Our Policies

Our commitment

The Cipher Academy CIC believes that every child and young person has the right to be safe, respected and listened to. We recognise our responsibility to protect young people from harm and to act on any concern promptly. This policy applies to all directors, staff, volunteers, sessional tutors and contractors.

The framework we follow

• National Guidance for Child Protection in Scotland 2021 (updated 2023)
• Getting It Right For Every Child (GIRFEC), the Scottish Government's approach to children's wellbeing
• The Protection of Vulnerable Groups (Scotland) Act 2007 and the PVG Scheme run by Disclosure Scotland
• The United Nations Convention on the Rights of the Child, as incorporated into Scots law
• Procedures of the Edinburgh Child Protection Committee

Child Protection Lead

Safer recruitment

• Everyone in a role that involves regular work with children must be a member of the PVG Scheme, checked before they start.
• We take up at least two references and hold an interview for every role.
• All adults complete a safeguarding induction before their first session, with refresher training every year.
• New volunteers are supervised by an experienced team member until their induction is complete.

Code of conduct for adults

• Never be alone with a young person out of sight of others. Any one-to-one conversation takes place in an open, visible space.
• No personal contact with young people through private messages, personal phone numbers or personal social media.
• Never give a young person a lift alone, or meet them outside sessions.
• Only take photos on Cipher Academy devices, and only of young people with photo consent.
• Use language and behaviour that is respectful, professional and appropriate to the age of the young person.

Recognising concerns

Harm can be physical, emotional, sexual or neglect, and can also happen online, through exploitation, or through exposure to domestic abuse. Signs may include unexplained injuries, sudden changes in behaviour, a young person seeming withdrawn or frightened, or something a young person tells us directly.

If a young person tells you something

1. Stay calm and listen. Let them speak in their own words.
2. Do not promise to keep it secret. Explain kindly that you must tell someone whose job is to help keep them safe.
3. Do not question or investigate. Only ask open questions needed to understand whether they are safe now.
4. Write it down straight away, using their words, with the date, time and your signature.
5. Tell the Child Protection Lead the same day. If a child is in immediate danger, call 999 first.

What the Child Protection Lead does

The Lead decides whether to make a referral to City of Edinburgh Council Children and Families Social Work (0131 200 2327) or to Police Scotland. If there is any doubt, the Lead will seek advice from social work rather than wait. Parents and carers will normally be informed, unless doing so could place the young person at greater risk.

Concerns about an adult in our organisation

Any concern about the conduct of a director, staff member or volunteer must be reported to the Child Protection Lead. If the concern is about the Lead, report it directly to the chair of the board. The adult concerned will be removed from contact with young people while the matter is looked into. Where we remove someone from work with children because of harmful behaviour, we will make a referral to Disclosure Scotland as the law requires.

Records and confidentiality

Child protection records are kept separately and securely, and shared only with those who need to know to keep a young person safe. Protecting a child always takes priority over confidentiality.

Whistleblowing

Anyone who raises a genuine concern will be supported and will not suffer any negative consequences for doing so.

Last reviewed: October 2026. Next review: October 2027, or sooner if guidance or the law changes.

Small groups help every learner get the attention they need, keep hands-on activities safe and make it easier for adults to notice when a young person needs support.

Minimum adult to learner ratios

These ratios are the minimum number of trained adults for the number of learners. If a group is larger than one adult can supervise at the ratio below, a second adult is present. In addition, at least two adults are present at every session, so no adult is ever alone with a group. In practice, every session is led by our founder alongside a PVG-checked parent director or parent volunteer.

We keep a pool of trained, PVG-checked helpers, so that a session never goes ahead with only one adult. If a second adult cannot be found, the session is rearranged.

Larger sessions

For standard (non-equipment) sessions with three or more adults present, a group may grow to a maximum of 15 learners. Equipment-heavy sessions always keep the maximum group sizes shown above.

