Privacy and data protection

Global Privacy Notice

Last updated: 17 September 2025

Introduction

This Privacy Notice (“notice”) explains how we manage and protect your personal data (referred to as “data”) when you visit our website (“Visitor”) or use our services either as a representative of a School to which we provide services (“School User”) or a student or parent of a School which uses our services (a “Service User”). If you are a Service User, for the majority of personal data we process about you, we are a processor and therefore act on behalf of your School and as directed by them. We recommend that you review your School’s privacy notice to understand how your School manages your personal data.

This notice tells you who we are, what data about you we collect in connection with our website and services, and what we do with it.

Who we are

Pamoja Education Ltd (“PMJ”, “we, “us”) delivers International Baccalaureate (“IB”) online courses to Schools and Students worldwide. For more information about PMJ please visit our website https://pamojaeducation.com, which sets out our services (“Services”).

For most of the personal data that we process about Service Users, we act as a data processor on behalf of their School, which is the data controller. We act as a data controller in relation to the personal data of the School Users and our Visitors.

We have appointed a Data Protection Officer (“DPO”), SchoolPro TLC, who oversees our compliance with applicable UK and international data protection laws and the EU-U.S Data Privacy Framework (“DPF”) Principles.

We also have an internal Data Compliance Officer (“DCO”) who is responsible for the day-to-day management of data protection activities across PJE and for supporting staff in understanding and meeting their data protection responsibilities.

You can find their contact details in the section How to make a request.

What personal data we collect

We use several types of data about you for purposes connected with the management of our website or the delivery of our Services.

Visitor

When you use our website, you may provide us with personal data so that we can deliver the services or information you request. For example:

  • If you request a course demo, sign up for a newsletter, or register for a webinar, we may collect your name, role, school name, and contact details.
  • If you contact our support team, we will collect the information you provide to respond to your enquiry.

We will only use this information for the purposes you request, or as otherwise permitted under applicable data protection laws.

We may also collect and process the following information about you in order to provide you with our website and services:

  • Information you provide directly: If you register for a demonstration, trial account, blog or webinar, we may collect your name, email address, phone number, school name, details of the curriculum your school offers, and any other information you choose to provide. Lawful basis: performance of a contract or steps taken at your request prior to entering into a contract.
  • Marketing communications: We may process your name and email address to send you newsletters, product updates, or other marketing materials. We will only send you such messages where permitted under applicable law and in line with your marketing preferences, which you can update at any time. Lawful basis: consent (and legitimate interests where permitted by law, such as for existing customers).
  • Website analytics and cookies: We use cookies to collect information about your use of our website and details of your device, internet connection, browser, location, pages viewed, and search terms used. For more information about cookies and how to manage your preferences, please see our Cookies Policy. Lawful basis: consent (for non-essential cookies) and legitimate interests (for essential cookies and analytics needed to maintain site security and functionality).
  • Job applications: If you apply for a job with us, we will collect and process the personal data you provide in your CV and cover letter for recruitment purposes. Lawful basis: performance of a contract or steps taken at your request prior to entering into a contract, and compliance with legal obligations.

School User

We may collect and process the following information in order to provide your School with our Services:

  • Account and contact details: your name, title, business telephone number, details about the School you represent, details about your position at the School (e.g subjects you teach or how long you have worked at the School) and email address used during our registration process in order to communicate with you in relation to the provision of Services to your School. Lawful basis: performance of a contract (or steps taken at your request prior to entering into a contract) and legitimate interests.
  • Surveys and feedback: responses to our surveys you choose to take. Lawful basis: legitimate interest.
  • Marketing communications: your email address to send email marketing to you, including our newsletters and updates as permitted under applicable law and in line with your preferences. You can opt out at any time. Lawful basis: consent (and legitimate interests, where permitted by law, such as for existing customers).
  • Customer support interactions: details of your interactions with us when you contact us with enquiries through our online customer support or via telephone or email. Lawful basis: legitimate interests (to provide support and resolve issues) and performance of a contract.

Service User

When you use our Services as a student or parent, most of the personal data we process about you is provided by your School, which is the data controller. We act as a data processor on their behalf and only as instructed by them. Where required by law, the School is responsible for obtaining parental consent before sharing children’s data with us.

