Teens in AI

Privacy Policy

1. Introduction

1.1 Acorn Aspirations Ltd trading as Teens in AI (company number 09349572), registered in England and Wales, with its registered office at 50 Woodgate, Leicester, LE3 5GF, United Kingdom (“Teens in AI”, “we”, “us” or “our” in this policy), is the data controller for the purposes of the UK General Data Protection Regulation (UK-GDPR) and the Data Protection Act 2018.

1.2 Our programmes have different eligibility criteria. AI Adventures is currently designed for learners aged 13 to 19. For the purposes of this notice, a child means a person under 18. Where a learner is 18 or 19, they may exercise their own data-protection and contractual rights. Other Teens in AI programmes may have different published age criteria, which will be stated at registration.

1.3 Together, these offerings are referred to as our “Services”. This Privacy Policy explains how we process personal data relating to all of our Services, including those delivered via third-party platforms such as Thinkific (see clause 9).

1.4 Teens in AI is committed to protecting and respecting your privacy. Where we decide the purpose or means for which personal data you supply through these Services is processed, we are the “data controller” for the purposes of the UK-GDPR.

1.5 This policy explains the following:

  • What information Teens in AI may collect about you;
  • How Teens in AI will use information we collect about you;
  • Whether Teens in AI will disclose your details to anyone else; and
  • Your choices and rights regarding the personal information you have provided to us.

1.6 Our online services contain hyperlinks to websites owned and operated by third parties. These third-party websites may have their own privacy policies, and we recommend you review them. We do not accept any responsibility or liability for the privacy practices of such third parties, and your use of them is at your own risk.

1.7 This Privacy Policy explains how we handle personal data when you participate in or use our Services. Where we need consent for a specific processing activity, we will ask for it separately and make clear how it can be withdrawn.

2. Information We Collect

2.1 We collect and process the following information, which may include your personal data.

Information provided by you when using our Services.

2.2 We collect and process personal data that you provide in the following situations:

  • Setting up an account and/or profile
  • Enrolling on Thinkific (for AI Adventures courses)
  • Signing up for events
  • Signing up for speaking opportunities
  • Attending our events
  • Using our Services
  • Signing up for our newsletter
  • Contacting us with enquiries

2.3 Such information may include:

  • Contact data: including your full name, email address, phone number, and how you heard about us.
  • Student information: including full name, date of birth, age, school or organisation affiliation, gender, country or region, student sign-out options, medical information, educational needs, and emergency contact details, where relevant to the programme or service being provided.
  • Transaction data: where you attend an event or access paid-for content or a course, we will keep information related to your purchases, such as billing address, order numbers, and payment method. Payments are handled by third-party processors such as Stripe and PayPal; Teens in AI does not store card details.
  • Your enquiries and feedback: if you contact us about our Services, we may retain the content of such enquiry. You are under no obligation to provide us with any details, but if you do not provide all relevant information, we may not be able to help.
  • Photos: we may take these at our in-person or online events, provided we have obtained prior parent or guardian consent from those being photographed.
  • AI Adventures enrolment: name, email address, and login details.
  • AI Adventures course activity: lesson progress, course feedback, quiz results, and certificates achieved.

2.4 Information may be collected directly from you or via third-party platforms such as Thinkific (see clause 9), which hosts our AI Adventures courses and manages course-related data.

3. How We Use Your Information

Providing the Services

3.1 We may use and retain your personal data where we need to perform the service we are about to enter into or have entered into with you, such as to:

  • register you as a user of our Services; and
  • deliver our Services to you.

3.2 We may also use and retain the personal data you provide to us when requesting our Services, to pursue our legitimate interests of providing our Services to you, such as to:

  • respond to your enquiries and communicate with you;
  • contact you about participating in our events;
  • analyse and improve our Services, such as to optimise logistics and future event offerings;
  • provide you with information and updates about the Services we offer; and
  • ensure legal and regulatory compliance.

4. Our Legal Basis for Processing Personal Data

4.1 We are required under UK-GDPR to identify a lawful basis for processing your personal data. We rely on the following:

  • Contract: Where processing is necessary to perform a contract with you or to take steps at your request prior to entering a contract.
  • Legal obligation: Where processing is necessary to comply with a legal obligation to which we are subject.
  • Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests. Our legitimate interests include operating and improving our Services, communicating with participants, and ensuring the safety and security of our events.
  • Consent: Where we rely on consent for a specific processing activity, we will explain the purpose and how consent can be withdrawn. Where required by applicable law, we obtain parental or legal guardian consent before processing a child’s personal data. You may withdraw consent at any time by contacting us at hi@teensinai.com.

4.2 Sometimes more than one lawful basis will apply to the same processing activity.

5. Cookies and Tracking

5.1 We use cookies and similar technologies on our website and, where applicable, our online services. These may include:

  • Strictly necessary cookies: Essential for the relevant website or platform to function correctly, including session management and security.
  • Analytics cookies: Used to understand how visitors interact with our website or learning platform, such as pages visited, navigation patterns and time spent on site. We use Google Analytics on our website. Our AI Adventures learning platform may also use authorised analytics providers, including Mixpanel, to understand course engagement and improve our educational services.

We do not use personal data for targeted advertising or commercial profiling. Where analytics or other non-essential cookies require consent under applicable law, they will only be used in accordance with the user’s cookie preferences.

5.2 You can manage or disable cookies through your browser settings and, where available, our cookie preference tools. Please be aware that disabling certain cookies may affect the functionality of our website or learning platform.

6. Data Minimisation and Purpose Limitation

6.1 We collect only the personal data that is necessary for the specific purposes described in this policy. We do not use personal data collected through our Services for any purpose other than those set out here.

6.2 We do not use personal data for automated profiling, targeted advertising, or any form of commercial monetisation. We do not sell, rent, or otherwise provide personal data to third parties for their own marketing purposes.

7. Data Origin, Sharing and Disclosure

7.1 We may share your information with the following categories of recipients, where necessary for the purposes described in this policy:

  • Thinkific Labs Inc.: To manage enrolments, access and course activity for our AI Adventures programme. Thinkific processes and stores participant data on our behalf as a data processor.
  • Google Workspace: For data storage, internal communications and administrative activities.
  • Analytics providers: Including Google Analytics and, where applicable, Mixpanel, to understand usage, measure engagement, troubleshoot technical issues and improve our services, in accordance with applicable cookie consent requirements.
  • Marketing measurement providers: Where applicable, providers such as Meta Platforms Ireland Ltd. may process website interaction or campaign measurement data in accordance with user cookie preferences.
  • Payment processors, including Stripe and PayPal: To process event and course payments. We do not store payment card details.
  • Email and communications providers, including Brevo: To manage programme communications, newsletters, registration workflows and event notifications.
  • Schools, institutional partners, event delivery partners and contractors: Where necessary to deliver our programmes, manage participation, provide support or report on programme outcomes, subject to appropriate data protection arrangements.
  • Other authorised service providers: Where necessary to provide essential services, such as technical support, collaboration, reporting and platform administration, subject to appropriate data protection obligations.
  • Legal and regulatory authorities: Where required by law, or where necessary to protect the rights, safety or property of Teens in AI, our users or others.

7.2 We do not sell personal information.

7.3 We do not sell, rent, trade or otherwise provide personal data to third parties for their own marketing purposes or targeted advertising.

7.4 We do not show external advertisements within our programmes, including AI Adventures online, self-paced courses.

7.5 AI-assisted educational content: Teens in AI may use approved generative AI tools to draft, structure or enhance educational and internal materials. AI-assisted educational content is subject to meaningful human review, correction and approval before publication or delivery. We do not enter learner personal data into public or general-purpose AI tools, train third-party AI models on learner data, or use AI to make solely automated decisions about learners that produce legal or similarly significant effects.

8. Data Retention

8.1 We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Our default retention periods are as follows:

  • Participant and event registration data: Retained for three years from the date of the relevant event or programme, after which it is securely deleted or anonymised.
  • Course enrolment and activity data (via Thinkific): Retained for the duration of a participant’s active enrolment plus three years, after which it is deleted or anonymised.
  • Financial and transaction records: Retained for six years in accordance with HMRC requirements.
  • Contact and newsletter data: Enquiry records are retained for as long as necessary to resolve the enquiry and for any subsequent period required for legitimate administrative or legal purposes. Newsletter and communication data are retained until you unsubscribe or request deletion, and are removed from active communication systems within 30 days of unsubscribing, subject to any legal retention requirements.
  • Safeguarding records: Retained in accordance with applicable safeguarding legislation and guidance.

