Legal
Privacy notice
This notice explains what personal information InclusionFirst Education Ltd collects, why we need it, who we share it with, and what rights you have. It covers information about adults and about children.
The short version
We collect as little as we can. We ask you not to send us detailed information about your child’s health when you first make contact. We do not sell data, we do not advertise, and this website sets no tracking cookies. You can ask us at any time what we hold and to delete it.
1. Who we are
InclusionFirst Education Ltd (“we”, “us”) is the data controller for the information described in this notice. We are a SEND and inclusion consultancy working with families, schools and local authorities.
When we work for a school, trust or local authority and handle information about their pupils on their instructions, they are the controller and we act as their processor under a written data processing agreement. In that situation their own privacy notice governs how the information is used, and this notice describes only our own handling of it.
2. What information we collect
When you enquire
- Your name, email address and, if you give it, your phone number
- Whether you are a parent or carer, a school, or a local authority, and your organisation if you name one
- The topic of your enquiry, any deadline you tell us about, and the brief outline you write in the form
- How you heard about us, if you tell us
Our enquiry form deliberately limits free text to 500 characters and asks you not to include diagnoses, medical or therapy reports, or detailed health information at that stage. This is a data protection measure as much as a practical one: we would rather not hold that information until we know we are working together and can protect it properly.
When we work together
If you become a client we will usually need more, and it will often include information about a child:
- Names, dates of birth, year group and school
- Correspondence with schools and local authorities, including letters, emails and meeting notes
- EHC plans, draft plans, annual review paperwork and assessment reports
- Reports from educational psychologists, therapists and health professionals where they are relevant to the work
- Our own notes, advice and records of meetings we attend
- Billing information — but not card details, which we never see or store
Special category and criminal offence data
Information about a child’s special educational needs, disability, physical or mental health, or diagnoses is special category data under UK GDPR and gets extra protection in law. Some cases also involve information about safeguarding concerns or alleged offences. We only collect this where it is genuinely necessary for the work you have asked us to do, and we work from anonymised or pseudonymised information wherever the task allows it — for example when reviewing a school’s paperwork or delivering training.
Website use
This website sets no analytics, advertising or tracking cookies. We do not profile visitors and we do not use third-party trackers or embedded social media widgets. Our hosting provider keeps standard server logs, which may include IP addresses, for security and reliability purposes. See section 9 on cookies.
3. Where we get it from
- Directly from you
- From a school, trust or local authority who has engaged us, acting on their instructions
- From documents you choose to share with us, such as plans and reports
- Occasionally from other professionals, where you have asked us to liaise with them
4. Why we use it, and our lawful basis
| What we do | Lawful basis (Article 6) | Condition for special category data (Article 9) |
|---|---|---|
| Respond to your enquiry and arrange an introductory call | Legitimate interests — replying to someone who has contacted us asking for help | Not normally applicable; we ask you not to send this at enquiry stage |
| Provide the advice, advocacy or consultancy you have engaged us for | Performance of a contract with you | Your explicit consent (Article 9(2)(a)) |
| Support you with an appeal, mediation or formal disagreement | Performance of a contract with you | Establishment, exercise or defence of legal claims (Article 9(2)(f)), and/or your explicit consent |
| Deliver services to a school or local authority under contract | Performance of a contract, or legitimate interests | Handled as processor on the controller’s instructions and lawful basis |
| Keep accounting records and meet tax obligations | Legal obligation | Not applicable |
| Report a safeguarding concern | Legal obligation, or vital interests where a child is at risk | Safeguarding of children and individuals at risk (DPA 2018, Schedule 1, Part 2) |
| Handle a complaint, insurance matter or legal claim | Legitimate interests, or legal obligation | Establishment, exercise or defence of legal claims (Article 9(2)(f)) |
Where we rely on your explicit consent to handle special category data, you can withdraw it at any time by telling us. That will not affect anything we did lawfully beforehand, but it may mean we can no longer continue the work.
Where we rely on legitimate interests, we have considered whether our interest is fair to you and whether you would reasonably expect it. You can object — see section 8.
We do not use your information for automated decision-making or profiling, and we do not use it to train artificial intelligence systems.
