Pekanga is a career intelligence platform that helps secondary school students explore career pathways based on their subject choices. It is also used by school staff and independent careers advisers who support students. The platform is operated by Pekanga Ltd, registered in England and Wales.
| Company name | Pekanga Ltd |
| Registered in | England and Wales, company number 17216579 |
| Registered office | 66 Paul Street, London EC2A 4NA |
| Contact email | hello@pekanga.co.uk |
| ICO registration | ZC172552 |
Depending on how you use Pekanga, we may collect and store:
Voice recording during a session is only used by staff and advisers, and only when they choose to start it. Audio is converted to text as it is spoken and is not kept as an audio file. Students can also use the microphone button in the chat to dictate a message. That short recording is sent to our speech-to-text provider (see section 5), turned into text, and not kept by Pekanga.
We do not ask for payment details from students. We do not collect more than we need, and we will update this notice before we collect anything new.
We use your information to provide the platform: to generate careers information for you, to let your school or adviser support you, to keep your account secure, to help keep students safe, and to fix problems and improve the service. We do not use your information for advertising or marketing, we do not sell it, and we do not use it to train AI models.
Because the platform includes a safeguarding feature, what students type into the chat and other free-text boxes, and the comments parents write, are checked against a list of words and phrases that may indicate a child is at risk. If something matches, the match is saved and shown in the school's safeguarding dashboard, where the school's staff can review it. This is a supplementary aid, not real-time monitoring: nobody at Pekanga reads messages as they are written, and the school remains responsible for safeguarding its students.
Once a school has named a safeguarding contact, a match is also emailed to that contact. The email gives the school, the time and the matched word, with a link to the dashboard, and does not include the text that was flagged.
School sign-in is protected by limits on repeated wrong attempts: after five wrong tries the account is locked for 15 minutes, and school staff can unlock a student sooner.
Where Pekanga is used through a school, the school is the data controller for its students' information. Pekanga acts as a data processor and processes the information only on the school's instructions, under a Data Processing Agreement. The school holds the lawful basis for its students' use of the platform. The same applies where an independent adviser uses Pekanga with their own clients: the adviser is the controller and Pekanga is the processor. A Data Processing Agreement for schools is available on request from hello@pekanga.co.uk.
For the limited information Pekanga decides how to use itself, such as anonymous usage measurement, security logs and adviser or staff account administration, our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): operating, securing and improving the platform. Where we have a legal obligation, such as responding to a lawful request, that is our basis.
We do not sell your data. We do not share your data with employers, universities, or advertisers.
We use a small number of service providers (sub-processors) to run Pekanga. They may only process data to provide their service to us, and each is bound by a contract.
| Provider | What they do |
|---|---|
| Supabase (Ireland, EEA) | Database, sign-in and file storage. Student and school data is stored in a Supabase database in Ireland (EEA) |
| Vercel (USA functions) | Serves the School web app to your browser. Vercel's serverless functions run in the USA, but School student data goes directly from the browser to Supabase and does not pass through them |
| Anthropic (USA) | AI that generates careers information, summaries and translations, under the EU Standard Contractual Clauses with the UK Addendum. What we send is not used to train its models, and is kept for a limited period, then deleted |
| OpenAI (USA) | Speech-to-text for student voice notes in the chat. Pekanga does not keep the audio or the transcript beyond the message the student sends. According to OpenAI's published API data controls, the audio transcription service is not subject to abuse-monitoring retention and does not store the audio or the transcript as application data. Data sent to the OpenAI API is not used to train its models |
| Speechmatics (EU) | Converts speech to text during live recorded sessions. Live session audio goes from the browser straight to Speechmatics' EU endpoint and is not stored |
| Resend (USA) | Sends staff emails (invitations, password resets and safeguarding alerts) and other emails such as reports sent to clients, under the EU Standard Contractual Clauses with the UK Addendum |
| Stripe (payments only) | Takes subscription payments from schools and advisers. Does not receive student information |
We also share information with your school or adviser, because they are responsible for it, and where the law requires us to.
Transfers outside the UK. Most of your information is stored in Ireland (the EEA), not the UK. Three of our providers process data in the USA: Anthropic (AI), OpenAI (speech-to-text for voice notes) and Resend (email). Vercel's serverless functions also run in the USA, but School student data does not pass through them. For the transfers to the three providers we rely on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, so your information keeps a level of protection equivalent to UK law. Our Data Processing Agreement page sets out each provider and its safeguard in more detail.
| Type of data | Retention period |
|---|---|
| Client and student records, reports and notes | For as long as the school's or adviser's agreement is active. School staff can delete a student's record from the dashboard, and Pekanga will delete records on request. When the agreement ends, they have 60 days to ask for the data to be returned or deleted, and we complete that within 30 days of the request. Deletion is carried out by Pekanga on request, not automatically Deleting a student also deletes their uploaded evidence files. |
| Session transcripts and action plans | Held with the client's record on the same terms. Audio is never stored, only the resulting text |
| Usage records | Kept for as long as the school's agreement is active, and deleted when the school's data is deleted at the end of it. They are not deleted automatically When a student's record is deleted, their name is removed from these records. |
| Expired sign-in sessions | Cleared automatically every day |
| Technical logs | Kept by our hosting providers (Supabase and Vercel) for the short periods set by their own services, then deleted by them. We do not copy them elsewhere |
Our AI provider keeps the content we send it only for a limited period under its data processing terms, and then deletes it. It does not use that content to train its models. We may keep information that has been genuinely anonymised, so that no individual can be identified, for statistics and to improve the service.
We use as few cookies as possible. We use essential cookies and similar browser storage that the platform needs to work, for example to keep you signed in and to remember your language choice. These do not track you across other sites.
If we introduce analytics cookies in future, we will ask your permission first through a consent banner before placing them.
Pekanga uses AI to generate personalised career pathway information, summaries and translations from the information you or your adviser provide. This is a functional process: it generates information to help you, not a profile of you as a person.
Under UK data protection law, you have the following rights over your personal data. If you use Pekanga through a school or adviser, they are the controller, so the quickest route is usually to ask them, and we will help them respond.
To exercise any of these rights, email us at hello@pekanga.co.uk. We will respond within one calendar month.
Pekanga is designed for students aged 13 and over (Year 9 upwards), and is used through a school. It may be used with children under 13 only where the school has agreed this in writing with Pekanga. We take the protection of children's data seriously and follow the ICO Age Appropriate Design Code (Children's Code).
The platform does not check anyone's age. The school is responsible for deciding who it gives access to, and for making sure the students who use Pekanga are of an appropriate age.
If you have any questions about this Privacy Notice or how we handle your data, contact us at hello@pekanga.co.uk.
If you are unhappy with how we have handled your data and we have not been able to resolve your concern, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.