Child Protection and Safeguarding Policy

1. POLICY STATEMENT

Scrubbing Squad Limited is a digital children's platform registered in England and Wales, currently in pre-launch development. Our products are designed for children aged 4 to 11. On launch, the platform is intended to operate in households, schools, and community settings across the United Kingdom and internationally. This policy sets out the safeguarding and data protection standards we commit to applying from launch.

This policy sets out our legal obligations, our commitments to children and their families, and the procedures that every person associated with Scrubbing Squad Limited must follow. It applies without exception. It is reviewed annually.

The guiding principle of this policy, and of every decision we make, is this: the best interests of the child come first.

Our Commitment in Plain Language

• Every child who interacts with our platform is entitled to be safe from harm.
• Every person who works with or for Scrubbing Squad Limited has a responsibility for that safety.
• We will act on any concern about a child's welfare promptly, professionally, and in the child's best interests.
• We will never allow the reputation of the company, commercial considerations, or internal relationships to override the safety of a child.
• We will be transparent with families, regulators, and the public about how we protect children.

2. SCOPE AND APPLICATION

Who This Policy Applies To

This policy applies to:

• All employees of Scrubbing Squad Limited, whether permanent, fixed-term, or part-time.
• All contractors, freelancers, and consultants engaged by Scrubbing Squad Limited.
• All advisors, board members, and officers of Scrubbing Squad Limited.
• All partner organisations accessing our platform, content, or data under a formal agreement.
• All volunteers operating under the Scrubbing Squad Limited name or brand.

Acceptance of this policy is a condition of engagement for all of the above. There are no exceptions.

What This Policy Covers

This policy covers:

• Child protection and safeguarding responsibilities in our digital platform.
• Data protection and privacy as it applies to children.
• Safe recruitment and vetting of all staff and contractors.
• Code of conduct for all interactions with or in relation to children.
• Reporting and responding to safeguarding concerns.
• Online safety by design (including Ace Mode accessibility).
• Institutional (school and partner) safeguarding obligations.

Children Covered by This Policy

For the purposes of this policy, a child is any person under the age of 18, as defined by the Children Act 1989 (England and Wales). Our platform primarily serves children aged 4 to 11. Our safeguarding obligations apply to all children under 18 who may access our platform or services in any capacity.

3. LEGAL AND REGULATORY FRAMEWORK

This policy is grounded in and compliant with the following legislative and regulatory frameworks. Where local law in other jurisdictions where we operate is more stringent, we apply that stricter standard.

United Kingdom (Primary Jurisdiction)

1. Children Act 1989 and Children Act 2004
2. Working Together to Safeguard Children (HM Government, 2026 edition)
3. Keeping Children Safe in Education 2025 (for institutional B2B partnerships with schools)
4. The Equality Act 2010 (including reasonable adjustments for SEND)
5. SEND Code of Practice 2015
6. UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025
7. Privacy and Electronic Communications Regulations (PECR)
8. ICO Children's Code (Age-Appropriate Design Code)
9. Online Safety Act 2023

United States (Secondary Jurisdiction)

10. Children's Online Privacy Protection Act (COPPA)
11. Family Educational Rights and Privacy Act (FERPA) -- applicable to our B2B education partnerships

International Standards

12. UN Convention on the Rights of the Child (UNCRC), Articles 3, 12, and 19
13. International Child Safeguarding Standards (Keeping Children Safe coalition)

4. ROLES AND RESPONSIBILITIES

Designated Safeguarding Lead (DSL)

Scrubbing Squad Limited has appointed MJ Midgley as Designated Safeguarding Lead (DSL), who holds responsibility for safeguarding at an operational level. The DSL is the named contact for all safeguarding concerns, both internal and external, and can be contacted at compliance@scrubbingsquad.com.

The DSL is responsible for:

• Receiving and assessing all safeguarding concerns raised within the organisation.
• Deciding on the appropriate course of action in response to concerns, including referral to statutory agencies where required.
• Maintaining a confidential record of all concerns and actions taken.
• Liaising with local authorities, police, and other statutory agencies where necessary.
• Ensuring all staff and contractors receive appropriate safeguarding training.
• Reviewing and updating this policy annually.
• Acting as the point of contact with the Information Commissioner's Office (ICO) on child data protection matters.