We may collect and process the following personal data about you:

  • Student account information: information captured in your student account, provided by you or your parents or your School including information such as your name, email address, nationality, date and place of birth, gender, language, national ID, and parents’ names and contact details. We may use this data (in aggregated and anonymised form where possible) to conduct statistical analyses for our internal reporting and service improvement. Lawful basis: legitimate interests (for our reporting) and performance of a contract (on behalf of your School as controller.
  • Surveys and feedback: your email address may be used in order to invite you to complete surveys or provide feedback about our services, educational plans, or new product developments, and to collect your responses. Lawful basis: consent (and legitimate interests, where permitted by law, such as for existing users).
  • Customer support interactions: details of your interactions with us when you contact us with enquiries through our customer support system online or via telephone or email. Lawful basis: legitimate interests (to provide support and resolve issues) and performance of a contract (on behalf of your School).

How and why we use your personal data

We use personal data for the following purposes, relying on the lawful bases set out in the UK GDPR:

  • Performance of a contract (Article 6(b)): to deliver our Services, process applications, and manage payments.
  • Legitimate interests (Article 6(f)): to understand how our Services are used, improve and develop our courses and website, maintain system logs for operation and maintenance, and ensure system security.
  • Consent (Article 6(a)): to send marketing communications (where you have opted in) and to collect survey responses.
  • Legal obligation (Article 6(c)): to maintain records required by law and comply with regulatory requirements.

The table below explains the purposes for which we use personal data and the lawful bases on which we rely to do so, as required by the UK GDPR and EU GDPR:

Visitors

Purpose Legal basis for processing
Management of our website
e.g site maintenance and analytics of website usage (which will include the sharing of data with Google Analytics)		 It is our legitimate business interest to manage and develop our website.
Fulfilment of online services
e.g registering for a demonstration, webinar, blog or trial account		 We process your data in order to provide you with the online service which you have requested. Our processing is based on your consent.
Marketing
e.g to send you marketing emails relating to product updates and other services we think you may be interested in		 We rely either on your consent or on our legitimate business interest to send email marketing to you depending on how we collected your personal data and the nature of our relationship. Any email marketing will only be sent to you as permitted by applicable law and in accordance with your preferences which you can update at any time as described below.
Legal & regulatory compliance and compliance with law enforcement requests In some instances, we will be required by law to process your personal data and share it with law enforcement or other government or regulatory bodies. We may also choose to do so in other circumstances, in accordance with our legal obligations or, where appropriate, our legitimate interests.
Processing a job application
e.g if you apply for a job or position via our website		 If you decide to apply for a role with us, we will process your personal data on the basis of our legitimate interests in order to ascertain your suitability for the role.

 

School Users

Purpose Legal basis for processing
Customer support activities
e.g interacting with you via our online customer support or by phone or email		 It is our legitimate business interest to provide customer support to School Users in order to provide the Services to Schools.
Provision and management of Services to Schools
e.g managing requests, curriculum standards, managing user accounts, submitting a Purchase Order, handling invoices, etc.		 It is our legitimate business interest to provide and manage the Services we provide to Schools.
Marketing
e.g to send you marketing emails relating to product updates other services we think you may be interested in		 We rely either on your consent or on our legitimate business interest to send email marketing to you depending on how we collected your personal data and the nature of our relationship. Any email marketing will only be sent to you as permitted by applicable law and in accordance with your preferences which you can update at any time as described below.
Sharing data with other third parties
Please see Who we share personal data with below		 It is our legitimate business interest to share data with third parties to assist with the purposes described below.
Legal and regulatory compliance and compliance with law enforcement requests  In some instances, we will be required by law to process your personal data and share it with law enforcement or other government or regulatory bodies. We may also choose to do so in other circumstances, in accordance with our legal obligations or, where appropriate, our legitimate interests.

