Mangorolla CIC is committed to protecting and respecting your privacy. This policy explains how we collect, use, and safeguard your personal data. If you have any questions, please contact us at privacy@mangorol.la.
If you are a participant in one of our activities or sign up to our mailing list, we, Mangorolla CIC, will collect information from you to help us run our activities and send you updates.
Data Controller: Mangorolla CIC, registered in England & Wales, company number 10384826
ICO reference number: ZA2433991. What data we collect, and why
Students
Students can access the site in two ways:
Login Cards – classes, particularly those with students under 13, are given login cards with a pre-assigned random username and password. This method does not require any personal data to be entered by the student.
Registration form – students aged 13 and over can register via a unique URL provided by their teacher. This requires the following data:
Display name Your display name is shown when you ask questions, take part in live Chats, and leave comments. Please do not use your full name. Full name To identify you to your teacher in the event of a safeguarding or behaviour concern. Email address To tell you when your question has been answered, about activity updates, and follow up surveys for you to tell us what you thought of taking part. If you are 13 or above To identify whether you are 13 or above and able to consent to this privacy policy. If you are under 13, your teacher will consent for you to use the site. Your account is linked to your teacher and school, so we can identify you if we need to. Sometimes we will be required to share your name and email address with your teacher. This will happen if you break any of the House Rules or if we have a safeguarding concern.
Teachers
We collect your name, email address, school, and subject responsibilities when you register your interest in our activities. This is so we can send you information about our activities that are relevant to you. We may also send you information about our activities that might be relevant for your colleagues.
We will use your email address to aid verification of your status as a teacher at your school. With your permission, we may also contact your school.
If you are taking part in one of our projects, you will have a profile which you can edit at any time.
Scientists
We ask for your name, email address, and information about where you work when you apply to take part in our projects. We use this to ensure you can participate in our projects, and to send you information about projects relevant to you. With your permission, we may also share your name, email address, information about where you work, and the interactions you have on the site with:
- your employer to check your work status for safeguarding reasons and to inform them of your involvement, and,
- if applicable, a funder of our programme to aid selection of participants and to publicise their involvement.
We also ask for some optional data on academic funding and membership of organisations to assess eligibility for some projects. You can tell us your education history, gender, and ethnicity to help us present a diverse range of scientists to students. If you tell us the name of the school you attended, we may use that to contact your school to invite them to take part.
If you are taking part in one of our projects, you will fill in a profile on this site about yourself and your work, which is visible to the public. You can edit this at any time. You have the ability to discourage search engines from indexing your profile, and to allow your profile to be only visible to logged in users.
Public
You can browse parts of our site without creating an account. Scientist profiles and student questions and answers are publicly accessible, unless a scientist has chosen to restrict their profile to logged-in users only. Live Chats are not publicly accessible unless they have been specifically set to public by the event organiser.
If you visit the site without logging in, we collect anonymous analytics data about your visit via our self-hosted Matomo analytics system (see Section 7 – Cookies). This may include your IP address, pages viewed, and browser type. We use this to understand how our site is used. Your IP address is not shared with any third party.
Keep Me Updated mailing list
If you sign up to our Keep Me Updated mailing list, we will ask for your name and email address. This is so we can send you information about our projects. You can unsubscribe from the list by clicking the unsubscribe link at the bottom of any email.
Debate Kit mailing list
If you sign up to our Debate Kit mailing list, we will ask for your name, email address, and school address. This is so we can email you when we have a new kit out, to ask if you would like one and post it out to you. If we send you a kit, we will also ask you if you received and used it. You can unsubscribe from the list by clicking the unsubscribe link at the bottom of any email.
2. Our legal basis for collecting your information, and how you can remove it
We process personal data under the following legal bases:
- Legitimate Interests: We collect data from students, teachers, and scientists to run our activities. We have carried out a Legitimate Interests Assessment to confirm that our use of personal data is proportionate and does not unduly override individuals’ rights.
- Consent: We collect your data for mailing lists only when you have explicitly opted in.
- Students under 13: Where students are under 13 and use login cards, no personal data is collected from them directly. Where a teacher registers a class and consents on behalf of students who are under 13, the teacher’s consent is the basis for processing. Students aged 13 and over provide their own consent when registering.
How to Remove Your Data:
You can request data removal by emailing privacy@mangorol.la with your name, email address, and relevant project details. We will delete your data within 30 days.
3. Who we share your information with
Students
If you are a student taking part in our activities, the data you provide us when registering or on your profile page is stored on our site. We use a US-based service, Postmark, to handle outgoing email transactions. They store your email address and metadata for 45 days from sending. We do NOT share your details with anyone else.