Board of Directors

The Board of Directors holds ultimate accountability for safeguarding within Scrubbing Squad Limited. At least one Director is designated with board-level safeguarding responsibility. The Board reviews this policy annually and receives a safeguarding update at each board meeting.

All Staff and Contractors

Every person working with or for Scrubbing Squad Limited has a personal and professional responsibility for child safeguarding. This responsibility cannot be delegated.

All staff and contractors are required to:

• Read, understand, and operate in accordance with this policy as a condition of engagement.
• Complete safeguarding training appropriate to their role before beginning work that involves child data, content, or platform access.
• Report any concern about a child's safety or welfare to the DSL immediately.
• Report any concern about the conduct of a colleague or partner to the DSL immediately.
• Never investigate a concern themselves -- report it to the DSL and allow proper procedures to be followed.
• Maintain confidentiality in all safeguarding matters, except where disclosure is required by law or for the protection of a child.

5. CHILD DATA PROTECTION AND PRIVACY

Data We Collect

We collect the following categories of data about children:

1. 14. Mission progress and habit completion records (necessary for platform function).
2. 15. Accessibility settings and neurodevelopmental profile configuration (where set by a parent or guardian).
3. 16. Platform usage data (anonymised and aggregated -- not linked to individual children's identities for reporting purposes).

We do not collect: biometric data, precise location data, persistent device identifiers, behavioural advertising profiles, or any data beyond what is strictly necessary for platform function.

How We Store and Protect Child Data

Child data within the Scrubbing Squad platform is stored using a data sovereignty architecture that gives families primary control over their child's data. This means:

• The parent or guardian holds the primary right to access, correct, and delete their child's data at any time.
• Data is encrypted in transit and at rest.
• Data is not stored on third-party advertising infrastructure.
• Access controls are enforced at architecture level, not by policy instruction alone.
• Sensitive data (including EHCP profile information in the B2B institutional platform) is subject to additional access restrictions.
• Neurodevelopmental and accessibility profile data (including any EHCP or IEP information, and any profile marked as neurodiverse) is special category data under UK GDPR. We process it only with the explicit consent of the parent or guardian, given specifically for that purpose, and solely to adapt the platform to the child's needs. It is never used for profiling for commercial or advertising purposes. Consent can be withdrawn at any time, and the relevant adaptation will be disabled.

Who Can Access Child Data

Individual child data may be accessed only by:

4. 17. The child's parent or guardian (full access, at all times).
5. 18. Scrubbing Squad Limited staff under documented operational need, subject to minimum-access principles.
6. 19. School or institutional users -- only anonymised aggregate data, unless the parent has granted explicit individual access in writing.

No third-party advertiser, data broker, or commercial partner accesses individual child data. Partner organisations (B2B) receive only anonymised, aggregated impact data.

Parent and Guardian Rights Under UK GDPR

Under UK GDPR and the Data (Use and Access) Act 2025, parents and guardians have the right to:

• Access their child's data held by Scrubbing Squad Limited.
• Request correction of inaccurate data.
• Request deletion of their child's data ('right to erasure'), subject to any legal or safeguarding retention obligations that require us to keep certain records.
• Object to any processing of their child's data.
• Withdraw consent for data processing at any time.

To exercise any of these rights, contact: MJ Midgley at compliance@scrubbingsquad.com

Children's Code Compliance

Scrubbing Squad Limited designs its platform in compliance with the UK ICO Age-Appropriate Design Code (Children's Code). Our platform applies the following standards as defaults:

• Privacy settings are set to high by default. Children are never asked to lower privacy settings to access the platform.
• Profiling for advertising or commercial targeting is not permitted on any part of the platform accessible to children.
• Nudge techniques that encourage children to share more personal data than necessary are not used.
• Geolocation data is not shared or collected without explicit parental consent, and is switched off by default.

