Who we are
Sophyra Limited is the data controller for the personal data described in this notice, apart from the school information described in the next paragraph. We are a private company limited by shares registered in Ireland, company number 817595, with our registered office at First Floor, Penrose 2, Penrose Dock, Cork, T23 YY09, Ireland.
For the school information you enter into The Head’s Companion, including any staff records, training records and governance documents, your school is the data controller and Sophyra Limited acts as a data processor on your instructions. We process that information only to provide the service to your school, and never for our own purposes. The data processing terms that apply to every school account are published on The Head’s Companion website.
Contact us about anything in this notice at privacy@sophyra.ie.
UK representative under Article 27 of the UK GDPR: REP27 LTD (company number 17385889, https://rep27.com), Unit 82a James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom. Data subjects in the United Kingdom may contact the representative at info@gdprrepresentative.com. Appointment verifiable at: https://gdprrepresentative.com/verify.php?code=UK27-CF7F-4D76
This notice covers www.sophyra.ie, The Head’s Companion at www.theheadscompanion.com, and the AI Policy Packs sold there. Education Options, Sophyra Next and Sophyra Tutors operate their own websites, each with its own privacy notice.
This notice is aligned with the EU General Data Protection Regulation and the Irish Data Protection Act 2018, and with the UK GDPR where we process the personal data of individuals in the United Kingdom.
What we collect, why, and on what basis
| What we collect | Why | Legal basis |
|---|---|---|
| Investor enquiry form: your full name, your email address, whether you are enquiring as an individual or on behalf of an organisation, investor type and your introduction; if you enquire on behalf of an organisation, your role, the organisation you represent and its website; and optionally a professional profile or relevant background, your investment interests and typical investment range | To respond to your enquiry, to send you the investor deck where appropriate, and to assess access to the investor data room | Your consent, given by ticking the consent box. You may withdraw it at any time |
| Careers applications: your full name, email address, CV, and your covering letter or the link to your video message, and optionally the part of the group that interests you | To consider you for work with Sophyra Limited and its businesses, and to reply to you | Steps you ask us to take before a possible contract, and our legitimate interests in recruiting the right people (Article 6(1)(b) and (f) of the General Data Protection Regulation) |
| The Head’s Companion account data you provide at sign up: your name, email address, and your school’s name, type, address, country and website | To provide the service to you and your school, including the free trial and any subscription | Contract |
| The information you enter into The Head’s Companion as you use it: obligation statuses and owners, policy and publication records, governance meeting and activity records, uploaded documents, staff names, job roles, work email addresses and their training records, and your readiness self-evaluation | To provide the service to your school, and never for our own purposes | Your school is the data controller for this information, and we process it as a data processor on your school’s instructions, as described under Who we are |
| Billing data when you subscribe to The Head’s Companion: handled by our payment processor, Stripe. We receive confirmation of your subscription status; we do not see or store your full card details | To provide the subscription, and to keep billing records | Contract, and legal obligation for retaining billing records required by tax and accounting statute |
| AI Policy Pack purchases: your name, email address and billing address, and your school’s or organisation’s name where checkout asks for it. Payment is handled by Stripe; we do not see or store your full card details | To send you the pack you have purchased, and to keep billing records | Contract, for fulfilling a product you have purchased, and legal obligation for retaining billing records required by tax and accounting statute |
| Technical data needed to run The Head’s Companion securely: IP address, browser and device type, and authentication session data | To operate the service securely and prevent fraud | Our legitimate interests in operating the service securely and preventing fraud |
| Server access logs for this website, kept by our hosting provider, including IP address, request time and browser type | To keep the site available and secure, and to investigate abuse | Our legitimate interests in operating and protecting the site |
| Aggregate measurement through Vercel Web Analytics: on this website, page views and brand-link clicks; on The Head’s Companion, page views, link clicks and the steps of its sign-up form | To understand which pages are read and which links and forms are used, in aggregate | Our legitimate interests in understanding site use. This measurement sets no cookies and does not identify you |
We do not sell or rent personal data. We do not use the details you give us for unrelated marketing, and we do not share them with any third party for that purpose.
Applying for work with us is voluntary, but we cannot consider an application without a CV. If you send a video link, we open it only to watch your message; the video stays with the service you chose, and you can remove it at any time.
