We currently collect and process some or all of the following information:

• - personal identifiers
• - contacts and characteristics (for example, name and contact details)
• - your personal banking data (such as descriptions of transactions in and out of your bank account)
• - account balances and account names
• - individual reports about your progression through the Good With education program
• - application-use data (such as how frequently the app is used)
• - your gender
• - your disability status
• - psychometric test scores

Under the UK General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

• (a) Your consent. You are able to remove your consent at any time. You can do this by contacting privacy@goodwith.co. Please provide your userID on all correspondence so we can process your request quickly.
• (b) We have a contractual obligation.
• (c) We have a legal obligation.
• (d) Legitimate interest

We are regulated by the ICO, and are fully accountable for making sure your data is safe, and not used for any reason other than those stated above. Staff who come into direct contact with your data are DBS certified, and are expected to remain up to date with the relevant data protection regulations. We store data in a secure database hosted in Google Cloud Platform. Access to the database is restricted to those who have a need to use data to fulfil their jobs. These access rights are reviewed regularly. Google does not have access rights, and is not allowed to process your data.

We will not keep your data for any longer than is deemed necessary. Typically, we keep your personal data for 6 years. This duration is thought to be appropriate in most cases, and is decided after consideration of: our contractual obligations to you, whether data is processed with your explicit consent (and whether this consent has been withdrawn), guidelines issued by relevant data protection authorities. After this time, data is aggregated and any connection to your user ID is removed. We do this so we can continue to improve the product by developing more accurate statistical models, but you will not be identifiable in this training data. You will be contacted in advance of your data being included in the training data store to ask whether you would prefer the data to be deleted.

Automated decision-making is a process of decision making that does not involve human interaction. Our chatbot uses your data along with our algorithms to make decisions around your educational pathway, readiness score, and wellness recommendations. Our bot is periodically trained to keep its scoring metrics as accurate as possible. In order to adhere to Article 22 of the UK GDPR, we have introduced a system in which human intervention can be requested. An appeal-like service is readily available should you run into any issues. Regular checks will also be carried out to ensure that the AI is functioning effectively and fairly. In order to adhere to these rights we have recognised that you must be able to: express your view, contest the decision, have access to adopted suitable measures that safeguards you, including privacy notice versioning, and staff trained in communicating with vulnerable users.

Under data protection law, you have rights including:

• - Your right of access - You have the right to ask us for copies of your personal information.
• - Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• - Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
• - Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• - Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
• - Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please contact us at privacy@goodwith.co if you wish to make a request.

If you have any concerns about our use of your personal information, you can make a complaint to us at privacy@goodwith.co. You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk