Controller: Daralexion Ltd · Last updated: 16 July 2026 · Version 1.0
This map records, for each category of personal data the app processes, the UK GDPR Article 6 lawful basis (and, where relevant, the position on special category data and children). It is an accountability document (UK GDPR Art. 5(2)) and underpins the Privacy Policy and our internal Data Protection Impact Assessment (available on request).
| # | Processing | Data | Data subject | Art. 6 basis | Notes |
|---|---|---|---|---|---|
| 1 | Create & authenticate the parent account | Email, password hash | Parent | 6(1)(b) Contract | Necessary to provide the app to the account holder |
| 2 | Store the parent's display name | Display name | Parent | 6(1)(b) Contract (optional convenience) | Optional; can be empty |
| 3 | Create & manage learner profiles | Nickname, year level, avatar | Child (managed by parent) | 6(1)(b) Contract | Provided by the parent under the parent's agreement to the Terms; minimised |
| 4 | Record practice progress | Mastery, XP, attempts, streak | Child | 6(1)(b) Contract | Core function — showing progress and resuming |
| 5 | Send the weekly progress summary email | Email + aggregate progress | Parent | 6(1)(b) Contract (a service email) with opt-out | Not marketing; strictly informational; parent can turn off |
| 6 | Keep the service secure (access control, abuse prevention) | Account identifiers | Parent/Child | 6(1)(f) Legitimate interests | Assessment on file; low-risk, expected |
| 7 | Fix faulty content you report | Question id, reason, account id | Parent | 6(1)(f) Legitimate interests | Improves safety/quality of a children's service |
| 8 | Handle contact & concern messages | Category + free-text message (adult-authored) | Parent | 6(1)(b)/(f) and, for a safeguarding/complaint, 6(1)(c) legal obligation where engaged | Authored by the adult, not the child |
| 9 | Optional referral feature | Referral code, count, referred-by | Parent | 6(1)(f) Legitimate interests / 6(1)(b) | Optional; referrer-only reward; no friend details harvested |
| 10 | Privacy-preserving product analytics | Random account id + closed event set (no PII, no child data) | Parent (pseudonymous) | 6(1)(f) Legitimate interests | Assessment on file; EU-hosted; no autocapture, no profiling of children |
| 11 | School marketing (Maevious Ltd) | Handled by Maevious Ltd on its website, never in this app | Parent | 6(1)(a) Consent (PECR-compliant, separate, unbundled) | Out of scope for Daralexion Ltd |
Short LIAs are held for items 6, 7, 9 and 10. Each concludes: the interest is legitimate (security / content quality / product improvement / optional growth), the processing is necessary and minimised, and it does not override the interests of parents or children because it involves no child PII, no profiling of children, no tracking SDKs, and EU hosting. Analytics can be operated without a child ever being identified.
Reviewed whenever the data model or analytics event set changes, and at least annually.