services, We may also collect the following types of Personal Data automatically about You via Your use of cookies and other technologies:

  • your visits to the site or the app and the content that you download;

  • your ip address;

  • your geographical location;

  • your browser type and version;

  • your operating system;

  • your referral source;

  • your length of visit;

  • your page views and site and/ or app navigation and exit;

  1. To learn more, please see Our Cookie Policy.

  1. We agree to adhere to all Data Protection Legislation and will take appropriate technical and organisational security measures against the unauthorised or unlawful processing of Your Personal Data and against accidental loss or destruction of, or damage to, Your Personal Data. 

  2. We shall process Personal Data listed in the table at Clause 2.1 only to the extent, and in such a manner, as is necessary for the sole purpose of fulfilling Our Services (including making improvements to Our Services). For the avoidance of doubt, We are the exclusive owner (or lawful licensee) of the Site or the App as well as the Content.


  1. Each monetary transaction made via the Site or the App shall be processed by a third-party payment processing partner who is a Service Provider – Pin Payments. You will be required to provide them with Your Personal Data including financial data. You are subject to their terms and conditions here.


  1. We will process the Personal Data You provide in a manner that is compatible with the Data Protection Legislation. 

  2. We will try Our best to keep Your Personal Data accurate and up-to-date and We shall not keep it for longer than is necessary. Our aim is not to be intrusive and We undertake not to ask You irrelevant or unnecessary questions. Moreover, the information You provide will be subject to rigorous measures and procedures to minimise the risk of unauthorised access or disclosure.


  1. You acknowledge that, Your Personal Data may be used by Us to contact You when necessary in connection with Your use of the Site or the App to access Our Services as follows:


  • What Type of Non-Marketing Communication?

  • Method of presentation/ sending?

  • Legal Basis for processing? 


  • To provide access to our products and services;

  • To manage prospective purchases, purchased subscriptions and payments including to provide quotes or offers for, and updates about, our products and services;

  • To send a confirmation notice to the Member of the registration;

  • To administer and manage accounts, including password resetting, responding to questions raised by Members, to contact the Member about any problems with the Member’s account or conduct on the Site;

  • To send booking reminders

  • To send community updates

  • To send emails about the Site including information about current events, changes, improvements, upgrades, new product development and rules of the Site;

  • To publish the names of high performing schools on the Site or in the Clay newsletter and to provide results data for each Member or school;

  • To send prizes or certificates for participation and performance on the App;

  • For administrative, planning, product or service development, quality control and research 

  • In App notifications, Emails, SMS

  • We do not need Your explicit consent for this as the “processing is necessary for the performance of a contract” under Article 6(1)(b) GDPR.


  1. From time to time and with Your permission, We may contact You and send you Marketing Communications that We believe may be of interest to You which shall be of the type (and via the method(s)) referred to in the table below). By looking at Your participation profile as well as any additional information which You have agreed can be shared with Us, We can identify news, offers and services that are most likely to be most relevant and will meet Your needs. When We send You a Marketing Communication, We may monitor whether You have opened the communication and clicked on any included links. This will enable Us to track and analyse Your level of engagement/ interest in the communication We are sending to You and will provide Us with further insight into what type of communications are of most interest to You. These Marketing Communications may come from Our partner organisations:


What Type of Marketing Communication?

  • Method of presentation/ sending?

  • Legal Basis for processing?

How can you opt out of continuing to receive direct marketing communications?

  • Newsletter or information or offers regarding upcoming promotions, partner updates, services or surveys.

  • Email

  • We will only send You these using the lawful basis under Article 6(1)(f) GDPR where you are a Member /we have a working relationship and/or you have attended one of Our  meetings and have not opted out of, or objected to, receiving Marketing Communications

  • ‘Unsubscribe’ button on a Clay marketing communication

  1. If You agree to receiving any of the above Marketing Communications but later change Your mind, You can use the ‘unsubscribe’ link at the end of any electronic communication received by You or simply respond to Our prompt in all of Our communications to You. If you opt out of Our communications, We will retain Your Personal Data on our suppression list so that We comply with Your wishes not to be contacted again.