Fair allocation of places

Places are offered first to young people who meet our priority criteria (see Equality and Inclusion), and then in order of registration. We will never overfill a group.

Behaviour and additional needs

Where a young person needs extra support, we will talk with them and their parent or carer, and may add an extra adult or suggest a session format that suits them better.

Last reviewed: October 2026. Next review: October 2027.

What we do

• Internet access during sessions is filtered and supervised by an adult at all times.
• We only use platforms and tools that are suitable for the age of the learners, and check their terms and age limits before use.
• Wherever possible, learners use Cipher Academy accounts rather than creating personal ones.
• Session laptops do not store learners' personal files. Work is saved to approved accounts or deleted at the end of each programme.

Using AI tools safely

As an AI academy, we teach young people to use AI thoughtfully. Learners never enter personal information (their own or anyone else's) into AI tools, adults check every AI tool before it is used, and we teach young people to question what AI produces rather than trust it blindly.

Mobile phones

Young people may keep phones with them for safety, but we ask that they stay in bags during activities unless an adult says they are needed for the task.

Last reviewed: October 2026. Next review: October 2027.

• We ask parents and carers for written consent when places are confirmed, with a separate choice for each use: our website, our social media, reports to funders, and local press.
• Young people aged 12 and over are asked for their own agreement too, and their wishes are respected.
• We never publish a young person's full name, school or address alongside their image.
• Photos are taken only on Cipher Academy devices and stored securely.
• Photos are kept for no more than three years, or removed sooner if consent is withdrawn. We remove them from our own website and channels within 10 working days of a request.
• At Family STEM Days, we ask families not to post photos that show other people's children.

Last reviewed: October 2026. Next review: October 2027.

Our risk assessment process

Every activity, whether coding, engineering, AI or practical science, is risk assessed before it runs. We follow the five-step approach recommended by the Health and Safety Executive (HSE):

1. Identify hazards, such as electrical components, hand tools, trip hazards, screen fatigue, allergies and online risks.
2. Decide who might be harmed and how: learners, adults and visiting families.
3. Evaluate the risk as low, medium or high, and decide on controls.
4. Record and put controls in place, for example safety briefings, age-appropriate tools, eye protection for engineering, screen breaks and filtered internet.
5. Review before each programme, after any incident, and whenever new equipment or activities are introduced.

Equipment

Laptops, circuit kits, robotics sensors, power cables, 3D printed parts and hand tools are checked before each programme. Electrical equipment is checked for safety, and damaged items are removed from use immediately.

First aid, medical needs and allergies

• At least one adult with a current first aid qualification is present at every session, and a stocked first aid kit is always available.
• Parents and carers tell us about medical conditions, allergies and emergency contacts when places are confirmed.
• Medication is only given in line with written instructions from a parent or carer.
• All accidents and incidents are recorded, and parents or carers are told the same day.
• Where food is provided, we check allergies first and label ingredients clearly.

Arrival, collection and emergencies

• A parent, carer or authorised adult signs each young person in and out.
• Young people aged 12 and over may leave on their own only with written permission from a parent or carer.
• We will only release a young person to an adult named on their form. If a different adult is collecting, please tell us in advance.
• If a young person is not collected on time, two adults will stay with them while we contact their parent, carer or emergency contacts.
• Every venue has a fire and evacuation plan, which is explained at the start of each programme.

Last reviewed: October 2026. Next review: October 2027.

This handbook sets out how we deliver high-quality, responsive and inclusive learning for young people aged 8 to 18.

1. Programme structure

Stage 1: Orientation and baseline

• Introductions, expectations and agreeing the Club Code
• Ice-breaker activities
• A short, informal skills check
• Safety and safeguarding briefing

Stage 2: Core learning

• Short interactive teaching
• Hands-on practice
• Challenge-based tasks
• Pair and team problem solving

Stage 3: Application

Learners complete a small project, such as a coded game, a maths challenge, a simple machine, an AI model or a family showcase presentation.