5. Children’s information
Most of our work concerns children, and we handle their information with that in mind:
- We normally take instructions from a parent or person with parental responsibility, or from a young person aged 16 or over acting for themselves
- We involve the child or young person’s own views where that is appropriate and they want to be involved
- We only collect what the specific piece of work requires, and we do not keep “background” information because it might one day be useful
- Where a young person has capacity to make their own decisions about their information, their rights are theirs to exercise
6. Who we share it with
We never sell personal data and we do not share it for marketing. We share it only where it is necessary:
- With your agreement — schools, local authorities, mediators, tribunals, solicitors or health professionals, where you have asked us to correspond or advocate on your behalf
- Where the law requires it — including a safeguarding referral to children’s social care or the police. We would normally tell you we were doing this, unless telling you would put a child at risk
- Our service providers — the suppliers listed below, who process data on our instructions under contract
- Our professional advisers — accountants, insurers or legal advisers, where genuinely necessary
Our service providers
| Provider | What for | Where |
|---|---|---|
| Netlify, Inc. | Website hosting and server logs | US |
| Formspree, Inc. | Receiving and forwarding enquiry form submissions | US |
| Google Ireland Limited (Google Workspace) | Email and calendar | EU/US |
| Google Ireland Limited (Google Drive) | Secure document storage and sharing | EU/US |
| Google Ireland Limited (Google Calendar) | Booking introductory calls | EU/US |
| Not applicable | Accounts and bookkeeping are managed manually; no accounting software processes client data | — |
7. How long we keep it
| Information | Kept for |
|---|---|
| Enquiries that do not become work | 12 months from last contact, then deleted |
| Client files, including case papers about a child | 6 years from the end of the engagement, then deleted — this reflects the limitation period for claims. Where the client is a child, 6 years from their 18th birthday |
| Safeguarding records | In line with statutory guidance and the receiving authority’s requirements |
| Accounting and tax records | 6 years plus the current financial year, as HMRC requires |
| Data we hold as a processor for a school or local authority | As instructed by them, and deleted or returned at the end of the contract |
8. Your rights
Under UK data protection law you have the right to:
- Be told how your information is used — this notice
- Ask for a copy of the information we hold about you (a subject access request)
- Have inaccurate information corrected
- Ask us to delete information, where there is no good reason for us to keep it
- Ask us to restrict how we use it while a concern is resolved
- Object to us using it where we rely on legitimate interests
- Ask us to transfer it to you or another provider, where it is held electronically and we rely on consent or contract
- Withdraw consent at any time, where consent is what we relied on
To exercise any of these, contact Georgia Morris-Boyce using the details in section 1. We will respond within one month. There is no charge. We may need to confirm your identity, and where a request concerns a child we will consider whether the child is old enough to make it themselves.
9. Cookies
This website does not set cookies for analytics, advertising or tracking, and there is no cookie banner because there is nothing to consent to. If we later add anything that does set non-essential cookies, we will ask for your consent first and update this notice.
Booking an introductory call through our scheduling provider takes you to their website, which has its own cookies and privacy notice.
10. Security
Our practical measures include:
- Multi-factor authentication on email, storage and business accounts
- Encrypted devices, with full-disk encryption and automatic locking
- Secure document sharing rather than sending sensitive attachments by email
- Access limited to what is needed for the specific piece of work
- Working from anonymised or pseudonymised information wherever possible
- Routine deletion at the end of each retention period rather than keeping things indefinitely
No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms we will tell you, and we will report it to the Information Commissioner’s Office within 72 hours where the law requires it.
11. Transfers outside the UK
We aim to use providers that store data in the UK or European Economic Area. Where a provider transfers data elsewhere, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, with additional safeguards where needed. You can ask us which providers this applies to.
12. Complaints
Please tell us first if you are unhappy — we would rather fix it. Contact Georgia Morris using the details in section 1.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator, at any time. Visit ico.org.uk or call their helpline on 0303 123 1113. Complaining to us first does not affect that right.
13. Changes to this notice
We review this notice at least annually and whenever our services change. The version number and date are at the top. Where a change materially affects you and we hold your contact details, we will tell you.