Appropriate Policy Document
Special category and criminal offence data at The Haven
| Controller | Autistic Girls Network (registered charity 1196655 in England and Wales and SC054837 in Scotland), which operates The Haven. ICO registration ZB867479. |
| Required by | Data Protection Act 2018, Schedule 1, Part 4 (paragraphs 38 to 41) |
| Scope | All special category and criminal offence data processed by The Haven about learners, parents and carers, staff, volunteers and contractors |
| Owner | Data Protection Officer, dpo@thehavenonline.co.uk |
| Kept | For as long as the processing continues, and for at least 6 months after it ends |
| Available | Published on The Haven’s policy site; also from the DPO on request, and to the Information Commissioner’s Office on request |
1. Purpose
The UK GDPR allows special category data (Article 9) and criminal offence data (Article 10) to be processed only where a further condition applies. Several of the conditions The Haven relies on are in Schedule 1 of the Data Protection Act 2018, and these require an Appropriate Policy Document. This document sets out:
- the conditions The Haven relies on, and for which data;
- how The Haven meets the data protection principles for this data;
- how long the data is kept and how it is deleted.
It sits alongside the Data Protection Policy, the Privacy Notices, the Data Retention Policy and the DPIA.
2. The data covered
| Category | Whose | Examples | Where held |
|---|---|---|---|
| Health, including mental health | Learners | Medical conditions, medication, allergies, mental health and wellbeing information, individual healthcare plans | TutorCruncher (restricted fields); Google Workspace (restricted drives) |
| Disability and SEND (treated as health data) | Learners | Diagnoses such as autism or ADHD, EHCPs, reasonable adjustments, exam access arrangement evidence | TutorCruncher; restricted Google drives |
| Safeguarding information | Learners | Child protection concerns, disclosures, referrals, chronologies, which may include health, sex life, or criminal offence data | TutorCruncher safeguarding record (DSL and Deputy DSL access) |
| Sexual orientation, and gender identity where it reveals health or sex life | Learners | Shared voluntarily by the learner or family, for example to agree names and pronouns | TutorCruncher (restricted) |
| Racial or ethnic origin | Learners, staff | Only if collected for equality monitoring | Restricted equality monitoring records |
| Health | Staff and volunteers | Sickness absence, reasonable adjustments, occupational health information | Restricted HR drive |
| Criminal offence data | Staff and volunteers | DBS check date and certificate number, and any disclosure or barred-list information | Single Central Record; restricted HR drive |
| Criminal offence data | Learners and others | Information about offences or alleged offences that arises in safeguarding work, including LADO matters | TutorCruncher safeguarding record |
The Haven does not process genetic data, biometric data for identification, trade union membership, or political opinions.
3. Conditions relied on
3.1 Conditions that do not need this document
These are listed for completeness:
- Article 9(2)(a) explicit consent: for any optional sharing a family or learner chooses, where consent is genuinely free.
- Article 9(2)(c) vital interests: in an emergency, for example sharing medical information with paramedics when someone cannot consent.
- Article 9(2)(f) legal claims: where needed to establish, exercise or defend legal claims.
3.2 Schedule 1 conditions that need this document
| Condition | Paragraph | Used for |
|---|---|---|
| Employment, social security and social protection | Schedule 1, Part 1, paragraph 1 (Article 9(2)(b)) | Staff health, sickness and reasonable adjustments; staff criminal offence data from DBS checks, which The Haven must carry out under safeguarding and employment law |
| Statutory and government purposes | Schedule 1, Part 2, paragraph 6 | Learner health and SEND information needed to meet The Haven’s duty to make reasonable adjustments under the Equality Act 2010 |
| Equality of opportunity or treatment | Schedule 1, Part 2, paragraph 8 | Equality monitoring of learners and staff (racial or ethnic origin, disability, sexual orientation), where collected, to check that The Haven is open and fair to all groups |
| Safeguarding of children and of individuals at risk | Schedule 1, Part 2, paragraph 18 | Learner health, mental health, SEND, sexual orientation and safeguarding information, where needed to protect a child from harm or to protect their physical, mental or emotional wellbeing |
| Safeguarding (criminal offence data) | Schedule 1, Part 3, paragraph 36, applying paragraph 18 | Criminal offence data that arises in safeguarding work, including allegations about adults (LADO) |
How paragraph 18 is met. Learners at The Haven are children, many with SEND, so they are children or individuals at risk within the meaning of paragraph 18. The processing is necessary to protect them from harm or to protect their wellbeing. It is carried out without the learner’s consent only where consent cannot be given, cannot reasonably be obtained, or seeking it would put the protection at risk. Otherwise, the learner and family are told what is recorded and why. The processing is in the substantial public interest because it keeps children safe.
