Privacy Policy
Effective date: 23 October 2026 · Version 1.2
Taner Ltd (company number 17492661), also trading as "TanersPlace" ("we", "us" or "our"), provides the Digital Compliance platform at matcompliance.com (the "Service", previously available at tanersplace.com) for Multi-Academy Trusts, schools and businesses. This policy explains what personal data we collect, why, how we protect it, and the rights you have over it.
We are a UK-based service, and this policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Who we are
The Service is operated by Taner Ltd, a private limited company registered in England and Wales (company number 17492661). Where we act as a data controller (see Section 3), Taner Ltd is the party responsible for that processing under UK GDPR.
Data protection contact: privacy@tanersplace.com (or Taner@TanersPlace.com if that address is not yet active). [INSERT ICO REGISTRATION NUMBER once registered — see Section 13.]
2. The short version
- We collect the account details you and your colleagues give us (name, email, role), plus what you enter into the platform to track your organisation's compliance progress, including Single Central Record details for your staff.
- We do not sell your data, and we use no advertising or analytics cookies. One essential cookie keeps you signed in; optional browser storage that remembers your menu layout is used only if you say yes, and we keep a record of your choice (Section 7).
- Hosting is in the UK. We do not move your data outside the UK for our own purposes; a few providers you choose to use (Google or Microsoft sign-in, Stripe payments) or that protect the sign-up form (Cloudflare) may process limited data elsewhere under their own safeguards (Section 6).
- You can ask for a copy of your data, ask us to correct or delete it, or raise a concern with the ICO, at any time. See Section 10.
- This product is used by school and business staff. We do not knowingly collect data about pupils. See Section 9.
3. Two roles we play: controller and processor
Because of what the Service does, we hold two different roles under data protection law, and it matters which one applies to a given piece of data:
- Data controller — for the account and platform-usage data described in Section 4 (who has an account, how they use the Service, security logs, cookie choices, billing and support communications). We decide why and how this data is processed, and this Privacy Policy governs it directly.
- Data processor — for the content your organisation enters or uploads into the platform as part of your own compliance work: assessment notes, evidence documents, DPIA files, Single Central Record entries and management information about your staff, and any names or details you choose to record about your suppliers' contacts (Section 5). Here, your organisation is the data controller, and we process this content only on your instructions, under a data processing agreement available on request (Section 12). If any of this content includes personal data about your staff, pupils, or other individuals, you are responsible for having a lawful basis to enter it into the Service and for telling those people about it.
4. Data we collect as controller (account & platform data)
| Category | Examples | Why, and our lawful basis |
|---|---|---|
| Account details | Name, email address, role (e.g. Trust Lead, Academy Lead), organisation name and type, password (stored as a one-way cryptographic hash — we never see or store your actual password), optional profile picture | To create your account and run the Service for you (contract) |
| Sign-in & security data | Login timestamps, IP address, multi-factor authentication (MFA) status and recovery codes, records of login attempts, a tamper-evident security log of sign-ins, access refusals, exports and administrative actions | To keep accounts and the platform secure and to detect abuse (legitimate interests; our legal duty to keep personal data secure) |
| Password breach check | When you set a password we check it against the public "Have I Been Pwned" breached-password list. Only the first five characters of a one-way hash of the password are sent; the password itself and your email address never leave our servers | To stop you using a known-compromised password (legitimate interests) |
| SSO identifiers | If you choose "Continue with Google" or "Continue with Microsoft": the stable account identifier, name and email address those providers share with us (scope: openid email profile only — we never request access to your email inbox, files, calendar or contacts) | To let you sign in the way you chose (contract) |
| Usage & activity data | An audit trail of actions taken in the Service (e.g. "X marked item Y complete"), used for your own organisation's audit trail and to help us support you | Contract; legitimate interests |
| Technical & log data | IP address, browser user-agent, pages visited, response codes and timestamps | Security monitoring and diagnosing faults (legitimate interests) |
| Cookie choices | The choice you make on the cookie banner and later changes: a random reference, your choice, date and time, the wording version, your IP address and browser type, and your account if you were signed in | To show we asked first and honoured your answer (legal obligation under PECR and UK GDPR accountability; legitimate interests) |
| Billing | Organisation billing contact, subscription status and invoices. Card details are entered on Stripe's pages and never reach our servers | Contract; legal obligation (tax and accounting records) |
| Communications | Support requests and any other correspondence you send us | Contract; legitimate interests |
5. Data we process as processor (your organisation's content)
When you use the Service to carry out your own compliance work, you may enter or upload:
- Self-assessment answers, progress notes, and blockers recorded against a security or compliance framework;
- Evidence files and DPIA documents you upload as proof of compliance;
- Single Central Record entries about your staff, governors, volunteers and contractors (names, roles, dates and outcomes of the checks you choose to record), including the optional management information that goes beyond the register itself — a photo, mobile number, emergency contact, vehicle registration and notes. Staff can also be sent a link to review and update their own details, and an inspector link can be created to show the register to an inspector;
- Names, job titles and contact details of your staff or suppliers' contacts (e.g. "SME/Admin" fields against a third-party service), where you choose to record them;
- Details of the third-party services and suppliers your organisation uses.