8.2 Data related to completed courses or programmes may be anonymised for reporting and evaluation purposes and retained indefinitely in that anonymised form.

9. Teens in AI’s AI Adventures Online, Self-Paced Courses Hosted on Third-Party Platform ‘Thinkific’

9.1 Thinkific Labs Inc. is a Canadian company which hosts and manages student data for Teens in AI, including:

  • Course enrolment and login information; and
  • Course progress, quiz results, and activity data.

Data Protection

9.2 Thinkific uses security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Procedures have been put in place to deal with any suspected personal data breach, and Thinkific will notify us and any applicable regulator of a breach where required by law.

9.3 Teens in AI ensures that our use of Thinkific complies with applicable data protection laws, including UK-GDPR. You can view Thinkific’s Privacy Policy and Sub-Processors Policy at: https://www.thinkific.com/privacy-policy/ and https://www.thinkific.com/thinkificsubprocessors/

Child Safeguarding

9.4 Our AI Adventures programme does not allow interactions between users and users cannot create their own content.

9.5 AI-assisted educational content: Please refer to clause 7.5.

10. Children

10.1 Our programmes have different eligibility criteria. AI Adventures is currently designed for learners aged 13 to 19, while other programmes may have different published age criteria, which will be stated at registration. We recognise that children and young people require particular protection when their personal data is collected and processed, as they may be less aware of the risks involved. Accordingly, we use their personal data only for the purposes described in this policy and maintain safeguarding policies for our personnel, programme partners and speakers.

10.2 Where required by applicable law, we obtain parental or legal guardian consent before processing a child’s personal data. Depending on the programme and circumstances, this may include consent obtained through online consent forms or written consent at registration. We may also rely on consent provided through a participating school, educational institution or programme partner where appropriate and lawful.

10.3 Parents and guardians may at any time request access to, correction of, or deletion of their child’s data by contacting us at hi@teensinai.com. We will respond to valid data-rights requests without undue delay and, in normal circumstances, within one month of receipt. Where the law allows us to extend the response period or pause the time while we obtain information needed to identify or clarify the request, we will tell you and explain why.

10.4 If a parent or legal guardian believes that their child has provided personal information without consent where consent was required, they should contact us immediately at hi@teensinai.com. We will investigate the matter and, where appropriate, delete the information within 30 days, subject to any legal obligations requiring its retention.

10.5 Where a safeguarding concern arises in connection with our Services, we follow established escalation procedures. Access to participant data is restricted to authorised personnel only. Mentors, volunteers, staff, and event partners are subject to appropriate behavioural expectations and guidance.

10.6 Teens in AI maintains a Safeguarding Policy governing the conduct of all personnel, mentors, volunteers, event partners, and speakers involved in our programmes. This policy is available on request by contacting us at hi@teensinai.com.

11. Your Rights

11.1 Under UK-GDPR, you (and, where applicable, your parent or guardian) have the following rights regarding your personal data:

  • The right to access your personal data.
  • The right to correct or update inaccurate data.
  • The right to request deletion of your data (“the right to be forgotten”).
  • The right to withdraw consent for specific processing activities.
  • The right to object to processing or to request that processing be restricted.
  • The right to data portability (where processing is based on consent or contract and carried out by automated means).

11.2 To exercise any of these rights, please contact us at hi@teensinai.com. We will respond to valid data-rights requests without undue delay and, in normal circumstances, within one month of receipt. Where the law allows us to extend the response period or pause the time while we obtain information needed to identify or clarify the request, we will tell you and explain why. We may need to verify your identity before processing your request.

11.3 You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at https://ico.org.uk, the supervisory authority for data protection matters in the United Kingdom.

12. Data Security

12.1 We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. These measures include:

  • Encrypted data transmission across our digital platforms.
  • Access controls restricting personal data to authorised personnel.
  • Regular review of data protection practices and internal policies.
  • Staff awareness of data protection and safeguarding obligations.
  • Appropriate assessment of third-party service providers and the data protection and security measures they maintain.

