Privacy Policy

Last updated: 16 May 2026

This Privacy Policy explains how Primary Maths Craft collects, uses, stores and protects personal data. Primary Maths Craft is a trading name of Marvel Education Ltd.

1. Who we are

Primary Maths Craft is a trading name of Marvel Education Ltd, a company registered in England and Wales under company number 10737135. Our registered office is 50 Brabazon Road, Oadby, Leicester, England, LE2 5HD.

For most website, account, purchase, mailing list and free-tool activity, Marvel Education Ltd is the data controller. For some school-controlled InterventionPack outputs, the school may be the data controller and Primary Maths Craft may act as a processor, support provider or system operator depending on the setup.

You can contact us at: system@primarymathscraft.co.uk.

2. What this Privacy Policy covers

This Privacy Policy covers personal data connected with:

• the Primary Maths Craft website;
• blog updates and email mailing lists;
• WooCommerce purchases and paid product access;
• InterventionPack diagnostic and intervention tools;
• ArithmeticPack free arithmetic slide generation;
• contact forms, support requests and customer communication;
• Google Drive, Google Sheets, Google Slides and Google Apps Script outputs used by our tools.

3. Personal data we collect

Website, account and support information

• name;
• email address;
• school or organisation name;
• account username;
• support messages and enquiries;
• product access or licence information;
• technical logs linked to form submissions or website use.

Payment and purchase information

• billing name;
• billing email address;
• billing address, where required;
• product purchased;
• payment status;
• order number;
• licence or renewal status;
• checkout consent records, where applicable.

We do not directly store full payment card details. Payment information is handled by the relevant payment provider.

InterventionPack onboarding and configuration information

• admin user name;
• admin user email address;
• school name;
• class names;
• licence or product selected;
• unique school or licence ID;
• links to school-shared Google Drive folders or files;
• configuration details needed to connect the tool to school-owned outputs;
• support/admin notes needed to operate or troubleshoot the tool.

InterventionPack diagnostic and pupil-related output data

Depending on how a school uses InterventionPack, diagnostic submissions and outputs may include pupil-related information such as:

• pupil name or identifier;
• class name;
• diagnostic answers;
• misconception outcomes;
• phase placement;
• intervention status;
• generated pupil report links;
• class summary and school overview outputs.

InterventionPack is designed so that substantive school outputs can be written into the school’s own Google Drive files and folders where possible, rather than being retained as a separate Primary Maths Craft central pupil database.

ArithmeticPack free generator information

• email address submitted for delivery;
• selected year group;
• selected half-term;
• number of weeks requested;
• optional uploaded school logo;
• generated Google Drive folder or slide deck links;
• timestamp of generation;
• disclaimer and terms acceptance;
• blog update consent, where given.

ArithmeticPack should not be used to submit pupil names, pupil data or sensitive personal information.

Mailing list and blog updates

• email address;
• name, if provided;
• consent status;
• signup date and time;
• Mailchimp tags or audience data;
• email engagement information such as opens or clicks, depending on the mailing platform.

Technical data

• IP address;
• browser type;
• device information;
• pages visited;
• form submission logs;
• security logs;
• cookie or analytics data, depending on your cookie settings.

4. How we use personal data and our lawful bases

We only use personal data where we have a lawful basis to do so. The main lawful bases we rely on are contract, consent, legitimate interests and legal obligation.

Purpose	Data used	Lawful basis
Providing paid products, licences and support	Name, email, school, order details, licence details, support messages	Contract and legitimate interests
Processing payments and keeping accounting records	Billing details, order records, payment status	Contract and legal obligation
Setting up and operating InterventionPack	Admin contact, school name, class names, licence ID, Drive links, configuration data	Contract and legitimate interests
Writing diagnostic outputs to school-owned Google Drive files	Diagnostic answers, pupil identifiers, class names, report and summary outputs	School-determined lawful basis; contract/processor activity where applicable
Generating ArithmeticPack slide decks	Email, year group, half-term, weeks requested, optional logo, generation logs	Contract or legitimate interests
Sending generated resource links and service emails	Email address, generated folder or deck links	Contract and legitimate interests
Sending blog updates and Primary Maths Craft email updates	Email address, name if provided, consent record, email engagement data	Consent, or soft opt-in where legally applicable
Maintaining website security and preventing misuse	IP address, logs, form submissions, technical data	Legitimate interests
Complying with legal, tax and accounting duties	Order records, invoices, payment records, business records	Legal obligation

5. InterventionPack: school data and processing

InterventionPack is designed to minimise the personal data retained directly by Primary Maths Craft. Where schools use InterventionPack, school-owned Google Drive folders, spreadsheets and slide reports may be used to store pupil reports, class summaries and school overview outputs.