We store and process this content only to provide the Service to you, and we do not use it for any other purpose (including, for the avoidance of doubt, training any AI/ML model). Exports of register data (Excel files) are produced only for users with edit rights, are recorded in the security log, and can be password-protected. See Section 3 for how responsibility for this content is split between us and your organisation.
6. Where your data is hosted, and who we share it with
The application and its database run on a virtual server in a data centre in London, United Kingdom, and backups are held in the UK. We do not transfer your personal data outside the UK for our own purposes. Some of the providers below may process limited data outside the UK; where they do, they rely on UK-approved safeguards such as the International Data Transfer Agreement or the UK Extension to the EU-US Data Privacy Framework.
We use a small number of service providers ("sub-processors") to run the Service, each engaged only to the extent needed to provide it to you:
| Provider | Purpose |
|---|---|
| Our UK cloud-server hosting provider (London) | Hosts the application, its database and backups |
| Fasthosts (UK) | Domain name (DNS) service and outgoing email delivery (account verification, password reset and notification emails) |
| Stripe | Taking card payments and managing subscriptions, only for organisations that buy a paid package. Stripe is an independent controller of the payment details you give it |
| Cloudflare (Turnstile) | A bot check on the sign-up form. It receives the data a browser sends when loading the check (such as IP address and browser details) |
| Google / Microsoft | Only if you choose "Continue with Google/Microsoft" to sign in |
| Have I Been Pwned | Breached-password check described in Section 4 (the five-character hash prefix only) |
| Google (favicon service) | When an administrator adds a third-party service to the catalogue, the service's public web domain is sent to fetch its logo. No personal data is sent |
| ip-api.com, rdap.org and HackerTarget.com | Only if you actively use the optional network tools (IP lookup, WHOIS, traceroute, connection test): the address or domain you type is sent to the relevant lookup service for that single request |
Our previous hosting environment (Fasthosts web hosting and ProSiteHosting database hosting, both UK) was retired on 23 October 2026. Any copies of your data that remain there are being deleted, and the accounts will be closed within 30 days of that date.
We do not sell, rent, or share your personal data with any third party for their own marketing purposes. We will only disclose personal data beyond the above where required by law, to protect our legal rights, or with your consent.
7. Cookies and browser storage
We use no advertising, tracking or analytics cookies. What we do use is listed in full, with durations, on our cookie page. In summary:
- Essential — a session cookie (
appsession) that keeps you signed in and protects forms against forgery, the cookie that remembers your cookie choice (tp_consent, 12 months), and the Cloudflare Turnstile bot check on the sign-up form. These are strictly necessary, so PECR does not require your consent for them and they cannot be switched off. - Preferences — browser storage that remembers your side-menu layout and email-editor view. These are optional and are not used unless you accept them.
When you first visit we show a banner with equal-weight buttons, "Essential only" and "Accept all". You can change your choice at any time on the cookie page (linked from the footer of every page); switching preferences off also clears what was saved. We ask again every 12 months and whenever the cookies we use change.