  1. We process Personal Data about You where We have a “legitimate interest” to do so as stated in this Privacy Statement in the tables at Clauses 2.1 and/ or 3.3 and/ or 3.4. In some cases, this may require Us to collect additional information from You or from other sources. Where We do rely on “legitimate interests” under Article 6(1)(f) GDPR  to process Your Personal Data, You have the right to object to any of the processing We undertake. If You wish to object to Our processing of Your Personal Data where We rely on this lawful basis, please complete Our Data Subject Rights Request Form. 

  1. PROFILING: We may from time to time use publicly available demographic information to determine who We target for specific events or marketing campaigns so as to avoid contacting individuals unnecessarily. You have the right not to be subject to a decision based solely on automatic processing (Article 22). We undertake profiling when You have visited Our  Site and/ or Our App or Facebook Page]. In order to manage Your cookie preferences via Our Cookie Preference Management Tool, please see Our Cookie Policy. 


  • Registration with Facebook Connect: We offer You the opportunity to register with Us through Facebook Connect (Facebook Inc., USA, Data protection declaration: An additional registration is not necessary in this case. You will be redirected to the Facebook page where you can log in with Your user data. This will link Your Facebook profile and Our service. The link automatically provides Us with the following information from Facebook: Facebook name, Facebook profile and cover picture, email address stored on Facebook, Facebook friends lists, Facebook likes, birthday, gender, country, language. Data is used to set up, provide and personalize Your customer account.

  • Social media plugins: On Our Site or Our App, We have included social media plugins that you can use to share certain content over social networks. To protect your privacy, We offer you these social plugins as so-called “2-click buttons.” The “2-click solution” prevents data (e.g. your IP address) from being transmitted to social networks such as Facebook or Twitter as soon as You open Our Site or the App For this purpose, the buttons are deactivated by default and are only activated by clicking the social plugins for the first time. After activation, the plugins also collect Personal Data such as Your IP address and send it to the servers of the respective provider where it is stored. In addition, activated social plugins set a cookie with a unique identifier when loading the relevant website. This also allows providers to create profiles of Your usage behaviour. The data will be used by them to show You personalized advertising on the social network, as well as for market and opinion research purposes.

  • Data transfer is independent of whether You have an account with the plugin provider and are logged in there. If You are logged in with the plugin provider, Your data collected with Us will be assigned to Your existing account with the plugin provider.

  • We have no exact information about the concrete use of the data nor about the storage period. Please read the privacy policy of the respective providers. We have integrated the plugins of the following providers on Our Site or Our App.

  • Facebook (Facebook Inc., USA, Data protection declaration:

  • Whatsapp WhatsApp Inc. and WhatsApp Ireland Limited (


  1. To minimise the risk of unauthorised access to Your Personal Data, We use some of Your Personal Data to authenticate Your identity when You use the Site or the App to access Our Services.

  2. We have a legitimate interest in sharing Your Personal Data with Service Providers who We engage to provide some of Our business and daily operational functions on Our behalf. Consequently, We need to disclose Your Personal Data to them for the sole purpose of fulfilling Our Services only (including making improvements to Our Services) and not for the purposes of those Service Providers sending Marketing Communications to You. We limit the Personal Data that We share to the minimum required to provide the Services and the Service Provider will only be able to use the Personal Data for the specific purposes for which it was shared with them by Us. We do not need Your express consent for this as We rely on legitimate interests under Article 6(1)(f) GDPR in addition to the fact that the “processing is necessary for the performance of a contract” under Article 6(1)(b) GDPR.

  3. Disclosure of Your Personal Data in Compliance with Laws or by way of a Legal/Statutory Obligation

  • You should be aware that We may release Your Personal Data when We believe it is necessary to comply with laws or regulations, to assist law enforcement, to enforce the terms under which You transact or communicate with Us, or to protect Our rights, property or safety of or those of a Member or other third parties. We may need to process Personal Data about You to comply with a legal or statutory obligation including but not limited to:

    • accounting, auditing, compliance and administration practices; and, 

    • the maintenance of amendments to consents and to create suppression lists to ensure a Member who objects to processing are excluded from the relevant processing activity in the future.

  • Transfer of Your Personal Data (to third party Data Processors)

  1. From time to time, We may transfer Your Personal Data to a related company, agent or contractor (also known as Service Providers and third party Data Processors) in order to perform certain business services for Us, improve Our Services or to assist our security, credit risk or fraud protection activities and as permitted by Data Protection Legislation from time to time.

  1. Name of Service Provider

  • Processing Activity?

