2wai Privacy Notice

This privacy notice ("Notice") sets out how 2wai (UK) Limited and its US affiliate, 2wai Inc. (together, “we”, “our” or “us”) processes personal data in the context of its offering of the UK Educational Suite (the "Platform") to schools in the United Kingdom (in each case, the "School").

This Notice is addressed to the following categories of data subject: authorized users of the Platform and School representatives ("you", "your").

Your “personal data” means any information that can identify you. When we say “processing” we mean any use of personal data, including (but not limited to) collection, recording, organisation, modification, transfer, and deletion.

We primarily process personal data on behalf of and in accordance with the instructions of the School that has purchased a subscription to the Platform. Such processing is carried out by us in our role as a processor and as necessary to make the Platform and its various functionalities and related services available to the School and its authorised users (e.g., teachers, parents and pupils) in accordance with our End User Licence Agreement  (EULA). This Notice does not cover such processing.

This Notice covers the more limited scenarios where we are processing your personal data for our own business purposes, as a controller, and the rights that you have in respect of such processing, in each case as further described in this Notice.

The entity acting as controller of your personal data for the processing activities set out in this Notice is 2wai (UK) Limited, with registered offices at Suite 27 8 Shepherd Market, Mayfair, London, United Kingdom, W1J 7JY.

If you have a question related to anything set out in this Notice, please contact us by emailing (see the 'How to contact us' section below for further details).

1. Personal data we collect about you

We collect certain personal data about School representatives as part of establishing and maintaining the business relationship between us and the School you represent, which includes contact details such as name, email address, telephone number and account information.

We may also collect limited personal data about how authorized users from the School use the Platform (Usage Information).

2. Lawful basis and purpose for processing your personal data

We use the personal data that we collect for the reasons set out below.

We will only use your personal data if we have a lawful basis, for example where the processing is necessary to comply with our legal and regulatory obligations; or for our legitimate interests or those of a third party. A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests (such reasons could include, for example, to review and respond to any correspondence or queries you send, to ensure security, to improve service and product development, to maintain our website, and to protect and grow our business).

We may use your personal data for the following reasons:

●     Manage our business relationships with Schools: We may use some of your personal data (primarily contact information) as part of establishing and maintaining our on-going business relationship with the School and to explore further ways in which we can assist the School, including to provide information about events and other networking opportunities. This is necessary for our legitimate interest to maintain a business relationship with Schools.

●     Comply with quality control, risk management and security procedures: We may process your personal data as part of ensuring the safe, secure and good functioning of the Platform, including for business continuity planning, ensuring compliance with the EULA and to protect the security of our systems. This is necessary for our legitimate interest of ensuring the security of the Platform, and running and managing our business.

●     Service Improvement: We may process your personal data (primarily Usage Information) to improve our Platform. This is necessary for our legitimate interest to make improvements to our Platform to ensure it continues to perform in line with users' expectations. We will only use aggregated / de-identified data for such purposes.

●     Comply with other relevant legal or regulatory obligations: We use your personal data to prevent, investigate, or provide notice of fraud, unlawful or criminal activity, perform due diligence, or unauthorised access to or use of your personal data, our networks, systems or applications. We may also use your data, such as contact information to enforce our EULA. This is necessary for our legitimate interests (for running and managing our business or detecting fraud) and to comply with our legal obligations.

●     Establish, exercise and defend legal claims: We may use your personal data if required for us to establish, exercise or defend a legal claim.

3. How we share and disclose personal data

We may share your personal data:

●     internally with our US affiliate, 2wai Inc. and

●     externally, in order to facilitate the provision of our products, services, and communications with users, vendors, clients, potential targets and / or business partners, our professional advisers, law enforcement, regulators, auditors, insurers and other government agencies and parties with whom we are involved.

We may also disclose your personal data to a third party in connection with a corporate reorganisation, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or capital, including in connection with any bankruptcy or similar proceedings.

4. International data transfers

Your personal data may be held at our offices and those of our affiliates, third-party agencies, service providers, representatives and agents as described above.

Where we process your personal data outside the United Kingdom, we will ensure:

●     the UK government has decided the particular country or international organisation ensures an adequate level of protection of personal data;

●     there are appropriate safeguards in place, such as the European Commission approved Standard Contractual Clauses as amended by the UK International Data Transfer Addendum together with enforceable rights and effective legal remedies for you; or

●     a specific exception applies under data protection law.

5. Data security

We have appropriate internal security measures in place with respect to data security and incident response to prevent personal data from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your personal data will do so only in an authorised manner and are subject to a duty of confidentiality.

Where we engage third parties to process personal data on our behalf as a processor, they do so on the basis of written instructions to ensure the security of personal data in compliance with the applicable data protection regulations.

6. How long we process and retain your personal data

We will only process and store your personal data for as long as necessary to fulfill the purposes for which we collected it (outlined above), including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for your personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

We will not keep your personal data for longer than is necessary, and following the end of the relevant retention period, we will delete or anonymise your personal data.

7. Your rights

You have the following rights, which you can exercise by contacting us in accordance with the 'How to contact us' section below:

●     Object to processing – the right to object to our continued processing of your personal data, e.g. processing carried out for the purpose of our legitimate interests.

●     Access a copy of your personal data – the right to be provided with a copy of the personal data that we process about you.

●     Correction (also known as rectification) – the right to request that we correct any errors, outdated information, or omissions in personal data that we process about you

●     A qualified right to erasure (also known as the right to be forgotten) – the right to require us to delete your personal data in certain situations.

●     A qualified right to restriction of processing – the right to require us to restrict processing of your personal data in certain circumstances, e.g. if you contest the accuracy of the data.

●     Data portability – the right to receive the personal data we process about you, in a structured, commonly used and machine-readable format and/or transmit that data to a third party in certain situations.

●     Not to be subject to automated individual decision making - the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you – we do not use any automated decision making when processing your personal data.

●     Withdraw your consent -where you have given us your consent, the right to withdraw your consent at any time by contacting us as described in the  "How to contact us" section below:

●     Complain – the right to bring complaints directly with us (see "How to contact us" section below) and/or with any relevant data protection or privacy authority.

Please contact us if you have any query or concern about our use of your personal data. We hope we will be able to resolve any issues you may have. If not, you can contact the Information Commissioner's Office, who can be contacted here: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline number: 0303 123 1113 https://www.ico.org.uk.

8. How to contact us

If you wish to contact us or make a request pursuant to this privacy notice, please email support@2wai.ai.

9. Changes to this privacy notice

We reserve the right to modify, alter or otherwise update this privacy notice at any time which will be made available through our website. Please check this page regularly for the most up to date version of this notice.

This Privacy Notice was last updated as of September 12, 2025.