Record of your choice. So that we can show we asked first and respected your answer, every choice is logged: a random reference (also held in your consent cookie), your choice, the date and time, the version of the wording, your IP address and browser type, the page you were on (without any query string) and your account if you were signed in. This record is kept for 3 years and then deleted. Its lawful basis is our legal obligations and our legitimate interest in being able to evidence consent. Only global administrators can view it.
8. Retention
| Data | Kept for |
|---|---|
| Account data | While your account is active, and for a reasonable period afterwards to meet legal, accounting and security obligations, after which it is deleted or anonymised |
| Your organisation's content (Section 5) | While your organisation's account is active; after termination it is available for export for a reasonable period and then deleted (see our Terms) |
| Web traffic log (IP address, page, browser) | 90 days |
| Sign-in attempt records | 180 days |
| Security log | 400 days (about 13 months) |
| Cookie choice record | 3 years |
| Rate-limiting counters | 2 days |
| Backups | Up to 14 daily copies plus one copy for each of the last 6 months, so deleted data can remain in backups for up to about 6 months before it is rotated out |
| Tax and accounting records | As the law requires (currently 6 years) |
The audit trail of actions inside an organisation's account belongs to that organisation and is kept for as long as the account is active.
9. Children's data
The Service is designed for use by adult staff at schools, academy trusts and businesses — not by pupils, and not directly by children. We do not knowingly collect personal data about pupils. If your organisation includes information about pupils within evidence you upload (Section 5), we process it solely as your processor, under your instructions and your organisation's own safeguarding and data protection obligations.
10. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), subject to any legal obligation we have to retain it;
- Restrict or object to certain processing, including processing based on our legitimate interests;
- Port your data to another provider in a structured, commonly-used format;
- Withdraw consent at any time, where processing is based on consent (for example, the optional preferences storage — see Section 7);
- Complain to the Information Commissioner's Office (ICO) — ico.org.uk — if you believe we have not handled your data properly.
We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you.
If your organisation's Trust Lead/administrator manages your account, some requests (particularly relating to organisation-owned content under Section 5, such as a Single Central Record entry) may need to be directed to them, since they control that data. For anything we hold as controller (Section 4), contact us directly using the details in Section 1. We aim to reply within one month.
11. How we keep your data secure
- All traffic is encrypted in transit (HTTPS with modern TLS, and HSTS so browsers insist on it).
- Passwords are stored only as salted one-way hashes. Multi-factor authentication is available to everyone and is mandatory for global administrators.
- Access is role-based: people see only the organisations and sites they belong to, and exports need edit rights.
- The server accepts administrator logins only by cryptographic key, runs a firewall and automatic banning of repeated attackers, installs security updates automatically, and limits sign-in attempts.
- The application's database account has data-only privileges, and uploaded files are stored outside the public web folder and checked before they are accepted.
- A tamper-evident security log records sign-ins, refusals and administrative actions, and raises alerts on suspicious activity.
- The platform is security-tested; the most recent full test (external, server and application) was carried out in October 2026.
- We back up daily (Section 8). No system is perfectly secure; if a breach affects your personal data we will tell you and, where required, the ICO without undue delay.
12. Data Processing Agreement
If your organisation requires a formal Data Processing Agreement (DPA) covering the content described in Section 5 — standard practice for schools and trusts under UK GDPR — please contact us and we will provide one.
13. Regulatory registration
[INSERT: confirmation of ICO registration status and registration number once registered — see ico.org.uk/for-organisations/register/. Organisations processing personal data as a controller are generally required to register with, and pay a data protection fee to, the ICO unless a specific exemption applies.]
14. Changes to this policy
We may update this policy from time to time — for example as the Service changes, or to reflect changes in the law. If we make a material change, we will take reasonable steps to notify account holders (such as an in-product notice or an email) before it takes effect. The "Effective date" and "Version" at the top of this page always show when it was last updated. Version 1.2 (23 October 2026) updates the hosting details after our move to a new server and domain, adds the cookie choice banner and its record, lists our full set of providers and retention periods, and adds the security section.
15. Contact us
Questions about this policy, or about how we handle your personal data, can be sent to privacy@tanersplace.com (or Taner@TanersPlace.com).
See also our Terms of Service and cookie page.