Privacy Policy

Last updated: 1st July 2026

Welcome to ScenarioSpace’s Privacy Policy.

This policy explains how we handle personal data when you use ScenarioSpace (“the Platform”).

Who we are

ScenarioSpace is operated by Proxima Education Ltd (“we”, “us”, “our”), a company registered in England and Wales at Churchdown Chambers, Bordyke, Tonbridge, Kent TN9 1NR.

We are the controller of the personal data described in this policy, except where otherwise stated.

If you have any questions about this privacy policy, you can contact us at privacy@scenariospace.org.

What information we collect and why

Data we collect when you access our website

When you access our website, we collect your IP address, device and browser information for the following purposes:

  • To keep the platform secure. (Lawful basis: legitimate interests.)

    We use this information to keep the platform secure from malicious attacks, e.g. via rate-limiting and DDoS protection.

  • To improve the platform. (Lawful basis: legitimate interests.)

    We use your data in a pseudoanonymised, anonymised and aggregated form to help us understand how the platform is being used so that we can improve it.

Data we collect when you register an account on the platform

When you register an account on ScenarioSpace, you provide us with the following personal information: your name, email address and any organisation details you choose to provide, e.g., your school’s name and setting. We use this information for the following purposes:

  • To create and administer your account. (Lawful basis: legitimate interests.)

    In order to run training sessions on the platform, a ScenarioSpace account is required. This allows you to keep a history of the sessions you have run and to view your session reports.

    We use your email address to enable you to log in to your account. For security reasons, we operate a password-less login system, which requires sending you a one-time passcode via email.

  • To communicate with you. (Lawful basis: legitimate interests and consent.)

    We use your name and email address to respond to any queries you raise in relation to your account, and to communicate essential information about the platform and your account. If you opt-in to receive marketing emails, we may also send you emails about platform-related updates from time to time.

  • To improve the platform. (Lawful basis: legitimate interests.)

    We may use your organisation details in an aggregated form to understand how we might better support users in certain types of organisations (e.g. primary schools vs secondary schools).

Data we collect when you create and run a training session

When you create and run a training session on ScenarioSpace, we collect usage data including which training sessions you have created, when you created them and how many participants joined your sessions. We use this data for the following purposes:

  • To enable you to use the platform. (Lawful basis: legitimate interests.)

    We store information about the training sessions you create and run in order to present this information back to you so that you can access your training sessions over time.

  • To improve the platform. (Lawful basis: legitimate interests.)

    We use information about the training sessions you create and run in order to inform platform improvements, such as which future training sessions to offer on the platform.

Data we collect when you participate in a training session

When you participate in a training session on ScenarioSpace, you will have the opportunity to submit responses to interactive scenarios and other activities.

We do not ask participants to register accounts or provide identifying information, and the platform is designed so that responses are not associated with a participant's identity. Participants must not submit personal data during training sessions under our Terms of Service. However, some activities allow free-text responses and therefore, despite this restriction, participants may inadvertently include personal data in their responses. If this occurs, we process that personal data in accordance with this Privacy Policy.

Responses you submit as part of a training session are used for the following purposes:

  • To enable the delivery of your training session (Lawful basis: legitimate interests.)

    The responses you submit during a training session form an integral part of the session, as the session’s content adapts based on participants’ responses. We use your responses to enable participants to engage in peer review activities, to display aggregate session data to participants, and to enable the session’s facilitator to adapt the session based on how participants are responding.

  • To improve the platform. (Lawful basis: legitimate interests.)

    We may use your responses to quality-assure the content of training sessions on the platform, to make sure that training session content is clear and relevant to participants. We may also use this data to inform decisions about the content of future training sessions to offer on the platform.

Data we collect when you send us a message

When you send us an email or other message via the platform, we collect your name, email address, and any other personal information that you choose to include in your message. We use this information for the following purposes:

  • To communicate with you. (Lawful basis: legitimate interests.)

    We use your name, email address and the contents of your messages to respond to any messages you send us.

A note about cookies

We do not use any advertising or analytics cookies, and we do not use cookies to track you across other websites.

We use only essential, first-party cookies that are necessary to enable you to use the platform. These cookies allow you to sign in to your account securely, stay logged in across sessions, and join and participate in training sessions.

Since these cookies are strictly necessary for the platform to work, we don't need to display a cookie banner on our website.

Who we share data with

We use trusted service providers to help us deliver and manage the ScenarioSpace platform. These service providers process data on our behalf as our processors and are prohibited from using personal data for any purpose other than the delivery of their services to us. They provide services including web hosting, database hosting, data storage, email services, privacy-focused analytics, application performance management, error tracking, log management and content delivery services.

We share responses submitted by participants during training sessions with the following parties:

  • Session facilitators. The person running a training session can see the responses submitted in it, both during and after the session has ended.
  • Other participants. During a training session, responses submitted by participants may be shared with other participants taking part in the same session.
  • Content partners. Where training session content has been created by or in partnership with a third-party content partner, responses submitted in training sessions using that content will be shared with that partner.

In addition, we may also disclose your personal information to third parties in the following circumstances:

  • We may disclose data to third parties, the court service and/or regulators or law enforcement agencies where required by law, or to establish, exercise, or defend legal claims.
  • If ScenarioSpace or substantially all of its assets are acquired by a third party, personal information about you may be one of the transferred assets. As part of the process, your personal data may be disclosed to our professional advisers as well as prospective purchasers and their advisers.

We may also share aggregated and anonymised data with third parties. Although aggregated data may be derived from your personal data, it is not considered personal data in law as it will not directly or indirectly reveal your identity.

International transfers

Your data is stored in data centres located within the UK and European Economic Area (EEA). In certain limited circumstances your personal information may be accessed by staff, stored with or transferred by our suppliers in, a destination outside the UK or the EEA. If your personal data is transferred out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data as determined under English law (“Approved Jurisdictions”).
  • Where we use service providers or overseas business partners outside of the UK or an Approved Jurisdiction, we will use specific contracts which give personal data the same protection it has in the UK.

How long we keep information

We keep personal information only as long as necessary for the purposes described above or to meet legal requirements. Information that is no longer needed is either irreversibly anonymised (and the anonymised information may be retained indefinitely) or securely destroyed.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the personal risk or harm from unauthorised use or disclosure, the purpose for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your rights

Under UK law, you have various rights in relation to personal data about you that we process:

  • Your right of access. You have the right to ask us for copies of your personal information.
  • Your right to rectification. You have the right to ask us to correct information you think is inaccurate.
  • Your right to erasure. You have the right to ask us to delete your personal information.
  • Your right to restriction of processing. You have the right to ask us to limit how we can use your personal information.
  • Your right to object to processing. You have the right to object to the processing of your personal data.
  • Your right to data portability. You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
  • Your right to withdraw consent. When we use consent as our lawful basis you have the right to withdraw your consent at any time.

To exercise a right, please contact us at privacy@scenariospace.org. If you make a request, we will respond to you within one month.

You also have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we process your personal data.