The school is responsible for deciding what pupil data is entered into the tool and for ensuring it has an appropriate lawful basis for processing that data. Schools should ensure that their own privacy notices, internal procedures and Google Drive sharing permissions are appropriate.

Primary Maths Craft may process limited data to operate the tool, including school name, admin email, class names, licence ID, diagnostic configuration, submitted diagnostic answers, generated report links and links to the school-shared Google Drive folder or files.

Primary Maths Craft does not use pupil diagnostic data for marketing. Schools should remove sharing access when they stop using the service or no longer require support.

6. ArithmeticPack: free slide generation

ArithmeticPack uses the information submitted through the generator form to create and email arithmetic slide decks. This may include your email address, selected year group, selected half-term, number of weeks requested and optional school logo.

The optional school logo is used only to personalise the generated slide deck. By uploading a logo, you confirm that you have permission to use it for this purpose.

Generated ArithmeticPack slide links remain available for approximately 6 months. Users should make their own copies if they wish to keep or edit slides permanently. After the availability period, generated folders may be deleted or made inaccessible.

ArithmeticPack should not be used to upload or submit pupil names, pupil data or sensitive personal information.

7. Email marketing and blog updates

If you choose to receive Primary Maths Craft blog updates, we may send occasional emails about blog posts, pedagogical discussion, resources, product updates and Primary Maths Craft news.

Blog and marketing consent is optional and separate from tool use. You can use ArithmeticPack or purchase products without joining the mailing list.

You can unsubscribe at any time using the unsubscribe link in our emails. We use Mailchimp to manage mailing lists and email updates.

8. Cookies and analytics

Our website may use cookies for essential functionality, checkout, account access, security, analytics, email sign-up forms and embedded content. More information is available in our Cookie Policy.

Non-essential cookies, such as analytics or marketing cookies, should only be used where consent has been given through the website’s cookie banner or settings tool.

9. Who we share personal data with

We may share data with service providers that help us operate the website, products and tools. These may include:

• website hosting providers;
• WordPress and WooCommerce services;
• payment processors;
• Google Workspace, Google Drive, Google Sheets, Google Slides and Google Apps Script;
• Mailchimp or email marketing providers;
• analytics, cookie consent, security or spam-prevention tools;
• professional advisers, where necessary;
• legal or regulatory authorities, where required.

We do not sell personal data.

10. International transfers

Some service providers may process data outside the UK. Where this happens, we rely on appropriate safeguards where required, such as provider terms, adequacy decisions, standard contractual clauses or equivalent mechanisms.

11. How long we keep personal data

• Order and payment records: up to 6 years for accounting and tax purposes.
• Mailing list records: until you unsubscribe or ask us to remove you, subject to suppression records needed to respect opt-outs.
• Support emails: up to 3 years, unless needed longer for legal, technical or dispute-resolution reasons.
• ArithmeticPack generated slide decks: approximately 6 months.
• ArithmeticPack generation logs: up to 2 years, unless needed longer for security, audit or legal reasons.
• Uploaded school logos for ArithmeticPack: deleted or made inaccessible when generated resources are cleaned up, unless retained in generation logs or stored separately by the user.
• InterventionPack licence and admin records: for the licence period and a reasonable period afterwards for support, renewal, accounting and audit.
• School-owned Google Drive outputs: controlled by the school’s own Google Drive retention and sharing settings.

Where we cannot specify an exact period, we use criteria such as the purpose of collection, legal requirements, product lifecycle, support needs, security needs and whether the data is needed to resolve disputes.

12. Security

We take reasonable steps to protect personal data, including limiting access, using secure third-party platforms, keeping administrative access controlled, and using logs or permissions to support troubleshooting and security.

No online system can be guaranteed completely secure. Users and schools are responsible for managing their own account credentials, device security and Google Drive sharing permissions.

13. Your rights

Depending on the situation, you may have rights to:

• access your personal data;
• correct inaccurate personal data;
• request erasure;
• restrict processing;
• object to processing;
• data portability;
• withdraw consent where processing is based on consent;
• complain to the Information Commissioner’s Office.

To exercise your rights, contact: system@primarymathscraft.co.uk.

You also have the right to complain to the Information Commissioner’s Office.

14. Children’s data

ArithmeticPack should not be used to submit pupil data. InterventionPack may involve pupil-related diagnostic information where a school chooses to use it. In those cases, the school is responsible for deciding what information is entered and ensuring that the use of pupil data is appropriate and lawful.

Primary Maths Craft does not use pupil diagnostic data for marketing.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will be published on this page.

Contact

Primary Maths Craft
A trading name of Marvel Education Ltd
Email: system@primarymathscraft.co.uk
Website: primarymathscraft.co.uk
Company number: 10737135
Registered address: 50 Brabazon Road, Oadby, Leicester, England, LE2 5HD