6. SAFE RECRUITMENT AND VETTING

Scrubbing Squad Limited requires all staff and contractors whose work involves access to child data, child content, or direct interaction with children to undergo appropriate vetting before beginning that work.

UK Staff and Contractors

1. 20. All staff and contractors in roles involving access to child data or content must undergo an Enhanced Disclosure and Barring Service (DBS) check before commencing work.
2. 21. Roles involving unsupervised contact with children, or management of child data, are treated as Regulated Activity and require an enhanced DBS check with barred list check.
3. 22. DBS certificates are reviewed at appointment and at intervals determined by the DSL. Staff are encouraged to use the DBS Update Service.
4. 23. All job descriptions and engagement contracts include an explicit safeguarding commitment clause.
5. 24. Interviews for all roles include values-based questions to assess safeguarding awareness and commitment.
6. 25. A probationary period applies to all new staff, during which safeguarding suitability is assessed.
7. 26. References are required from all previous employers where the applicant has worked with children.

International Contractors

For contractors based outside the United Kingdom, equivalent background checks appropriate to their jurisdiction are required. Where an equivalent check is not available, additional safeguarding measures including supervised access, restricted data permissions, and enhanced reference checking will be applied.

7. CODE OF CONDUCT

The following standards apply to all staff, contractors, advisors, and partners of Scrubbing Squad Limited in relation to children and the data, content, and systems associated with them.

Interactions With or About Children

1. 27. All interactions with children, whether in person, via the platform, or in content, must be appropriate, respectful, and in the child's best interests.
2. 28. No member of staff or contractor will communicate directly with a child outside of the platform's monitored communication channels.
3. 29. No member of staff or contractor will photograph, film, or record a child without the explicit written consent of their parent or guardian.
4. 30. No content involving a child will be shared publicly without the explicit written consent of their parent or guardian.
5. 31. One-to-one situations between an adult and a child outside the platform are not permitted. All supervised interactions are preferred.

Digital and Platform Conduct

6. 32. Staff and contractors will not access child data beyond what is required for their documented operational function.
7. 33. Staff and contractors will not download, copy, or transfer child data to personal devices or accounts.
8. 34. Staff and contractors will not share access credentials to systems holding child data.
9. 35. Any breach of data security that may affect child data must be reported to the DSL immediately and within no more than 2 hours of discovery. This internal escalation deadline is separate from, and does not replace, our statutory duty to notify the Information Commissioner's Office within 72 hours of becoming aware of a notifiable personal data breach.

‍

Social Media and Public Communications

10. 36. Staff and contractors will not identify individual children in any public communication, including social media.
11. 37. Staff and contractors will not make any statement about child welfare, safeguarding, or child data on behalf of the company without prior authorisation from the DSL or a Director.

8. ONLINE SAFETY BY DESIGN

Scrubbing Squad Limited operates a safety-by-design principle. Child safety is not addressed through content moderation alone. It is built into the architecture, the content design, the data model, and the accessibility engine of the platform.

Ace Mode: Neuro-Inclusive Accessibility

The platform is designed to include Ace Mode, a neuro-inclusive accessibility engine for children with sensory processing differences, autism spectrum conditions, ADHD, and other neurodivergent profiles. Ace Mode is not intended to be a simplified version of the platform. It is designed as a full-platform sensory environment adaptation that will activate automatically or via parent toggle. The features described in this section represent our committed design standard for Ace Mode and are not yet live.

The core design principle of Ace Mode is that autism spectrum conditions and ADHD require opposite sensory interventions. The platform is designed to serve both profiles without conflating them. When the ASD/Sensitive profile is active, it functions as a Global UI/UX Override: the platform is programmatically prohibited from displaying any element of the high-stimulation profile. This override has no exceptions.

Ace Mode activation occurs via: manual parent or guardian toggle; automatic activation when an EHCP or IEP profile indicates sensory sensitivities; automatic activation when a child profile is marked as neurodiverse during setup; and automatic detection through Sensory Audit threshold monitoring. Automatic detection operates solely in the best interests of the child, to adapt the sensory environment to their needs. It is not used to build a commercial or advertising profile, and is explainable to parents and guardians on request.

