Privacy Policy

Duologue ("Duologue", "we", "our", "us") provides a guided-dialogue learning platform used by schools, universities, and other educational institutions ("Partner Institutions") to support students' critical thinking and reasoning skills. This policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over it.

This policy covers the Duologue marketing website and the Duologue learning platform. If you're a student, teacher, or administrator using Duologue through a Partner Institution, please also check with that institution — they may have their own privacy notice that applies alongside this one.

Duologue is committed to protecting personal information and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection law.

Duologue's role in relation to your personal data depends on how you interact with us:

We act as a Data Processor for the learner and usage data generated when students and staff use the Duologue platform through a Partner Institution. In these cases, the Partner Institution (your school or university) is the Data Controller — they decide why and how that data is used — and Duologue processes it only on their instructions, under a Data Processing Agreement. If you have questions about how your institution's data is used, your institution's own privacy notice and data protection contact are the right place to start; we'll direct any requests we receive to the relevant institution where appropriate.

We act as the Data Controller for personal data we collect directly — for example, if you visit our marketing website, fill in a contact or "Get in touch" form, sign up for updates, or if you're an administrator setting up a Duologue account on behalf of your institution. This policy explains our responsibilities as Data Controller for that data in detail below.

Contact: Duologue Privacy Team

Email: duologue@sgul.ac.uk‍

Company registration: [COMPANY NAME AND REGISTRATION NUMBER, IF APPLICABLE]

ICO registration number: [ICO REGISTRATION NUMBER, IF APPLICABLE — see ico.org.uk/for-organisations/register]

Depending on how you use Duologue, we may collect:

• Name and email address, for anyone with an account — students, teachers, and administrators.
• Course enrolment information, linking your account to the right institution, course, or class.
• Interaction data — the conversations and activity within the platform, including responses within guided-dialogue exercises, progress, and completion data.
• Website and enquiry information — name, email, and any message content submitted through contact forms, demo requests, or newsletter sign-ups on our marketing website.
• Technical data — IP address, browser type, device information, and cookie identifiers collected automatically when you use our website or platform (see our separate Cookie Policy for details).

This data is used to personalise the learning experience and track progress. We do not knowingly collect more personal information than we need for these purposes, we never sell it, and we don't use it for purposes beyond providing and improving the Duologue platform.

We use personal data to:

• provide, maintain, and improve the Duologue platform for Partner Institutions and their students and staff;
• respond to enquiries, set up and manage accounts, and provide customer support;
• send service updates, and — where you've agreed to it — marketing communications about Duologue;
• understand how the platform is used, so we can develop and improve our learning modules and labs;
• meet our legal, regulatory, and contractual obligations, including those in our agreements with Partner Institutions.

Where we act as a processor on an institution's behalf, we only use platform data for the purposes the institution has instructed, as set out in our Data Processing Agreement with them — never for our own separate purposes, such as unrelated marketing.

No. Student conversation data is never used to train models — not Duologue's own systems, and not any third-party models. Aggregated, anonymised data may be used for pedagogical research and to improve the platform, but individual conversations remain strictly confidential.

Duologue does not sell personal information, and does not share it with third parties beyond what's needed to run the platform. The only recipients are:

• Partner Institutions — for platform usage data, since the institution is the Data Controller for its students' and staff's data.
• Amazon Web Services (AWS), our cloud hosting provider, hosted on EU infrastructure. AWS only processes personal data under our instructions, under contract, and only to store and run the platform — never for its own purposes.
• Professional advisers and regulators, where necessary for legal, accounting, insurance, or compliance purposes.
• A buyer or successor, if Duologue were to undergo a merger, acquisition, or sale of assets — in which case personal data may be transferred as part of that transaction, subject to the same protections described here.

We don't share personal information with third parties for their own independent marketing purposes.

Where Duologue is the Data Controller, we rely on the following lawful bases under UK GDPR, depending on the purpose:

(a) Consent — for example, when you opt in to marketing emails. You can withdraw consent at any time by emailing duologue@sgul.ac.uk or using the unsubscribe link in any email.

(b) Contract — where processing is necessary to perform a contract with you or your institution, such as setting up and administering a Duologue account.

(c) Legal obligation — where we need to process data to comply with the law, such as tax or accounting requirements.

(d) Legitimate interests — for example, to understand how our website and platform are used so we can improve them, or to respond to enquiries, provided this doesn't override your rights and interests.

Where Duologue acts as a Data Processor for platform usage data, the lawful basis for that processing is determined by the Partner Institution as Data Controller, and set out in our agreement with them.

Duologue's platform is designed to be used by students, some of whom may be under 18, accessing it through their school, college, or university. Where a student under 18 uses Duologue directly:

• their institution (not Duologue) is responsible for obtaining any parental consent or providing any parental notice required, and for deciding that use of the platform is appropriate, as the Data Controller for that student's data;
• we design the platform with UK Age Appropriate Design Code principles in mind — for example, collecting only the data needed to provide the service, and not using children's data for marketing profiling;
• we do not knowingly collect personal data directly from children outside of an institution-managed account, and we do not permit direct sign-up by individuals under 18 without institutional involvement.

If you're a parent or guardian with concerns about how your child's data is used on Duologue, please contact your child's school or institution in the first instance, as they hold the primary relationship and responsibility as Data Controller. You're also welcome to contact us at duologue@sgul.ac.uk and we'll help direct your query.

All data is hosted on AWS EU infrastructure, with appropriate safeguards in place for any international transfers — for example, where a sub-processor needs to access data from outside the UK/EEA, we rely on the UK's International Data Transfer Agreement or an equivalent safeguard to make sure your data keeps the same level of protection.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including encryption in transit, access controls, and regular security review of our systems and sub-processors.

Account and interaction data is retained for 13 months after your last activity, then deleted or anonymised. You can request deletion of your data at any time by contacting duologue@sgul.ac.uk — requests are processed in line with GDPR requirements.

Under UK data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data in certain circumstances.
• Restriction — ask us to limit how we use your data while we resolve a query about it.
• Portability — ask us to provide your data in a machine-readable format, or transfer it to another organisation, in certain circumstances.
• Objection — object to our use of your data for direct marketing at any time (we'll stop immediately), or on other grounds relating to your particular situation.

If Duologue is the Data Controller for your data, you can exercise these rights by contacting us at duologue@sgul.ac.uk. If your data relates to your use of Duologue through a school or university, we'd encourage you to contact that institution directly, as they are the Data Controller — but you're welcome to contact us and we'll help route your request appropriately.

We aim to respond to all requests within one calendar month.

Duologue's learning modules may adapt content or suggest next steps based on a student's activity within the platform (for example, recommending a module based on progress). This does not involve decisions that produce legal or similarly significant effects about an individual without human involvement. If this changes, we'll update this policy and provide information about the logic involved and your right to request human review.

If you have concerns about how we (or, where relevant, a Partner Institution) handle your personal data, please contact us at duologue@sgul.ac.uk and we'll do our best to resolve it.

You also have the right to complain to the UK's data protection regulator:

The Information Commissioner's Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk

We may update this policy from time to time, for example to reflect changes in our platform or the law. We'll update the "Last updated" date at the top of this page when we do, and encourage you to check back periodically.