Teachers and scientists
We may provide your data to third-party suppliers in order to run our activities. We are a UK-registered organisation and this policy operates under UK GDPR. All suppliers within the UK or European Economic Area (EEA) are required to be GDPR-compliant registered data processors. We may also use suppliers outside of the UK and EEA. These countries may not have equivalent data protection laws. When transferring your information outside of the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or the UK’s International Data Transfer Agreement (IDTA).
The third-party processors we use fall into a number of categories which are listed below:
- IT service providers (Airtable, Basecamp, Alchemer) – software providers we use to help us to run our activities.
- Email systems (Brevo, SendGrid, Postmark, Google Workspace) – to send updates on our activities, and to communicate with participants during an event
Teachers:
- With your permission, we may contact your school for verification purposes.
- We may share your name and username with other participating teachers and staff at your school.
Scientists:
- Employer – with your permission, we will share your name, email address, and information about your level of activity with your employer for safeguarding reasons, and to inform them of your participation.
- Funders – with your permission we will provide your name, workplace, email address, and level of activity in the project to our funders to assist with participant selection, and for research and evaluation purposes.
4. How long we keep your information for
Students
Student personal information will be removed after 36 months of inactivity. That means we’ll delete your name and email address if you’ve given them to us. We will then make any questions, comments, or evaluation surveys you have sent on the site anonymous.
Teachers and scientists
We will keep information about you and your participation for up to 5 years after your last participation in one of our projects, after which it will be deleted or anonymised. You can request for us to remove your information at any point by emailing privacy@mangorol.la.
Mailing lists
We keep your information until you unsubscribe from the list.
5. Accessing your information
You have the right to:
- Access the data we hold on you.
- Correct any inaccuracies in your personal data.
- Request deletion of your data.
- Restrict processing — you can ask us to pause the processing of your data in certain circumstances, for example while a correction is being verified.
- Data portability — where processing is based on your consent, you can ask us to provide your data in a commonly used, machine-readable format.
- Object to processing — you can object to us processing your data where we rely on legitimate interests as our legal basis.
To exercise these rights, email privacy@mangorol.la with your name, the email address you used, and the project you participated in. We will respond within 30 days.
Right to complain: If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection authority. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.
6. Site data
Our site uses session cookies to manage your participation. These cookies:
- Help you participate in Chats, vote, and ask questions.
- Are removed when you log out.
As you use the site, we do record some information that could be traced to you. We record how you vote, the questions you ask, and the messages you write in Chats.
We also record when you log in and where you log in from (your IP address). We log the IP address so that if someone registers on the site claiming to be someone else then we can see where they are logging on from. It also helps us track any technical issues.
That sounds like a lot, but it doesn’t get given away and nobody will be able to trace it to you.
7. Cookies
The site uses cookies. These are mainly session cookies to allow you to stay logged in, and analytics cookies so we know how many people are using our site. Our analytics are recorded on our own system, not a third party.
Cookie Duration Type Purpose Intrusiveness _pk_id 13 months matomo It is used to store some details about the user, such as their unique visitor ID. Users can be automatically tracked across subdomains, without extra configuration. _pk_ref 6 months matomo It is used to store information that is needed to recognise users. The place the web page was visited from. _pk_testcookie per session matomo It is used to check if the server used by the visitor allows cookies. It is created and directly deleted. _pk_ses
_pk_cvar
_pk_hsr30 minutes matomo Short-lived cookies that are used to store data for the visit temporarily. Cookies expire and are removed from the server. PHPSESSID per session imascientist.org.uk It is a cookie generated in each session by the server. It is used to establish the user’s session and to pass data about the state via a temporary cookie. borlabs.cookie 1 year imascientist.org.uk Stores your cookie consent preferences so we don’t ask again on every page. Set when you make a cookie consent choice. Remembers your preference for 1 year. wordpress_logged_in per session imascientist.org.uk It is used to indicate when the user has logged in and what user it is. This cookie is kept in the web interface, as well as when one logs in. mtm_cookie_consent
or
mtm_consent
or mtm_consent_removed30 years matomo Whether or not the user accepts the consent. Created with an expiration date of 30 years to remember if consent was given or not.
8. Security measures
We take the security of your data seriously. Measures include:
- Access controls to ensure only authorised personnel have access.
- Regular audits of our systems to identify and mitigate potential security risks.
9. International data transfers
As a UK-registered organisation, we operate under UK GDPR. We may transfer your data outside the UK and EEA. When we do, we ensure the following protections are in place:
- UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs) or other legally approved safeguards.
- Data Processing Agreements with third parties to ensure compliance with GDPR.
10. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our practices or legal obligations. This policy was last reviewed on 3rd March 2026 and will be reviewed again in 12 months.
By continuing to use our site, you agree to the terms outlined in this Privacy Policy.
For any questions or concerns, contact us at privacy@mangorol.la