‍

COPPA-Compliant Data Architecture

The platform's data architecture is designed to comply with the Children's Online Privacy Protection Act (COPPA) for US-based families. All families, regardless of location, benefit from the same child data protections.

No Advertising

Scrubbing Squad's platform contains no third-party advertising. No advertising network has access to any part of the platform or its data. The platform is funded by subscriptions and B2B partnerships. Child attention is not monetised.

Content Safeguards

• All mission content is age-gated and reviewed against the developmental stage of the target age group (4 to 6 or 7 to 11) before publication.
• The platform does not include open user-generated content or unmoderated communication between children.
• Character content and mission scripts are reviewed against child protection guidelines before publication.
• Parent/guardian controls allow full oversight of the child's mission progress and platform activity.

9. REPORTING AND RESPONDING TO SAFEGUARDING CONCERNS

How to Report a Concern

Anyone with a concern about a child's safety or welfare in connection with Scrubbing Squad Limited - whether they are a member of staff, a contractor, an advisor, a parent, or a member of the public - should contact:

Reports should be made in writing wherever possible. Verbal reports should be followed up in writing within 24 hours.

The DSL can be contacted at any time. In an emergency where a child is in immediate danger, contact the emergency services (999) first, then notify the DSL.

What Happens After a Report

1. 38. The DSL will acknowledge receipt of the concern within 24 hours.
2. 39. The DSL will assess the concern and decide on the appropriate course of action. This may include seeking advice from the NSPCC helpline, contacting the relevant local authority children's social care team, or referring the matter to the police.
3. 40. All concerns and actions taken are recorded confidentially and retained in accordance with our data retention policy.
4. 41. The person who raised the concern will be informed of the outcome where appropriate and where doing so would not compromise the safety of the child.
5. 42. The child and their family will receive appropriate support throughout the process.

Confidentiality

All safeguarding concerns are treated as confidential. Information is shared only on a need-to-know basis, and only where sharing is necessary for the protection of a child. Confidentiality cannot be guaranteed where disclosure is required by law, where withholding information would put a child at risk, or where a referral to statutory agencies is required.

No member of staff or contractor will promise confidentiality to a child or adult who discloses a safeguarding concern.

Allegations Against Staff or Contractors

Any concern or allegation about the conduct of a member of staff, contractor, or partner of Scrubbing Squad Limited must be reported to the DSL immediately. Where the allegation is against the DSL, it must be reported directly to a Director.

Allegations will be dealt with under the company's disciplinary procedures and, where appropriate, referred to statutory agencies. The accused individual will be suspended from contact with child data and content pending investigation, without prejudice.

10. INTERNATIONAL SCOPE

Scrubbing Squad Limited is registered in England and Wales. Our primary legal obligations are under the laws of England and Wales. However, our platform serves families in multiple jurisdictions internationally.

Operating Principle

Where the laws of another jurisdiction in which we operate impose a higher safeguarding or child data protection standard than that required by English law, we apply the higher standard. We do not minimise our obligations to fit a lower regulatory floor.

US Families

For families in the United States, our data architecture is aligned to COPPA requirements. US families have the same data rights and protections as UK families. Where FERPA applies to our institutional (school) partnerships in the United States, we comply with FERPA requirements.

International Staff and Partners

All international staff and partners are required to adhere to this policy in full, and additionally to comply with any stricter safeguarding requirements applicable in their local jurisdiction.

11.POLICY REVIEW AND UPDATES

This policy is reviewed annually by the Designated Safeguarding Lead and approved by the Board of Directors. It will be reviewed earlier if:

• There is a change in relevant legislation or statutory guidance.
• A safeguarding incident occurs that requires the policy to be updated.
• Significant changes are made to the platform, its data architecture, or its operational scope.
• A regulatory inspection identifies required changes.

‍

The current version of this policy is always the version published at scrubbingsquad.com/child-protection-policy. Previous versions are retained in the company's governance records.