 

Service Users

Purpose Legal basis for processing
Conducting statistical analyses for reporting
e.g to conduct data analyses that enable us to improve and develop our Services		 It is our legitimate business interest to improve our Services through the use of statistical analyses and reporting.
Customer support activities
e.g interacting with you via our online customer support or by phone or email		 It is our legitimate business interest to provide customer support to Service Users.
Feedback and surveys
e.g to request survey responses or feedback from you in relation to future product developments and educational plans		 It is our legitimate business interest to gather feedback and survey results to improve user experience and develop improved services. We store this data in anonymised form.
Sharing data with other third parties
Please see Who we share data with below		 It is our legitimate business interest to share data with third parties to assist with the purposes described below
Legal & regulatory compliance and compliance with law enforcement requests In some instances, we will be required by law to process your personal data and share it with law enforcement or other government or regulatory bodies. We may also choose to do so in other circumstances, in accordance with our legal obligations or, where appropriate, our legitimate interests.

 

Please note that we do not process any special category data about Service Users (eg information on race or ethnicity) for our own purposes. You may be requested by your School to provide such information which may be passed to us for processing but we do not use it for any other purpose.

In some instances, we may use personal data about you in ways that are not described above. Where this is the case, we will provide a supplemental privacy notice that explains such use and, where required by law, seek your consent. You should read any supplemental notice in conjunction with this Notice.

Data you provide and how we collect it

You may provide personal data directly to us when you use our website or services. This may include:

  • Contact details (such as your name, email address, phone number, and school name) when you request a course demo, sign up for a trial account, subscribe to newsletters, register for a webinar, or contact our support team.
  • Account details (if you register as a School User, including your title, role, or subject taught).
  • Payment and billing information (when you purchase services through the website).
  • Application details (if you apply for a job with us, such as your CV, cover letter, and references).

We only use this information to deliver the Services you request, communicate with you, or as otherwise permitted by data protection law. Where consent is required (for example, for marketing emails), you may withdraw it at any time.

Use of AI-assisted Tools

We may use AI-assisted tools to support our internal operations, such as analytics (legitimate interests) and customer support (contractual necessity). These tools are designed to improve efficiency and accuracy but are not used to make decisions about individuals without human oversight. We do not use AI-assisted tools for profiling or for making automated decisions that could have significant consequences for you, such as affecting your legal rights or access to education. Personal data is only used in ways consistent with this Privacy Notice, and we ensure appropriate safeguards are in place when using AI-assisted technologies.

Cookies

We use cookies and similar technologies to understand how visitors use our website, to improve performance, and to support certain functionality. For more details about the cookies we use, the purposes they serve, and how you can manage your preferences, please see our Cookies Policy.

Who we share personal data with

We share data across the Faria Education Group (our parent group, with offices in the UK, US, Canada, Hong Kong, China and Taiwan) to deliver our Services, provide customer support, manage billing, and operate our systems. Data may be accessed or processed by our teams in these locations and is hosted on secure cloud servers in Ireland and the United States (or locally in China for users based there). When we transfer personal data outside the United Kingdom or European Economic Area, we use appropriate safeguards such as Standard Contractual Clauses, or International Data Transfer Agreement, or rely on our participation in the EU-US Data Privacy Framework.

We share data across Faria Education Group for various purposes such as:

  • Customer support activities (eg our online support or contacting us via our email or telephone) may be undertaken by our offices in China, Taiwan, UK, Canada or the US depending on your School’s location and the time of the day of your enquiry.
  • Management of our Services (eg bulk process requests, importing curriculum standards, importing users) may be processed in the US, UK, China, Taiwan, India or Ukraine.
  • Billing enquiries (eg submitting a purchase order, handling invoices, etc.) will be processed by our offices in the UK, Hong Kong and Taiwan.
  • System usage and platform hosting is provided from our offices in the UK and cloud-based in Ireland or the US (unless you are based in China in which case it will be done in the country in which you are based).

How we share your data

  • If you are a Service User, we will share data with education partners such as exam awarding bodies for exam registration, moderation and coursework submission or integration partners, such as other school systems providers, only as instructed by your School in its role as data controller.
  • We may share data with trusted partners, such as IT providers or customer support services, to provide services such as:
    • Customer Relationship Management (CRM): Contact information is stored in OpenApply.
    • Payments: Payment processors such as Stripe and PayPal receive limited information required for processing.
    • Marketing and Analytics: We use services such as Google Ads, LinkedIn Insight Tag, Hotjar, and Meta Custom Audiences to improve website functionality and deliver relevant marketing. Data collected may include hashed email addresses, site interactions, or anonymised technical data. Please contact us to opt out
  • A list of our Sub-Processors can be found here
  • We may share anonymised data, feedback and survey results with third-party service providers, such as other school systems for research purposes.
  • We may share data about you with other third parties, where required or permitted by law, for example: regulatory authorities; government departments; in response to a request from law enforcement authorities or other government officials;
  • We may share data when we consider disclosure to be necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal purpose; and
  • We may share data in the context of organisational restructuring

If you would like to learn more about the parties with which we share data, please contact us using the details below in How to make a request.

