How The Arena Hub Ltd collects, uses, and protects your information.
The Arena Hub Ltd ("Arena Hub", "we", "us") is a company registered in England and Wales. We provide Arena Lite, a cloud-based evidence management platform designed for Alternative Provision and SEMH education practitioners. Our contact address for all data-related matters is hello@thearenahub.co.uk.
Under UK GDPR, the legal roles are important to understand clearly:
Student data — including observations, evidence records, and safeguarding logs — is processed and stored exclusively within the subscribing school's own Google Workspace account. Arena Hub never accesses, stores, or processes student personally identifiable information (PII) on our own systems.
When you subscribe to or use Arena Lite, we collect and hold the following information about you as the subscribing practitioner or school:
Account data: Your email address, your full name (practitioner name), and your school or organisation name. This is provided by you during the subscription checkout process.
Licence data: Your unique Arena Lite licence key, subscription plan (monthly or annual), subscription start date, and subscription status.
Payment data: Payment processing is handled entirely by Stripe, Inc. We do not store payment card numbers or full payment details on our systems. Stripe retains payment data in accordance with their own privacy policy and PCI DSS obligations.
We do not collect, access, or store any student data. Student records, evidence commits, safeguarding logs, and all related pedagogical data exist solely within your Google Workspace environment.
We use your account data for the following purposes only:
Licence validation: To verify that you hold a valid, active Arena Lite subscription when you activate or use the platform. Your email address is the primary identifier for this check.
Account management: To manage your subscription, process renewals, and handle requests to change or cancel your account.
Product and service communications: To notify you of important updates to the platform, changes to these terms, or critical security notices. We do not send marketing emails without your explicit opt-in consent.
We rely on the following lawful bases under UK GDPR Article 6:
Contract (Article 6(1)(b)): Processing your account and licence data is necessary to perform the subscription contract you have entered into with us.
Legitimate interests (Article 6(1)(f)): We have a legitimate interest in maintaining the security and integrity of our platform, preventing fraudulent licence use, and communicating critical service information to active subscribers.
Your account and licence data is stored on Google Cloud infrastructure within the European Union (EU) region. We use Google Cloud services for backend processing and storage of account data.
Payment transaction data is stored by Stripe, Inc., subject to Stripe's privacy policy and data residency commitments. Stripe is certified under the EU-US Data Privacy Framework and complies with GDPR requirements for international data transfers.
We do not use any other third-party data processors for your account data. There are no analytics trackers, advertising networks, or external marketing databases involved in the operation of Arena Lite.
This is the most important data protection principle underpinning Arena Lite. All student data — every evidence record, every observation note, every safeguarding entry — is written directly to a Google Spreadsheet within your school's own Google Workspace account (your Google Drive). This data is governed by your school's Google Workspace terms of service and your school's own data protection policies.
Arena Hub's Cloud Run functions act as a transient processing layer: they receive a request, write data to your Drive, and return a response. No student data is retained by Arena Hub at rest. We act as a Data Processor under UK GDPR Article 28 in relation to any student data that transiently passes through our processing layer, and a formal Data Processing Agreement (DPA) is available upon request.
We retain your account data (email, name, school name, licence record) for the duration of your active subscription. Following cancellation or expiry, account data is retained for a maximum of 30 days for the purpose of subscription recovery or query resolution, after which it is deleted from our systems. You may request earlier deletion by contacting hello@thearenahub.co.uk.
Student data held within your Google Workspace is entirely your responsibility as Data Controller. Arena Hub has no role in its retention or deletion.
As a data subject, you have the following rights in relation to the personal data we hold about you:
Right of access: You may request a copy of the personal data we hold about you.
Right to rectification: You may ask us to correct inaccurate data.
Right to erasure: You may ask us to delete your account data, subject to any legal obligations to retain it.
Right to data portability: You may request your account data in a structured, machine-readable format.
Right to object: You may object to processing based on legitimate interests.
To exercise any of these rights, please contact us at hello@thearenahub.co.uk. We will respond within 30 days. If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
The Arena Lite platform uses session cookies solely to maintain your authenticated state during a Google OAuth login session. These cookies are essential for the platform to function and are not used for tracking, advertising, or analytics purposes.
Our public marketing website (thearenahub.co.uk) does not use any tracking cookies, analytics cookies, or third-party advertising cookies. No cookie consent banner is required because we do not deploy non-essential cookies.
We may update this Privacy Policy from time to time. Where changes are material, we will notify active subscribers by email before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.
All data protection enquiries should be directed to:
The Arena Hub Ltd
Email: hello@thearenahub.co.uk