Privacy Policy

CredimusAi ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our educational assessment platform.

We collect information that you provide directly to us, including:

• Name and contact information (email address, phone number)
• School or organisation details
• Job role and professional information
• Account credentials
• Assessment data and student work samples
• Communications with our support team
• Survey responses and feedback

When you register for our waitlist or apply for the Founding Partner Programme, we collect:

• Contact details (name, email, phone number)
• School information (name, type, size)
• Your role within the organisation
• Areas of interest in our platform
• For founding partner applicants: additional details about your school's technical readiness and participation motivations

This information is used to manage your registration, assess founding partner applications, and contact you about access opportunities.

If you participate in our Founding Partner Programme, we may additionally collect:

• Usage data and analytics to understand how the platform is used
• Feedback, comments, and suggestions provided during the programme
• Technical logs for debugging and performance improvement
• Anonymised assessment data for algorithm improvement (with explicit consent)
• Video recordings of feedback sessions (with consent)

Founding partner participant data is retained for the duration of the programme plus 12 months, or until you request deletion. Aggregated and anonymised insights may be retained indefinitely for research and product improvement purposes.

We use the information we collect to:

• Provide, maintain, and improve our services
• Process and analyse assessment data
• Manage waitlist and Founding Partner Programme registrations
• Send you technical notices and support messages
• Respond to your enquiries and provide customer service
• Send marketing communications (where you have opted in)
• Comply with legal obligations

Under UK GDPR, we process your personal data on the following legal bases:

• Consent: Where you have given explicit consent for specific purposes (e.g., marketing communications)
• Contract: Where processing is necessary to perform our contract with you or take steps to enter into a contract
• Legitimate interests: Where processing is necessary for our legitimate business interests, provided these are not overridden by your rights
• Legal obligation: Where we are required to process data to comply with the law

We do not sell your personal data. We may share your information with:

• Service providers who assist in operating our platform (hosting, email, analytics)
• Professional advisors (lawyers, accountants) where necessary
• Law enforcement or regulators where required by law

All service providers are bound by data processing agreements and must comply with UK GDPR requirements.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data is encrypted in transit and at rest. We regularly review and update our security practices.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements:

• Waitlist registrations: Until you are onboarded as a customer or request deletion
• Founding Partner Programme applications: For the duration of the programme plus 12 months
• Customer data: For the duration of your subscription plus 7 years for legal compliance
• Marketing preferences: Until you unsubscribe or request deletion

CredimusAi is operated by The Fourths (Pty) Ltd, a company incorporated in South Africa (registered address: 27 Scott Street, Waverley, Johannesburg, 2090). As your data controller is based outside the UK, the collection and initial processing of your personal data constitutes a restricted transfer under UK GDPR.

Primary processing location: Your personal data and examination scripts are stored and processed in Azure UK South (London), a Microsoft Azure region located within the United Kingdom.

Transfer to South Africa: Where personal data is transferred to The Fourths (Pty) Ltd in South Africa for platform development, support, or administration, we rely on the UK International Data Transfer Agreement (IDTA), supported by appropriate technical and organisational measures.

Other third-party processors: Where sub-processors are located outside the UK, we ensure each transfer is covered by an appropriate safeguard. A list of current sub-processors is available on request at dpo@credimus.thefourths.com.

Under UK GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data in certain circumstances
• Restriction: Request restriction of processing in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests or for direct marketing
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, please contact us using the details below. We will respond within one month.

We use cookies and similar technologies to improve your experience on our platform. For more information, please see our Cookie Policy.

CredimusAi processes student examination scripts using artificial intelligence. Where scripts contain information that could constitute special category data under UK GDPR Article 9, we apply the following safeguards:

• Student scripts are processed under a Data Processing Agreement with the school, which acts as the data controller for student data
• AI processing is used solely for the purpose of assessment marking and analysis — not for profiling, advertising, or any secondary commercial purpose
• Scripts are not used to train third-party AI models without explicit written consent from the data controller (school or trust)
• All AI outputs are subject to teacher review before being treated as final
• Data is held in UK-based infrastructure and is not transferred outside the UK without appropriate safeguards

The lawful basis for this processing is the performance of a contract (Article 6(1)(b) UK GDPR) between CredimusAi and the school.

CredimusAi is designed for use by educators and school administrators. We do not collect personal information directly from children or students. Student examination scripts uploaded to the platform by schools constitute children's personal data — the school or trust is the data controller for that data, and CredimusAi acts as data processor under a written Data Processing Agreement (UK GDPR Art 28).

We comply with the ICO's Age Appropriate Design Code (Children's Code) in our handling of student data. Access is restricted to authorised school staff and our platform engineering team on a least-privilege basis.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email.

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

The data controller for personal data collected through this site is CredimusAi, operated by The Fourths (Pty) Ltd. Registered address: 27 Scott Street, Waverley, Johannesburg, 2090, South Africa.

UK Representative (Art 27 UK GDPR): The Fourths (Pty) Ltd is in the process of designating a UK-based representative. In the interim, data subjects may contact us directly at dpo@credimus.thefourths.com or lodge a complaint with the ICO at ico.org.uk.

Email: dpo@credimus.thefourths.com

You may also contact us via our contact form. We will respond to data protection requests within one calendar month.