GDPR & Data Protection Policy

1. Introduction

Bridgepoint Educare Ltd ("we", "us", "our") is committed to protecting the personal data of the children, young people, families, schools, and professionals we work with. This policy sets out how we collect, use, store, and protect personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Bridgepoint Educare Ltd is the data controller for personal data processed in connection with our services. We are registered with the Information Commissioner's Office (ICO).

2. Data we collect

We may collect and process the following categories of personal data:

• Young people: name, date of birth, school or setting, year group, SEND status, relevant medical or health information, attendance and behaviour records, progress notes, and outcome data
• Parents and carers: name, contact details, and relationship to the young person
• School and professional contacts: name, job title, organisation, and contact details
• Staff and associates: name, contact details, DBS certificate information, qualifications, and employment records
• Website visitors: contact form submissions and enquiry details

We may also process special category data (including health, SEND, and ethnicity information) where this is necessary to deliver our services safely and effectively, and where we have an appropriate lawful basis to do so.

3. Lawful basis for processing

We process personal data on the following lawful bases:

• Contract: where processing is necessary to deliver our services under a contract with a school, local authority, or other commissioning body
• Legitimate interests: where processing is necessary for our legitimate interests in delivering high-quality mentoring and support, provided these are not overridden by the rights of the individual
• Legal obligation: where processing is required to comply with a legal obligation, including safeguarding duties
• Vital interests: where processing is necessary to protect the life of a child or young person
• Consent: where we have obtained explicit consent, for example for photography or the use of case studies in marketing materials

4. How we use personal data

We use personal data to:

• Deliver, monitor, and evaluate our mentoring programmes
• Communicate with schools, local authorities, and commissioning bodies about programme delivery and outcomes
• Fulfil our safeguarding obligations and report concerns to statutory agencies where required
• Manage our staff and associates, including DBS checks and training records
• Respond to enquiries submitted via our website or by email
• Comply with legal and regulatory requirements

5. Data sharing

We will only share personal data where there is a lawful basis to do so. We may share data with:

• Schools, local authorities, multi-academy trusts, and other commissioning bodies involved in the delivery or oversight of our programmes
• Children's social care, the police, or other statutory agencies where required for safeguarding purposes
• Third-party service providers who process data on our behalf (e.g. secure cloud storage), subject to appropriate data processing agreements

We will never sell personal data or share it with third parties for marketing purposes.

6. Data retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our retention periods are as follows:

• Young people's programme records: 7 years from the end of the programme, or until the young person reaches the age of 25 (whichever is later)
• Safeguarding records: retained in line with statutory guidance — indefinitely where a referral was made to statutory agencies
• Staff and associate records: 6 years from the end of employment or engagement
• Website enquiry data: 2 years from the date of enquiry

Data is securely deleted or anonymised at the end of the applicable retention period.

7. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• Secure, password-protected systems with access controls
• Encrypted storage and transmission of sensitive data
• Staff training on data protection and information security
• Regular review of our data security practices

In the event of a personal data breach, we will notify the ICO within 72 hours where required, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

8. Your rights

Under UK GDPR, individuals have the following rights in relation to their personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate or incomplete data
• Right to erasure: to request deletion of your data in certain circumstances
• Right to restriction: to request that we limit how we use your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests
• Rights relating to automated decision-making: we do not use automated decision-making or profiling

To exercise any of these rights, please contact us at the address below. We will respond within one calendar month. You also have the right to lodge a complaint with the ICO at ico.org.uk.

9. Cookies and website data

Our website may use cookies and similar technologies to improve user experience. Where non-essential cookies are used, we will obtain your consent before placing them. You can manage your cookie preferences at any time through your browser settings.

10. Policy review

This policy will be reviewed annually, or sooner in the event of changes to legislation or our data processing activities. The most current version will always be available on our website.