Last updated: June 2026
1. Who this notice is for
This notice applies when you access 2mins through your school, college, or other educational institution (an “Educational Institution”) as part of a 2mins programme or pilot. It explains what information is collected about pupils and staff in that context, why, and who is responsible for it.
If you visit the 2mins website or marketing pages, or create a personal account independently of a school, our general Privacy Policy applies instead. Where both notices could apply, this Schools Privacy Notice takes priority for anything relating to your use of 2mins through your Educational Institution.
2. Who is responsible for your personal information
Your Educational Institution is the data controller for the personal information of its pupils and staff that is processed through 2mins. This means your school decides why and how this information is used, and is responsible for telling you (or your parents/carers) about that use, including under its own privacy notices and policies.
2mins Limited acts as a data processor. We process pupil and staff information only on the documented instructions of the Educational Institution, as set out in the Data Processing Agreement (“DPA”) signed between 2mins and the Educational Institution. We do not decide why pupil data is collected or use it for our own independent purposes.
2mins Limited is a company registered in England and Wales (company number 17155742), registered office c/o Cox Costello & Horne, 7 St Johns Road, Harrow, England, HA1 2EY, and is registered with the Information Commissioner’s Office (ICO registration number ZC147056).
If you have a question about how your school uses your information, or want to exercise a data protection right (such as access or erasure), please contact your school in the first instance — see Section 10 below.
3. Information we collect
When you access 2mins through an Educational Institution, we may collect:
- Your first name
- Your school name and school-issued email address
- Your year group or class
- Gameplay activity, progress, and scores within the 2mins platform
- Leaderboard participation and ranking
- Basic technical information needed to operate your account (e.g., login timestamps, device/browser type)
We do not collect images, files, or messages between pupils, and the platform does not offer pupil-to-pupil messaging, public profiles, or any general social networking functionality. Leaderboards visible to other pupils show only a first name and score — never email addresses or other account details.
4. How we use information
Information collected through an Educational Institution is used to:
- Create and operate pupil accounts and deliver core platform functionality
- Run school-specific leaderboards and in-programme features
- Provide participation, engagement, and outcomes reporting to authorised staff at the Educational Institution, for the purpose of administering and evaluating the programme
- Maintain the security and proper functioning of the platform
- Improve and maintain the 2mins platform on behalf of Educational Institutions, using de-identified or aggregated information wherever possible
We do not use pupil data for advertising, profiling for marketing purposes, or any purpose unrelated to delivering the educational programme.
5. Our lawful basis for processing
Educational Institutions are responsible for identifying their own lawful basis for using 2mins with their pupils (commonly public task, for processing necessary to perform a task carried out in the public interest by a state school, or legitimate interests/contractual necessity for independent settings). 2mins relies on its contractual obligations to the Educational Institution under the DPA (UK GDPR Article 28) as the basis for processing data on the school’s behalf.
6. Who we share information with
We share pupil and staff information only:
- With the relevant Educational Institution and its authorised staff, limited to what is reasonably necessary for them to administer and evaluate the programme
- With our sub-processors, who provide infrastructure or services needed to run the platform (see Section 8)
- Where required by law, regulation, or a valid request from a law enforcement or regulatory body (such as the ICO)
We never sell pupil or staff data, and we never share it with third parties for their own marketing purposes.
7. Where and how information is stored and protected
Personal information is stored and processed on secure cloud infrastructure located within the United Kingdom. We apply technical and organisational measures including:
- Encrypted transmission of data (HTTPS)
- Industry-standard password hashing via bcrypt, ensuring original passwords are never held or stored, combined with secure authentication (including one-time email verification codes)
- Restricted, role-based administrative access to user data
- Automated full-server backup procedures managed by DigitalOcean, running weekly (every Sunday between 8:00 PM–12:00 AM UTC) with a rolling 4-week retention window
- Regular review of our security arrangements as the platform develops
8. Sub-processors
We use the following sub-processors to deliver the platform. We will notify the Educational Institution in advance of any material change to this list, in line with the terms of the DPA.
- DigitalOcean (United Kingdom – London): Used for cloud hosting infrastructure and automated full-server backups.
- OneSignal (European Union (primary) / United States): Used for push and in-app notification routing. OneSignal receives device tokens only and does not receive pupil names, email addresses, or other directly identifiable personal information.
- Sentry (European Union – Germany): Used only for error monitoring, crash reporting, and diagnostics to help identify and resolve technical issues. Sentry may process limited technical information, including IP addresses, as part of this service. Pupil usernames and email addresses are not transmitted to Sentry. Sentry is hosted within the European Union and operates in accordance with applicable data protection requirements.
- MailerSend (European Union – Lithuania): Used for transactional email delivery, including one-time verification codes and password reset emails. MailerSend receives recipient email addresses solely for the purpose of delivering these account-related communications. Data processing remains within the European Union.
- Firebase (Google): Used for push notification delivery, core user sign-in functionality, and app invites. Firebase Analytics and advertising services are not enabled within the platform. Firebase and Google services are used solely to support core application functionality, user authentication, and app invites.
We do not use third-party advertising networks or behavioural analytics platforms. Platform usage and engagement reporting is managed internally. Usage and engagement data is monitored within our own content management system, hosted on the same UK-based infrastructure described in Section 7, rather than being passed to an external analytics tool.
International Transfers
Where a sub-processor processes information outside the UK or EEA, we ensure appropriate safeguards are in place in accordance with applicable data protection laws. These safeguards may include Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum where required.
OneSignal receives only pseudonymised technical identifiers (such as device tokens) and does not receive pupil names or email addresses.
9. How long we keep information
2mins operates as an ongoing programme rather than a fixed-term campaign. To ensure we adhere strictly to the UK GDPR principle of data minimisation and do not retain personal information longer than necessary, we apply the following retention parameters:
- We retain pupil and staff information for as long as the Educational Institution and its pupils continue to actively participate in the programme.
- Where an Educational Institution or an individual pupil’s account is deleted at the Educational Institution’s request, we will delete the associated personal data within 30 days of receiving and verifying that request.
- If an Educational Institution’s account becomes inactive (meaning no pupil or staff logins are recorded) for a continuous period of 12 months, and no alternative retention structure has been agreed upon, 2mins will automatically delete or securely anonymise all personal data associated with that institution after providing 30 days’ written notice to the registered school contact.
- Educational Institutions running a time-limited pilot are encouraged to confirm with us in advance whether they want deletion instructions to apply automatically at the conclusion of the pilot.
10. Your rights
Because your Educational Institution is the data controller, requests to access, correct, delete, or restrict the use of pupil or staff personal data should be made to the Educational Institution, who will work with us as needed to fulfil the request within the timeframes required by law.
If you contact 2mins directly with such a request, we will pass it to the relevant Educational Institution and provide reasonable assistance to them in responding, in line with our obligations under the DPA.
11. Children’s privacy
2mins is designed for use by pupils through their Educational Institution. We rely on the Educational Institution to manage any consents, notices, or parental communications required by its own policies and applicable law before pupils use the platform. We only collect the personal information reasonably necessary to provide and administer the educational service, and we do not knowingly use pupil data for any purpose beyond that.
12. Changes to this notice
We may update this notice from time to time, for example to reflect changes to the platform or our sub-processors. We will notify the Educational Institution of any material change in advance.
13. Contact us
For questions about this notice or how 2mins processes information as a data processor, contact:
- Email: info@2mins.app
For questions about how your Educational Institution uses your personal information, or to exercise a data protection right, please contact your school, college, or institution directly.