International data transfers

As with any multinational organisation, and as a result of the global nature of our Services, we are often required to transfer data internationally as described in this Notice. This includes transfers within our corporate group (Faria Education Group) and to third-party service providers located outside the United Kingdom and the European Economic Area (“EEA”).

Whenever we transfer personal data internationally, we ensure that appropriate safeguards are in place in accordance with the requirements of the UK GDPR and EU GDPR. Depending on the destination country, these safeguards may include:

  • Relying on adequacy decisions issued by the European Commission or the UK Government, which recognise certain countries as providing an adequate level of data protection;
  • Using the Standard Contractual Clauses (“SCCs”) approved by the European Commission, together with the International Data Transfer Agreement (“IDTA”) or UK Addendum where required;
  • Relying on our participation in the EU-US Data Privacy Framework for transfers of personal data to the United States; or
  • Implementing intra-group data transfer agreements that impose equivalent data protection obligations across all entities within Faria Education Group.

PMJ is established in the United Kingdom and is registered with the Information Commissioner’s Office (“ICO”). If you would like more information about the safeguards we use for international transfers, please contact us using the details provided in How to make a request.

Data retention

We retain personal data only for as long as necessary to:

  • Fulfil the purpose for which it was collected
  • Comply with legal and regulatory obligations
  • Maintain adequate business and academic records
  • Address any future legal or operational requirements

Different categories of personal data may be kept for different periods in accordance with our internal data retention policy. When data is no longer required, it will be securely deleted or anonymised in accordance with our data retention policy. Please contact us if you would like further information about the applicable retention periods.

Your rights over your data

Depending on where you are resident, you may have some or all of the following rights under applicable law in respect of data about you which we hold:

  • Right of access: to request access to your personal data and have us provide you with a copy of any data we hold about you
  • Right to rectification: to request us to rectify or update any in accurate or incomplete data
  • Right to erasure: to request us to erase your personal data in certain circumstances
  • Right to restriction: to request us to restrict the use of your personal data in certain circumstances
  • Right to object: to object to our processing of your personal data in certain circumstances
  • Right to withdraw consent: where we process your data based on consent, you may withdraw that consent at any time
  • Right to data portability: to request that we transfer your personal data to you or to another organisation in certain circumstances
  • Right to opt out of marketing: you can opt out of receiving our marketing emails at any time by clicking the “unsubscribe” link in those emails or by contacting us using the details below
  • Right to lodge a complaint: to complain to the supervisory authority in your country (if there is one).

You can exercise these rights, or learn more about them, by contacting us using the details set out below in How to make a request.

We may be required to confirm your identity before fulfilling your request, which may involve asking you to provide identification documents.

How to make a request

We take your privacy seriously and will respond to all questions and requests about your personal data as promptly as possible. If you have any questions about how we handle your personal data, or if you wish to exercise any of your data protection rights, please contact:

Data Compliance Officer (internal contact):
Email: data.protection@pamojaeducation.com

Data Protection Officer (external contact):
Ben Craig, SchoolPro TLC, Unit 1b Aerotech Business Park, Bamfurlong Lane, Cheltenham, GL51 6TU, United Kingdom
Tel: 01452 947633
Email: dpo@schoolpro.uk

Supervisory authority (United Kingdom):
Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
Helpline: 0303 123 1113 (Mon-Fri, 9am-5pm)
Website: https://ico.org.uk

If your country has its own data protection supervisory authority, you have the right to contact it with any questions or concerns. If you are based in the UK, this is the ICO.

Changes to this notice

We may update this notice (and any supplemental privacy notices and addenda), from time to time to reflect changes in our practices, legal requirements, and other factors. Where required by law, we will notify you of any material changes. We encourage you to review this notice periodically to stay informed about how we protect your personal data.