PHIL · BEHAVIOUR MENTORING

Privacy policy

Draft v1, last reviewed 8 August 2026

1. Who we are

Phil (“Phil”, “we”, “us”) provides a behaviour-mentoring platform used by UK secondary schools and independent mentors to run structured, evidence-informed mentoring courses with pupils. This policy explains what personal data Phil processes, why, and how it is protected. It applies to establishment admins, mentors, and parents/carers who use Phil, and to the pupils whose records are created within it by mentors and admins on an establishment's behalf.

Contact: [Phil data protection contact name], [email address]. If Phil appoints a formal Data Protection Officer, their contact details will be added here.

2. Controller and processor roles

Data protection law draws a distinction between a data controller (who decides why and how personal data is processed) and a data processor (who processes it on the controller's instructions). Getting this right matters, because it determines who a parent, pupil or regulator should contact first.

For a school or establishment subscribed to Phil, the establishment is the data controller for its pupils' personal data. Phil acts as a data processor, processing that data only on the establishment's instructions, under a data processing agreement (DPA) signed as part of onboarding.

For an individual mentor on the independent plan, the mentor themselves is the data controller for the pupil data they enter, since there is no separate establishment instructing Phil on their behalf. Phil is still the processor of that data on the mentor's behalf.

For account data about mentors, admins and parents/carers themselves (name, email, login activity), Phil is the controller, since this data relates to the use of Phil's own service rather than to a pupil an establishment is responsible for.

3. What data we collect

3.1 Account data

Name, email address, role (admin, mentor, or parent/carer), establishment, and authentication and login activity, for every person who holds a Phil account.

3.2 Pupil data

Pupils do not hold their own Phil account or log in. Pupil data is entered by mentors or admins as part of delivering mentoring, and includes: forename, surname, date of birth, year group, form class (optional), enrolment and course history, session dates, engagement and mood ratings, mentor's session notes, the safeguarding_flag and safeguarding_note fields described in section 6, and certificates issued.

3.3 Parent/carer data

Name, email address, and relationship to the pupil (or pupils) they are linked to, recorded only once an admin or mentor has confirmed the parent/carer is entitled to see that pupil's information.

3.4 Billing data

Establishment billing contact details, payment method type, and invoice records including any purchase order reference supplied. Card payments are handled directly by Stripe, our payment processor, Phil does not store full card numbers.

3.5 Technical and usage data

Login timestamps, device and browser information, and an access log of who viewed or exported a safeguarding-flagged session record, and when, kept so an establishment can audit access to sensitive records if it ever needs to.

4. Our lawful basis for processing

Where Phil is a processor acting on an establishment's instructions, the establishment's own lawful basis applies, typically that processing pupil data is necessary for the school's public task of providing pastoral support and education (UK GDPR Article 6(1)(e)), or its legitimate interests. Because some session content (such as notes touching on a pupil's emotional or mental wellbeing) can be special category data, an establishment should hold an appropriate Article 9 condition too, such as the substantial public interest conditions used for safeguarding and pastoral welfare purposes under the Data Protection Act 2018, Schedule 1, this is the establishment's responsibility to confirm as controller, not Phil's.

Where Phil is itself the controller (account data, and pupil data entered by an individual mentor with no establishment behind them), our lawful basis is performance of the contract with the account holder, and our legitimate interest in operating, securing and improving the service.

5. Safeguarding data, how it's handled

Within Phil, a session record, flagged or not, is visible to the mentor who recorded it and to their establishment's admin, who can look up any pupil's records across the whole establishment at their own initiative. This is a fixed feature of the admin role, not something granted case by case, and it is passive, look-it-up access, Phil does not push, alert, or route a flagged record to the admin, or to anyone else. Whether the same person holds both the Phil admin account and the establishment's own Designated Safeguarding Lead role is a decision the establishment makes for itself. Phil staff can access a specific record only in response to a specific, logged support request from the account holder, for example to help a mentor recover a record they can't find, never as routine monitoring.

6. How we use data

To provide the service: creating and running enrolments and courses, recording sessions, generating certificates and PDFs, and showing progress to mentors, admins and linked parents/carers as described in the roles and permissions section of Phil's technical specification.

To manage subscriptions and billing, including seat usage and invoicing.

To respond to support requests from account holders.

To meet our own legal and regulatory obligations, including responding to lawful requests from an establishment or from a data subject.

To understand overall usage of the product, only in aggregate or anonymised form (for example, how many sessions are recorded per week across all establishments), never by reading individual pupil session content for this purpose.

7. Who we share data with

We do not sell personal data, and we do not share it with advertisers. We share data only with the following categories of recipient, each bound by a data processing agreement or equivalent terms:

Hosting and infrastructure providers, to run the service.

Stripe, to process card payments and invoicing.

An email delivery provider, to send account, invite and billing notifications.

An establishment's own nominated admin and mentors, exactly as described in the roles and permissions model, this is data sharing within the establishment's own organisation, which Phil simply enables.

Phil is not affiliated with the Department for Education or any local authority, and does not share data with either as a matter of course.

8. International transfers

Phil's production data is hosted in the UK/EU. Where any sub-processor involves a transfer of personal data outside the UK or European Economic Area, that transfer is made only under a UK GDPR-recognised safeguard, such as the UK's International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum.

9. How long we keep data

Pupil data is retained in line with the instructions of the establishment that controls it, typically matching the school's own data retention schedule for pastoral records. On request, or when a subscription ends, an establishment's data is exported and then deleted from Phil's systems within the timeframe set out in its data processing agreement. Account data for mentors, admins and parents/carers is retained while the account is active, and for a limited period afterwards to meet legal and accounting obligations.

10. Security

Data is encrypted in transit and at rest.

Access follows the roles and permissions model described in Phil's technical specification, mentors see only their own pupils, admins see roster and billing data but not session content, and so on.

Access to safeguarding-flagged records is logged, so an establishment can audit who viewed or exported one, and when.

Phil staff access to establishment data is limited to specific, logged support requests.

11. Data subject rights

Under UK GDPR, individuals have rights to access, correct, erase, restrict or object to the processing of their personal data, and to receive a copy of it in a portable format. For pupil data, a request should generally be made to the establishment first, since it is the data controller; Phil will assist the establishment in responding to it. For account data Phil controls directly (mentor, admin and parent/carer accounts), requests can be made to Phil using the contact details in section 1.

If you're unhappy with how your data has been handled, you also have the right to complain to the Information Commissioner's Office (ico.org.uk).

12. Children's data

Phil processes personal data about pupils, who are children. Pupils do not create their own account or interact with Phil directly, all pupil data is entered by school staff on the establishment's behalf, as part of its existing pastoral duties. Responsibility for notifying parents/carers and, where required, obtaining consent for this processing sits with the establishment as data controller, in line with its own privacy notices and safeguarding policy.

13. Cookies

Phil uses only the minimal, essential cookies needed to keep an account holder securely signed in. Phil does not use third-party advertising or tracking cookies.

14. Changes to this policy

We may update this policy as Phil's features or sub-processors change. Material changes will be notified to establishment admins in advance.

Phil · structured support, real growth. This document is a working draft for planning purposes and should be reviewed by a qualified solicitor or data protection professional before publication.