Contacting schools and businesses
We sometimes write to the Head of a school, or to the owner or director of a company, to offer our services. For this we use their name, role, the name of their school or company and their business contact details, taken from the school’s or company’s own website, the Department for Education’s register of schools (Get information about schools), Companies House or another company register, trade press, or LinkedIn.
We use these details only to contact them about our services and to keep a record of what we sent and any reply. The legal basis is our legitimate interests in offering our services to schools and businesses.
The details are held in our email, hosted by Proton in Switzerland, and in the software we use to research and write. That software’s provider processes them in the United States under the European Commission’s standard contractual clauses, and you can ask privacy@sophyra.ie for a copy. Both providers act only on our instructions.
We keep these details for 12 months after our last contact, unless the school or company becomes a client. If someone asks us not to contact them again, we stop and keep only their name and their school or company, so that we do not write to them again.
Anyone can object at any time by replying to our message or by writing to privacy@sophyra.ie. The other rights, and how to complain, are set out below.
Cookies and browser storage
On this website and on The Head’s Companion, Vercel Web Analytics measures site use without cookies. On this website, our advertising measurement does not create advertising cookies, and we use local storage in your browser to remember your ad measurement choice for up to 180 days. This preference record contains your choice, the notice version and its expiry date, not an advertising identifier.
On The Head’s Companion, by default we use only the cookies necessary for the service to function, such as the cookie that keeps you signed in. The one exception is optional advertising measurement, described below, which we use only if you accept it.
Optional ChatGPT ad measurement
On this website
If you allow ad measurement, we can measure a click from our corporate homepage to Education Options, The Head’s Companion, Sophyra Next or Sophyra Tutors during a visit from a ChatGPT ad. The legal basis is your consent. Declining has no effect on access to our website or services.
Our server sends OpenAI the ad-click reference provided in your landing-page address, the selected brand event, its time, a randomly generated event identifier and our homepage address. The ad-click reference allows OpenAI to relate the event to an ad interaction. We do not store that reference in cookies or local storage, and we do not send events when the reference is absent.
After you accept this notice, a link to one of our four brand websites also carries the same ad-click reference. The destination website makes its own advertising-consent check before storing that reference or sending a form-start event. Your consent choice is not transferred between websites. Rejecting here prevents this handoff; you can reject or withdraw separately on each brand website.
This connection does not use OpenAI’s browser pixel or automatic contact matching. It does not read enquiry forms or send names, email addresses, telephone numbers, their hashes, or your IP address and browser details to OpenAI. Each event opts out of future user-level personalisation. Our hosting provider still receives the technical information needed to serve website requests, as described above.
You can withdraw consent or change your choice at any time using in this notice or the website footer. Withdrawal stops future measurement through this connection; it does not undo information already sent. Our integration does not save event payloads in a database. OpenAI processes received conversion information under its Conversion Terms, Ad Tools Data Processing Addendum and applicable privacy information. Those terms govern OpenAI’s processing and retention, separately from the 180-day browser preference.
OpenAI is a separate recipient of this optional measurement information. Its Conversion Terms distinguish independent-controller processing from restricted processing on our behalf. Processing may involve transfers outside the European Economic Area under the safeguards in its Ad Tools Data Processing Addendum. Contact privacy@sophyra.ie with questions or requests concerning this measurement.
On The Head’s Companion
If you arrive from one of our adverts in ChatGPT, we ask whether you accept advertising cookies. If you accept, we tell OpenAI, which runs ChatGPT’s advertising, when you start our free trial sign-up form. We send the advert reference OpenAI added to the link, the name of the event and the time. We do not send your name, email address, anything you type into the form, or your IP address. The advert reference is kept in your browser for the current session only, and your choice is remembered on this browser for up to 180 days. If you reject, or make no choice, nothing is sent. You can withdraw consent at any time using Cookie settings at the foot of any page, and we stop straight away. OpenAI handles this information as an independent controller under its Conversion Terms, except for limited processing it carries out for us as our processor. For visitors in the European Economic Area it is handled by OpenAI Ireland Limited, which uses a valid transfer mechanism for any onward transfer outside the EEA; for visitors in the UK it is handled by OpenAI OpCo, LLC under the UK standard contractual clauses.