  1. Where is the data transferred to? & what level of protection is given to it?

  • Microsoft Azure

  • Site and/ or App Hosting 

  • Your Personal Data is transferred and stored outside of the European Economic Area (the “EEA”) (The EEA consists of all EU member states, plus Norway, Iceland, Liechtenstein.). It is stored in the US and EEA by Our Service Provider called Microsoft Azure on Our behalf. You are deemed to consent to such transfers by becoming a Member. 

  • All Service Providers that are third party Data Processors based in the US participate in and have certified compliance with EU-US Privacy Shield Framework -


  • MailChimp

  • Email Communication

  • We use MailChimp, a US-hosted third party provider] to send out our Marketing Communications who are certified as adhering to the EU-US Privacy Shield. For more information, please see

  • Twillio

  • Email, in-app and SMS Communication

  • PipeDrive

  • Customer Relationship Management

  • We use Pipedrive, a US-hosted third party provider to send out our Sales Communications who are certified as adhering to the EU-US Privacy Shield. For more information, please see

  • Google

  • Data Storage

  • Zendesk

  • Customer Support

  1. Pin Payments

  • Payment Gateway

  1. We use Pin Payments, an Australian-hosted third party payment gateway provider who are subject to the Privacy Act 1988 (Cth). For more information, please see




  • Transfer of Your Personal Data to Service Providers (or partner organisations) who are independent Data Controllers

  1. From time to time, We may transfer Your Personal Data to a related company, agent or contractor (also known as an independent Data Controller) e.g. where We introduce You to a complimentary service.  From time to time, We may transfer Your Personal Data to a related company, agent or contractor (also known as a Joint Data Controller) e.g. where We collaborate on a joint project together.

  2. We maintain a Facebook Page.  In this instance, Facebook is considered to be a Joint Data Controller with Us.


Name of Data Controller? Are they joint or independent?

What Personal Data is transferred/ shared?

  • Purpose of Sharing?

What is the lawful basis for processing i.e. sharing the Personal Data (as applicable from Article 6 and/ or Article 9)?

Facebook (through the use of our page)

Name, contact details and any other personal identifiable details as is placed on Facebook by the Data Subject and made accessible to the Data Controller.

  • So that the Data Subject can be a part of the Facebook Page community. More information can be found on Facebook here.

  • We are relying on your consent set out in Article 6(1)(a) GDPR  

  • Where our customers share their own special category data,  we will be relying on Article 9(2)(e)  GDPR where the data is manifestly made public (We are defining ‘public’ as in the Facebook Audience and this is in accordance with Facebook’s terms and conditions)

  1. Transfer of Personal Data in the Event of the Sale of Claytheapp Ltd or its Assets 

  2. In the event that Clay is sold or transfers some of its assets to another party, Your Personal Data could be one of the transferred assets. If Your Personal Data is transferred, its use will remain subject to this Privacy Statement. Your Personal Data will be passed on to a successor in the event of a liquidation or administration. 

  3. Other Websites or Applications and their Privacy Policies and Cookie Policies 

  4. The Site or the App may contain links to other websites or applications. We are not responsible for the privacy practices or the content of such websites or applications or for the privacy policies, cookie policies and practices of other third parties, so You should be careful to read and understand those policies independently. 


  1. We aim to ensure Our Services are fully inclusive and accessible to everyone. To make this possible, We need to collect (and may provide to prospective Service Providers) information on Your usage of Our Services which will help us review the accessibility of, and Your usage of, Our Services. This information is very important to Us as it also enhances Our understanding of the Member needs and helps Us to help the technical administration of the Site or the App, to better understand how the Site or the App is functioning and to draw conclusions upon demographic information. Such information is provided in anonymised and aggregate form and do not include any individually identifiable data.

  2. RETENTION: How long We keep Your Personal Data depends on the context in which You provide it and the purpose for which We use it. We will only retain it for as long as is necessary for such purposes. Our retention periods are set out in this Privacy Statement in the tables at Clauses 2.1.

  3. TELEPHONE CALLS: We may record calls, both inbound and outbound, as it helps Us to understand the contents of the conversations better especially when they involve work requests/ instructions from You. These recordings may also be used for training and quality control to ensure that We continuously monitor and improve Our Service standards. Sometimes, We need to listen to a call over and over again to save Us contacting You again for the same info! If We record calls, they are recorded and stored via Zendesk. Sometimes We will download it to a computer file. All recordings are deleted from Our computers as soon as We determine that We no longer need it. This may be immediately following the call. Our legal basis for processing Personal Data in this way is supported by Article 6(1)(b) GDPR or where contract does not apply, We rely on Our legitimate interests under Article 6(1)(f) GDPR



For information about cookies and how they are used on the Site, please visit Our Cookie Policy.


