GDPR & Data Protection

This statement explains how The Grammar Index™ meets its obligations under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), together with the UK Data Protection Act 2018. It sits alongside our Privacy Policy and provides the additional detail those regulations require. If anything here conflicts with the Privacy Policy on a data-protection point, this statement takes precedence.

1. Who we are (the data controller)

The data controller responsible for your personal data is Alderstrom Limited ("we", "our", "us"), trading as The Grammar Index, a company registered in the United Kingdom.

• Registered office: Aberdeen House, HAYWARDS HEATH, RH16 4NG
• Company registration number: 10168380
• Data-protection contact: info@grammarindex.com, or write to us at the address above marked "Data Protection".

We are not required to appoint a statutory Data Protection Officer, but the contact above is responsible for overseeing data protection and answering any questions about this statement.

2. The personal data we process

We keep data collection to the minimum needed to run the service. We process:

• Purchase & licence data: your name and email address, your licence key(s), and the tier purchased. For Team, Institution and Gift / Sponsorship licences and gift cards, the registering owner's name and email, and the school or organisation's name and (for UK schools) its DfE reference number (URN).
• Payment data: handled entirely by Stripe. We never receive or store your card or bank details — only a confirmation of payment and a Stripe reference.
• Device-activation data: a hashed device fingerprint (derived from basic device properties) used to enforce device limits, together with the platform, time and IP address of each activation and licence check. The fingerprint cannot on its own identify you, and you can name, view or remove your devices in the My Devices portal.
• Portal sign-in data: to manage devices you sign in with your email and a short-lived 6-digit code sent to that address — we do not store passwords.
• Support & enquiry data: the name, email address and message you send us through the Contact form or by email.
• Technical & analytics data: standard server logs and privacy-conscious website analytics (see cookies, section 6).

What we do not do: we do not track which grammar topics you view, search for, or how you study. The apps work offline and that usage stays on your device. We do not sell your data or use it for third-party advertising.

3. Why we process it, and our lawful basis

Under Article 6 of the UK/EU GDPR we rely on the following lawful bases:

• Performance of a contract (Art. 6(1)(b)) — to deliver your licence key, activate and manage your devices, and provide the service you paid for.
• Legitimate interests (Art. 6(1)(f)) — to answer support enquiries, secure our website and forms (including bot-protection), prevent licence abuse and fraud, and understand aggregate website usage. We balance these against your rights and use the least intrusive option.
• Consent (Art. 6(1)(a)) — for any non-essential cookies or optional communications. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to keep transaction records for tax and accounting purposes.

The Grammar Index is an educational service and does not carry out profiling or automated decision-making that produces legal or similarly significant effects.

4. Sub-processors we share data with

We do not sell or trade your personal data. We share it only with the service providers needed to operate The Grammar Index, each acting under a data-processing agreement and only for the purposes below:

• Stripe — payment processing.
• Twilio SendGrid — sending transactional email (licence keys, verification codes, support replies).
• Google reCAPTCHA — protecting our login and forms from automated abuse.
• Statcounter and Google Analytics — aggregate website analytics.
• Our hosting provider — running the website and licence servers.
• Legal or regulatory bodies — only where we are required by law, or to establish, exercise or defend legal claims.

5. International data transfers

Some of the sub-processors above may process data outside the United Kingdom or the European Economic Area. Where that happens, the transfer is protected by an approved safeguard — an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses — so your data receives an equivalent level of protection wherever it is processed.

6. Cookies

We use a small number of cookies:

• Strictly necessary: security and anti-forgery cookies that keep the site working and protect form submissions. These do not require consent.
• Functional: a cookie that remembers your chosen display currency.
• Analytics & security: cookies set by Statcounter and Google Analytics (aggregate visitor statistics) and Google reCAPTCHA (bot-protection).

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the site from working.

7. How long we keep your data

• Licence & account data is kept for as long as your licence is active, and for a reasonable period afterwards so we can reissue keys and honour support.
• Payment & transaction records are retained for the period required by UK tax law (generally six years).
• Support messages are kept only as long as needed to resolve your enquiry and for our records.

When data is no longer needed, we securely delete or anonymise it.

8. Your rights

Under the UK/EU GDPR you have the right to:

• Be informed about how we use your data (this statement).
• Access the personal data we hold about you.
• Rectification — correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data ("right to be forgotten"), subject to our legal retention duties.
• Restrict or object to our processing in certain circumstances.
• Data portability — receive your data in a portable, machine-readable format.
• Withdraw consent at any time where we rely on consent.

To exercise any of these rights, contact info@grammarindex.com or use our Contact page. We will respond within one month, free of charge in most cases. We may need to verify your identity before acting on a request.

9. How we protect your data

We apply appropriate technical and organisational measures, including encryption in transit (HTTPS), authenticated and access-controlled systems, hashed device identifiers, and keeping payment card data entirely out of our systems by using Stripe. We review these measures regularly.

10. Children's data

The Grammar Index is used in educational settings, including by schools on behalf of pupils. We do not knowingly collect personal data directly from children. Where a school or institution buys licences, the school is responsible for the lawful basis for any pupil use, and purchases are made by authorised staff. Accounts and purchases are intended to be made by adults (aged 18 or over).

11. Complaints

If you have a concern, please contact us first and we will do our best to resolve it. You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO), ico.org.uk, helpline 0303 123 1113. If you are in the EEA, you may complain to your local data protection authority.

12. Changes to this statement

We may update this statement to reflect changes in our practices or the law. We will post the revised version on this page with a new "last updated" date.

13. Contact us

For any data-protection question or request, contact info@grammarindex.com or use our Contact page.