Stage 4: Reflection and growth

• A short quiz or mini assessment
• Learner feedback
• Personal development notes and a digital badge

The goal is to build confidence as well as competence.

2. Teaching team

• Sessions are led by trained tutors with STEM expertise.
• All tutors and volunteers are PVG Scheme members and complete our induction (see Child Protection).

3. Learning approach

• Sessions of 60 to 90 minutes
• A mix of screen-based and practical work
• Real-world links to science, engineering and AI
• Inclusive teaching using visual, hands-on, spoken and written methods

4. Behaviour

We model and teach respect, curiosity, collaboration and safe use of equipment. If behaviour becomes a persistent problem, we follow these steps, always explaining what is happening and why:

1. A quiet reminder
2. A cool-down break
3. A conversation with the young person and their parent or carer
4. A review of the support or session type that would suit them best

Bullying of any kind, online or in person, is never accepted. We take every report seriously, support the young person affected, and work with everyone involved to put it right.

5. Attendance

• Attendance is recorded at every session.
• If a young person misses two sessions in a row without letting us know, we will get in touch to check everything is all right.
• Repeated unexplained absences may mean the place is offered to another young person, after a conversation with the family.

Last reviewed: October 2026. Next review: October 2027.

Our teaching is rooted in active learning, problem solving and the belief that every child is capable of excellence in the right environment.

1. Hands-on learning

Coding by building games, maths by solving puzzles, engineering by constructing real objects, and AI by training simple models. This makes STEM memorable and builds confidence.

2. Scaffolding

We start simple, add complexity gradually, and reduce support as learners grow, so no one is left behind.

3. Challenge-based learning

Every session has a clear goal, a problem to solve and a creative outcome, which builds persistence and problem-solving skills.

4. Mixed ability

We use pairing, individual tasks, optional extension challenges, visual aids and real-world analogies, so every learner can move at their own pace.

5. Real-world context

We connect STEM to local community issues, careers in Scotland's digital economy, everyday life and future technologies.

6. Encouraging curiosity

Questions are welcomed and mistakes are valued. We want every learner to leave each session feeling confident, curious and keen to explore more.

Last reviewed: October 2026. Next review: October 2027.

Our commitment

We welcome every young person and will not tolerate discrimination of any kind. We act in line with the Equality Act 2010, and treat everyone fairly regardless of age, disability, sex, gender reassignment, race, religion or belief, sexual orientation, marriage or civil partnership, or pregnancy and maternity.

Priority for places

Because our mission is to widen access to STEM, places are offered first to young people who are:

• living in Pilton and the surrounding area
• from low-income families
• underrepresented in STEM, including girls and young women
• from refugee or minority ethnic backgrounds
• care experienced, or young carers

Additional support needs

• We talk with the young person and their family before they start about what helps them learn and feel comfortable.
• We make reasonable adjustments, such as quiet spaces, visual timetables, adjusted tasks or extra adult support.
• Information about support needs is kept confidential and shared only with the adults working with that young person.

Removing barriers

Our programmes are free. We provide all equipment used in sessions, and will work with families to remove other barriers where we can, such as language or access to the venue. If something would stop your child taking part, please tell us.

Last reviewed: October 2026. Next review: October 2027.

Who we are

The Cipher Academy CIC (company number SC868971), registered in Scotland, is the data controller for the personal information described here. Contact us about your data at info@thecipheracademy.co.uk.

What we collect and why

Who we share it with

• Service providers who help us run the website and communicate with you. Our website forms are handled by Formspree, a service based in the United States. Where information is transferred outside the UK, we rely on the safeguards required by UK data protection law.
• Social work or Police Scotland, only where we have a concern about a young person's safety.
• Funders, only in anonymous form, so that no individual can be identified.

We never sell your information or share it for marketing.