How long we keep it
- Investor enquiries. Kept for no longer than 24 months from our last contact with you, then deleted. If a business relationship begins, we keep what that relationship requires, and afterwards for six years to meet Irish company and tax record-keeping obligations.
- Careers applications. Kept for six months from the day we receive them, then deleted, unless you agree that we may keep yours longer to consider you for a future role. If you join us, we keep what that working relationship requires.
- The Head’s Companion. We keep your account and the school data you enter for as long as your account is active. If you close your account, we delete the school data within 30 days, except where we must retain billing records for six years to meet statutory tax and accounting requirements. You can ask us to delete your data sooner, subject to those legal retention obligations.
- AI Policy Pack purchases. Billing records are kept for six years to meet statutory tax and accounting requirements.
- Server logs for this website. Kept for the short period our hosting provider retains them, and not copied elsewhere by us.
Who processes it for us
For this website, we use three service providers, each acting only on our instructions under a data processing agreement:
- Vercel hosts this website and provides the cookieless analytics described above.
- Resend delivers the emails our investor enquiry and careers forms send to us. We do not use it to email you.
- Proton hosts our email. Messages from our investor enquiry and careers forms, with any CV, arrive in our Proton mailbox and are kept there for the periods above.
For The Head’s Companion and the AI Policy Packs, we use a small number of trusted service providers. Each acts as a processor under written terms and applies appropriate technical and organisational measures:
- Supabase provides the database, authentication and document storage, hosted in the European Union (Frankfurt, Germany). Each school’s data is isolated by row-level security so a school can only ever see its own data.
- Stripe processes card payments and issues our invoices under its own terms as our payment processor; Sophyra Limited is the seller.
- Anthropic Ireland, Limited, with processing in the United States by Anthropic, PBC under standard contractual clauses, processes documents you submit to the Companion Assistant to produce its reports, and, where Ask Companion is enabled for your school, the compliance, governance, readiness, training and calendar records it retrieves to answer your question. Ask Companion retrieves only what your own account may already see in the product, it never receives pupil records or safeguarding case material, and staff appear only as the names and training status your school has entered. Both are processed under Anthropic’s Commercial Terms and Data Processing Addendum, with Anthropic as our processor, are not used to train models, and are retained by Anthropic for at most 30 days for safety monitoring.
- Vercel Inc. hosts the application and stores the technical data necessary to serve it.
- Resend Inc. delivers the email we send on our behalf, such as forwarding a message you submit through the report-a-problem form to our support inbox.
Vercel and Resend are established in the United States, so your data may be processed outside the European Economic Area. Both providers’ data processing agreements provide for such transfers on the European Commission’s standard contractual clauses. Proton is established in Switzerland, which the European Commission has recognised as providing adequate protection for personal data. International transfers outside the UK or EEA are made under Standard Contractual Clauses or an equivalent Article 46 safeguard.
The exali liability seal
This website and The Head’s Companion display the exali liability seal, which confirms that Sophyra Limited holds professional indemnity insurance. The seal graphic is loaded from servers operated by exali AG. Because of the technical design of the internet, your IP address is transmitted to exali AG so that the graphic can be delivered to your browser. If you click the seal you leave our site and are taken to exali AG’s servers.
The legal basis is Article 6(1)(f) of the General Data Protection Regulation, legitimate interest. Our legitimate interest is in allowing visitors to verify independently that we hold professional indemnity cover. exali AG is established in Germany, within the European Economic Area, so no transfer outside the EEA arises. Further information is in exali AG’s privacy notice.
Your rights
Under the General Data Protection Regulation, and the UK GDPR where it applies, you have the right to ask us for a copy of the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time where consent is the basis for our use. Withdrawing consent does not affect anything done before you withdrew it.
To exercise any of these rights, or for any other privacy question, write to privacy@sophyra.ie. We aim to respond within ten working days, and in any event within one month.
Complaints
If you are not satisfied with how we have handled your personal data, you have the right to complain to the Irish supervisory authority, the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, at dataprotection.ie. If you are in the UK you may also complain to the Information Commissioner’s Office. We would rather you raised it with us first, so that we can put it right.
Changes to this notice
If we change how we handle personal data we will update this page and the date at the top of it.