Privacy Policy

Last updated: 14 March 2026

1. Introduction

SPPIN Hub ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use the SPPIN Hub supply chain simulation platform ("the Platform"). It applies to all users including educators, students, and administrators.

We are a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

Account Data

When you register or are registered on the Platform, we collect: name, email address, institutional affiliation, job role, and authentication credentials.

Usage Data

We automatically collect: IP address, browser type and version, pages visited, time spent on pages, simulation session data, and error logs. This data is used to improve the Platform and diagnose technical issues.

Simulation Results

We store the decisions, scores, outcomes, and feedback generated during simulation runs. This data belongs to the institution and is processed on their behalf.

Communication Data

If you contact us via email or support channels, we retain correspondence to resolve your query and improve our services.

3. Lawful Basis for Processing

We process personal data on the following lawful bases:

• Contractual necessity: to provide the simulation services you or your institution have contracted for
• Legitimate interests: to improve the Platform, ensure security, and prevent fraud
• Compliance with legal obligations: to meet our obligations under UK and EU law
• Consent: for any optional analytics or marketing communications (you may withdraw consent at any time)

4. How We Use Your Data

• Providing and maintaining the Platform
• Authenticating users and managing access permissions
• Generating simulation results and reports
• Sending essential service communications (account confirmations, security alerts)
• Improving platform performance and user experience
• Complying with legal obligations

5. Data Retention

Data Category	Retention Period
Account data	Duration of contract + 2 years
Simulation results	Duration of contract + 3 years
Usage logs	90 days rolling
Support correspondence	3 years

Upon contract termination, we will delete or anonymise your data within 90 days, unless a longer retention period is required by law.

6. Your Rights Under UK GDPR

You have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data ("right to be forgotten")
• Portability: receive your data in a structured, machine-readable format
• Restriction: ask us to limit how we process your data
• Object: object to processing based on legitimate interests
• Withdraw consent: for any consent-based processing

To exercise these rights, contact us at privacy@myedmentor.com. We will respond within 30 days.

7. Cookies

We use strictly necessary session cookies to maintain your login state. We do not use advertising cookies. Optional analytics cookies are only placed with your consent. See our Cookie Policy for full details.

8. Third-Party Processors

We work with the following sub-processors:

Processor	Purpose	Location
Supabase	Database and authentication	EU/US (SCCs in place)
Anthropic	AI-powered simulation feedback	US (SCCs in place)
Cloudflare	CDN and DDoS protection	Global
Vercel	Platform hosting	US/EU

All sub-processors are bound by data processing agreements and provide adequate safeguards for international transfers.

9. International Transfers

Where data is transferred outside the UK/EEA, we rely on Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs) as appropriate.

10. Security

We implement industry-standard security measures including TLS encryption, access controls, regular security reviews, and breach response procedures. We will notify you and the ICO of any data breach within 72 hours of becoming aware of it.

11. Contact Us

For privacy-related enquiries: privacy@myedmentor.com

To lodge a complaint with the UK supervisory authority: Information Commissioner's Office (ICO), ico.org.uk, 0303 123 1113.