12.2 Thinkific (see clause 9) also maintains its own security measures to protect data hosted on its platform.

13. Breach Notification

13.1 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, in accordance with our obligations under UK-GDPR.

13.2 Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also notify those individuals directly without undue delay.

13.3 We maintain an internal record of all data breaches, including those that do not meet the threshold for notification.

13.4 Where a personal data breach affects personal data processed on behalf of a school or institutional partner, we will notify the relevant partner within 48 hours of becoming aware of the breach, where contractually agreed or otherwise applicable, to support the partner in meeting its own data protection obligations.

14. Special Categories of Data

14.1 “Special categories” of personal data - such as data concerning health, racial or ethnic origin, or religious or philosophical belief - are granted higher levels of protection under data protection law.

Where we process special category data, we identify both a lawful basis under Article 6 UK GDPR and a separate condition under Article 9. Depending on the circumstances this may include explicit consent, vital interests, substantial public interest where a relevant statutory condition applies, or another lawful condition. We collect only the minimum information needed for the stated purpose and apply additional access controls.

14.2 Teens in AI may process information about physical or mental health or disability status where necessary to ensure the health and safety of participants at our events and to provide appropriate adjustments. We will only process this type of information where we have a lawful basis to do so, such as where it is necessary to protect your vital interests or where you have provided explicit consent.

14.3 Where you have made special category data manifestly public - for example, by featuring in publicly available videos or materials - we may process this information where it is relevant to our Services and we have a lawful basis under data protection law (such as Article 9(2)(e) UK-GDPR). We will not actively infer, profile, or create new special category data from such materials.

15. Child Safety and Prevention of Harassment and Fraud

15.1 We may process your information for the legitimate interests of ensuring that use of our Services is lawful and non-fraudulent, does not disrupt the operation of our Services, and does not involve harassment or bullying of our personnel or other individuals.

15.2 Where we suspect unacceptable activities, we may investigate and retain a record of such investigation and its conclusion. Where an investigation results in a ban from our Services, we will retain details of such a ban to ensure it can be enforced.

15.3 We process information for the legitimate interest of complying with HMRC requirements by retaining records of customer purchases and transactions.

15.4 Where we reasonably believe that you are or may be in breach of applicable law, we may use your personal information to inform relevant third parties, your email or internet provider, or law enforcement agencies.

15.5 Our AI Adventures online, self-paced courses programme does not allow interactions between users and users cannot create their own content.

15.6 AI-assisted educational content: Please refer to clause 7.5.

16. International Data Transfers

16.1 Teens in AI is a UK organisation. We use Google Cloud services for the storage and protection of our data. Google replicates customer data between multiple geographically dispersed data centres and logically isolates customer data. Our data is stored in data centres listed at: https://cloud.google.com/about/locations.

16.2 Where we transfer personal data outside the UK or European Economic Area (EEA), including to Thinkific Labs Inc. in Canada, we ensure that the transfer complies with applicable data protection law. Where a country is not covered by an applicable adequacy decision or regulation, we implement appropriate safeguards, which may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission’s Standard Contractual Clauses (SCCs), or another legally recognised transfer mechanism. Where applicable, we may rely on the UK–US Data Bridge for certified recipients.

16.3 If you would like further information about these safeguards, please contact us at hi@teensinai.com.

17. Data Protection Complaints

You may complain to us about how we have used your personal data by emailing hi@teensinai.com and marking the message "Data protection complaint". We will acknowledge the complaint within 30 days, investigate it appropriately and without undue delay, and tell you the outcome and any action we have taken or propose to take. You also have the right to complain to the Information Commissioner's Office. Raising a complaint with us does not remove that right.

18. Policy Updates

18.1 This Privacy Policy may be updated periodically to reflect changes in our practices or legal requirements. The effective date at the top of this document indicates when the policy was last revised. Where changes are material, we will notify participants by email or via a notice on our website.

19. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us:

Acorn Aspirations Ltd trading as Teens in AI

For the Attention of Elena Sinel, CEO and Data Controller

50 Woodgate, Leicester, LE3 5GF, United Kingdom

Email: hi@teensinai.com

Company number: 09349572

Last updated: September 2026