How long we keep it

• Interest registrations: until the end of the programme year they relate to, unless your child takes up a place.
• Enrolment, attendance and medical information: up to three years after your child's last session.
• Photos: up to three years, or until consent is withdrawn.
• Child protection records: for as long as safeguarding guidance requires.

Your rights

You have the right to see the information we hold, to have it corrected or deleted, to restrict or object to how we use it, and to withdraw consent at any time. In Scotland, young people aged 12 and over are generally presumed old enough to exercise these rights themselves. To make a request, email info@thecipheracademy.co.uk. We will respond within one month.

If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Our website

Our website does not use advertising or tracking cookies. Some features store small amounts of information in your own browser only, such as STEM Spotter progress on our Pilton page; this never leaves your device. Our pages load fonts, icons and maps from third-party providers (Google Fonts, cdnjs and OpenStreetMap), which receive your device's IP address in order to deliver them.

Last reviewed: October 2026. Next review: October 2027.

We welcome compliments, suggestions and complaints from parents, carers, young people, volunteers and partners. Young people can raise a concern with any adult they trust at a session.

Important: a concern about a young person's safety is never handled as a complaint. Follow the Child Protection policy straight away.

Stage 1: Talk to us

Speak to the session leader, or email info@thecipheracademy.co.uk. We aim to resolve most issues within five working days.

Stage 2: Formal complaint

If you are not satisfied, put your complaint in writing to the board of directors at the same address. We will acknowledge it within five working days and give you a full written response within 20 working days. If we need longer, we will tell you why.

Stage 3: Review

If you are still unhappy, you can ask for the complaint to be reviewed by a director who has not been involved. Their decision is final within our organisation. Complaints about how we handle personal information can also be taken to the Information Commissioner's Office (see Privacy Notice).

Learning from feedback

Every complaint is recorded and reviewed by the board, so that we can learn and improve.

Last reviewed: October 2026. Next review: October 2027.

How we are run

The Cipher Academy CIC is a Community Interest Company registered in Scotland (SC868971). It is run by a board of directors that includes our founder and parents from the Pilton community whose children are the same age as our learners. As a CIC, our assets and any surplus are used for the benefit of the community we serve, and we report on our community activities each year to the Regulator of Community Interest Companies.

Why this policy matters

Having parents on the board is one of our strengths, because it means local families help shape what we do. It also means a director may sometimes have a personal interest in a decision, for example where their own child is involved. This policy makes sure those situations are handled openly and fairly.

Register of interests

• Every director completes a declaration of interests when they join the board, and updates it whenever their circumstances change.
• Interests include having a child or close relative who attends or applies to our programmes, any business or personal connection with a supplier or partner, and any other role that could affect their judgement.
• The register is reviewed at every board meeting, and is available to funders on request.

Decisions about a director's own child

A director, or any volunteer, takes no part in decisions about their own child or a close relative. This includes:

• offering or allocating places
• behaviour matters and reviews of support
• complaints involving their child
• any safeguarding concern involving their child, which is handled only by the Child Protection Lead and, where needed, the other directors

Places are allocated using the published priority criteria in our Equality and Inclusion policy, so that no child receives an advantage because a parent is a director or volunteer.

Declaring an interest at meetings

1. At the start of each board meeting, directors are asked to declare any interest in the business to be discussed.
2. A director with an interest in an item leaves the discussion and does not vote on it.
3. Declarations, and the director's absence from the item, are recorded in the minutes.

Payments, gifts and suppliers

• Any payment to a director, or to a business connected with a director, must be approved in advance by the other directors and recorded.
• Directors and volunteers do not accept gifts or hospitality that could appear to influence their decisions, other than small tokens of thanks, which are recorded.
• Where we buy goods or services, we seek value for money and avoid any arrangement that could benefit a director personally.

Parent directors and volunteers at sessions

Parent directors and parent volunteers who help at sessions follow the same rules as every other adult: they are PVG Scheme members, complete our safeguarding induction, and treat every young person equally, including their own child.

Last reviewed: October 2026. Next review: October 2027.