  1. You have a number of rights that You can exercise free of charge and on request in certain circumstances, however, if Your requests are obviously unfounded or excessive, We reserve the right to charge a reasonable fee or to refuse to act. You have the right:

  • to be informed about the collection and use of Your personal data;

  • to access Your Personal Data and supplementary information;

  • to have inaccurate Personal Data corrected, or completed (if it is incomplete);

  • to have Your Personal Data erased;

  • to restrict Our processing of Your Personal Data

  • to receive a copy of any Personal Data You have provided to Us, in a machine-readable format, or have this information sent to a third party (portability);

  • to object at any time to processing of Your Personal Data for direct marketing purposes;

  • to object in certain other situations to the continued processing of Your Personal Data.

  1. For more information on these rights and when you can exercise them, see the Information Commissioner’s Guide []

  1. If You wish to exercise any of these rights, please complete Our Data Subject Rights Request Form.  We will respond to You within one month from when We receive Your request, unless the complexity and number of requests We receive means that we need more time. If We do need more time (up to two further months), We will tell You why within the first month.


We try to meet the highest standards when collecting and using Personal Data. For this reason, We take any complaints We receive about this very seriously. We encourage You to bring it to Our attention. We are happy to provide any additional information or explanation needed in respect of Our processing activities upon request. If You are still not happy with the way in which Your Personal Data is being processed by Us, You also have the right to lodge a complaint with the Information Commissioner’s Office if you are in the UK, or with the supervisory authority of the European Member State where You work, normally live or where the alleged infringement of data protection laws occurred. The Information Commissioner’s Office can be contacted here.



Content: the content including all Intellectual Property Rights therein residing on the Site or the App (which may or may not include Personal Data).


Data Controller: means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (Article 4(7));


Data Processor: means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller (Article 4(8));


Data Protection Legislation: means, as applicable to either Party:

  1. the General Data Protection Regulation 27 April 2016;

  2. the Data Protection Act 2018;

  3. the Privacy and Electronic Communications (EC Directive) Regulations 2003;

  4. any other applicable law relating to the Processing, privacy and/or use of Personal Data, as applicable to either Party;

  5. any laws which implement any such laws; and,

  6. any laws that replace, extend, re-enact, consolidate or amend any of the foregoing.


Data Protection Manager (DPM): Leonardo Vano


Data Subject Access Request or ‘DSAR’: refers to right of access as further described in the table at Clause 7.


Electronic Mail: includes but is not limited to email, text, video, voicemail, picture and answerphone messages (including push notifications).


General Data Protection Regulation or GDPR: the General Data Protection Regulation ((EU) 2016/679). Personal data is subject to the legal safeguards specified in the Data Protection Legislation including the GDPR.


Intellectual Property Rights: patents, rights to inventions, copyright and neighbouring and related rights, trademarks and service marks, business names and domain names, rights in get-up and trade dress, goodwill and the right to sue for passing off or unfair competition, rights in designs, database rights, rights to use, and protect the confidentiality of, confidential information (including know-how and trade secrets) and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world.


Marketing Communication(s): refers to any communication whether by an Electronic Mail method or otherwise that We send to You (either directly or via a Service Provider) which may include but are not necessarily limited to relevant newsletters and magazines, information about opportunities, products, services and events and relevant information.


Non-Marketing Communication(s): refers to any communication which is functional/ administrative only as distinct from Marketing Communications.


Personal Data: has the meaning set out in the Data Protection Legislation.


Service Provider(s): refers to third party Data Processors or Data Controllers (as distinct from partner organisations) with whom We work with from time to time as a necessary part of providing Our Services and with whom We may need to share Your Personal Data.


Services: refers to Our Services We may provide to You.


Special Category Data: is defined under Article 9 of the GDPR as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. 


Member: refers to the person using the Site or the App.


We keep Our Privacy Statement under regular review. This Privacy Statement was last updated on 30th Sept 2019. 


Contains public sector information from licensed under the Open Government Licence v3.0 [[]].