Privacy Notice

About this notice

This notice explains, in plain language, what personal information NextStepUni collects when you use the Learning Lab, why we use it, and the choices and rights you have.

It applies to students using NextStepUni. Last updated 1 June 2026 (version 2026-06-01).

Who looks after your information

Your school is the data controller — it decides how your information is used to run this study programme and acts on behalf of you and your parents/guardians.

NextStepUni Ltd is the data processor — we build and run the app and handle your information on your school’s instructions.

PwC Ireland sponsors the programme but is not a controller or processor and never receives any student information.

You can contact NextStepUni about your information at nextstepuniinfo@gmail.com.

What we collect

• Account details: your name, your email address, a password (stored only in a scrambled “hashed” form by Google Firebase), and the avatar you choose.
• Your school and year group (for example, 5th or 6th Year).
• Your study setup: the subjects and levels you take, your target grades, your exam start date, your rest days, and your “North Star” goal for after school.
• Your activity: how far you’ve got in each module, your study sessions, points and achievements, mock exam results, and your topic confidence/mastery.
• Your reflections: short notes you write after a study session, and free-text answers to module exercises.
• Peer features: the kudos and gifts you send to classmates at your school.
• Settings: your display preferences, such as dark mode, language and theme.

What we do NOT collect

• We do not ask for your date of birth or age.
• We do not collect your location beyond the name of your school.
• No biometric data, no advertising identifiers, and no advertising or tracking cookies.
• We do not use any analytics or tracking service.
• We do not send anything you type to any artificial-intelligence service.

Why we use your information

To run the study programme and show you the right content for your subjects and year; to track your progress, points and streaks; to let your school’s guidance counsellor support you; and to keep your account secure.

Our legal basis

We rely on a public-interest task (GDPR Article 6(1)(e)): your school delivers a state-curriculum educational service and acts in place of a parent during the school day. Permission from your parent or guardian is obtained when you are enrolled in the programme at your school (Article 8).

If sensitive information ever happens to appear in something you write, we rely on the “substantial public interest (education)” condition (Article 9(2)(g) GDPR and section 41 of the Data Protection Act 2018).

These legal bases are being confirmed with participating schools and our legal advisers.

Who can see your information

• You can see all of your own information.
• Your school’s guidance counsellor can see your progress to support you.
• Other students at your school can see a limited public version of your island (your first name, avatar, school, chosen goal category, and your island decorations and score), plus any kudos you choose to send. Your full name, study sessions, reflections, grades, points and purchases are never shown to other students.
• NextStepUni staff do not routinely read your information by hand — only occasionally to fix a technical problem.

Who we share it with

Your information is stored using Google Firebase (for login, the database, and server functions). Firebase is our main service provider.

Your profile picture is generated by an avatar service called DiceBear. We only send it the preset avatar name you picked (such as “Maya Angelou”) — never your real name, email, or anything that identifies you.

We do not sell your information and we do not share it for advertising.

Your information is stored in the European Economic Area (London region). Some processing may take place on Google servers outside the EEA, under Google’s data-protection terms.

How long we keep it

We keep your information while you are in the programme, plus a period afterwards. Our intended policy is to keep it for 12 months after your Leaving Certificate, and then erase the details that identify you. This retention period is being finalised.

Your rights

You can ask to see a copy of your information, correct it, delete it, or restrict or object to how it is used.

To do any of these, email us at nextstepuniinfo@gmail.com or ask your guidance counsellor. We will respond within one month. These requests are currently handled by our team by hand.

If you are unhappy with how your information is handled, you can complain to the Irish Data Protection Commission at dataprotection.ie.

Changes & contact

We may update this notice. When we do, we will change the version date at the top.

Questions about your privacy: nextstepuniinfo@gmail.com.