How paragraph 8 is met. Equality data is used only to check whether equality of opportunity is being maintained. It is never used to make decisions about an individual. Anyone can ask in writing for their equality data to stop being used. Where possible, it is collected optionally and analysed in aggregate.
4. How the data protection principles are met
Lawfulness, fairness and transparency. Every category in section 2 has an Article 6 lawful basis and a condition in section 3. The Privacy Notices tell learners, families and staff which special category data is processed and why. Learners are told in age-appropriate ways that safeguarding information may be shared to keep them safe.
Purpose limitation. The data is used only for education, wellbeing, reasonable adjustments, safeguarding, safer recruitment and employment. It is not used for marketing or profiling. Any new use is assessed by the DPO first, with a DPIA update where needed.
Data minimisation. Only what is needed is collected. For example, DBS records hold the date and certificate number only, and equality monitoring is optional.
Accuracy. Families and staff are asked to update health and contact information at enrolment, at induction and each term. Safeguarding records record facts, sources and dates, and keep opinion separate.
Storage limitation. Retention follows section 5 and the Data Retention Policy.
Security.
- Data is held only in managed Haven systems: Google Workspace for Education and TutorCruncher, with Cloudflare protecting Haven portals.
- Multi-factor authentication is required for staff accounts.
- Safeguarding records are restricted to the DSL and Deputy DSL. Health and SEND details are restricted to staff who need them. HR records are restricted to named leaders.
- Special category data is not stored on personal devices or sent by personal email.
- The processors are listed on the Service Providers and Data Processors page and work under data processing terms.
Accountability. This document, the DPIA, the processor register, the Data Retention Policy and the training register together evidence compliance. The DPO reviews them each year and reports to the Proprietor.
5. Retention and erasure
| Data | Kept for |
|---|---|
| Learner health, SEND and education records | Until the learner is 25, in line with the Data Retention Policy |
| Safeguarding records | Until the learner is 25 at minimum, longer where there is an ongoing concern or LADO involvement, in line with KCSIE and the Data Retention Policy |
| Staff health and HR records | For the duration of employment plus six years |
| DBS records | Date and certificate number only, for the duration of employment; certificates are not kept |
| Equality monitoring data | Analysed in aggregate; individual responses deleted once analysed or within one year |
At the end of retention, records are securely deleted from live systems and from backups in line with the backup cycle. Deletion of safeguarding-relevant data is logged. Requests for erasure are honoured unless an exception in Article 17(3) applies, such as a legal obligation or safeguarding. The person is told the reason in writing within one month.
6. Review
This document is reviewed each year by the DPO, and straight away if:
- the categories of data change;
- the conditions relied on change;
- retention periods change;
- a new processor handles special category data;
- there is a breach involving special category or criminal offence data.
7. Decisions recorded at sign-off
Approved on 19 October 2026. Paragraph 6 (statutory purposes) is retained for Equality Act reasonable adjustments, alongside paragraph 18. This document is published on The Haven’s policy site and is also available from the DPO on request.
8. Sign-off
| Role | Signature | Date |
|---|---|---|
| Data Protection Officer | ||
| Designated Safeguarding Lead | ||
| Proprietor (on behalf of the Autistic Girls Network trustees) |