Date: October 2026 Review Date: October 2027 Coordinator: Data Protection Officer (DPO) Nominated Governor: the Co-Chair of Governors Version: 10.26
1. Statement of intent
The Haven respects the privacy, dignity and safety of every learner, family member and member of staff. This policy is The Haven’s data protection (UK GDPR) policy. It explains how personal information is collected, used, shared, kept safe and deleted, and how it supports safeguarding.
The Haven aims to:
- protect people’s rights under the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025;
- build privacy, confidentiality and security into everyday practice;
- share information appropriately to keep children safe and meet legal duties;
- respond quickly and openly to incidents and complaints.
2. Who is responsible for the data
- The Haven is operated by Autistic Girls Network (registered charity 1196655 in England and Wales and SC054837 in Scotland). Autistic Girls Network is the data controller for personal information about learners, parents and carers, and staff held by The Haven.
- Autistic Girls Network is registered with the Information Commissioner’s Office (ICO), registration ZB867479.
- Autistic Girls Network has appointed a Data Protection Officer (DPO) from within its senior leadership. The DPO can be contacted at dpo@thehavenonline.co.uk.
- Where a local authority or school commissions a place, it shares referral information so that The Haven can provide education and meet its safeguarding duties. The Haven then holds that information as a controller in its own right; the commissioning body remains controller of its own records. This is controller-to-controller sharing under the commissioning agreement. If a commissioning contract instead asks The Haven to process data on the commissioner’s behalf, the DPO reviews the contract and an Article 28 agreement is put in place.
3. Legal framework
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Data (Use and Access) Act 2025
- Privacy and Electronic Communications Regulations 2003
- ICO Age Appropriate Design Code (Children’s Code), as good practice for online services used by children
- DfE Keeping Children Safe in Education 2026
- DfE Information sharing: advice for practitioners providing safeguarding services (2024)
4. Data protection principles
Personal data is processed in line with the seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability.
5. Lawful bases
- Learner education and welfare: contract with the commissioning body or family, and legitimate interests (including the recognised legitimate interest of safeguarding vulnerable people, introduced by the Data (Use and Access) Act 2025).
- Safeguarding and legal duties: legal obligation and vital interests where relevant.
- Staff: contract and legal obligation.
- Consent is used only where it is genuinely optional, for example publishing images. Consent is freely given, specific, informed and unambiguous, and can be withdrawn at any time.
Special category data. Health, SEND, EHCP and mental health information is processed only to keep learners safe and to make reasonable adjustments. The conditions relied on are set out in The Haven’s Appropriate Policy Document: mainly Data Protection Act 2018, Schedule 1, paragraph 18 (safeguarding of children and individuals at risk), with paragraph 6 (statutory purposes, for Equality Act reasonable adjustments), paragraph 8 (equality monitoring) and, for staff health and DBS information, paragraph 1 (employment). Access is limited to staff who need it.
6. Confidentiality and information sharing
- Confidentiality is never absolute where there is a safeguarding concern. Learners are told this in age-appropriate ways.
- Information is shared on a need-to-know basis. Data protection law is not a barrier to sharing information to keep a child safe.
- Every sharing decision is recorded with the reason and legal basis.
- Termly joint DSL and DPO reviews check how confidentiality and sharing are working.
7. Systems and processors
The Haven uses a small number of service providers (processors). Each acts only on The Haven’s written instructions under a data processing agreement:
| Provider | Used for | Data location |
|---|---|---|
| Google Workspace for Education | Email, Google Meet live lessons, Google Classroom, Drive storage | UK/EU and other regions under Google’s data processing terms |
| TutorCruncher | Enrolment, scheduling, payments and the safeguarding record | As set out in the TutorCruncher DPA |
| Cloudflare | Secure hosting and access control for The Haven’s portals and course library | As set out in Cloudflare’s DPA |
The current list, including any new platform under evaluation, is kept in the processor register and the DPIA. A new platform is not used with learner data until the DPO has reviewed it and a DPIA update and DPA are in place.
Meeting transcription. Tactiq is being retired as a meeting transcription tool. From November 2026 meetings are transcribed, if needed, only with Google Meet’s built-in features inside The Haven’s Google Workspace. Transcripts are kept within Haven systems.
Continuity. If TutorCruncher is unavailable, staff use agreed manual processes in Google Workspace; if Google Workspace is unavailable, the Business Continuity Plan applies.
8. Individuals’ rights
People have the right to be informed; of access (subject access requests); to rectification; to erasure; to restrict processing; to data portability; to object; and rights about automated decision-making.
- Subject access requests are answered within one month. Under the Data (Use and Access) Act 2025, the time limit starts once The Haven has the information it reasonably needs to confirm identity and understand the request, and may be paused while clarification is sought. Searches are reasonable and proportionate.
- Requests made on behalf of a child are handled with the child’s best interests and capacity in mind.
9. Data protection complaints
From 19 June 2026, anyone can complain to The Haven about how their personal information has been handled. Data protection complaints:
- can be made by email to dpo@thehavenonline.co.uk, by letter or through the family contact channels;
- are acknowledged within 30 days and dealt with without undue delay;
- are logged, investigated by the DPO and answered in writing, with the outcome and any action taken;
- do not have to go through the general Complaints Procedure first.
The person can also complain to the ICO (ico.org.uk) at any time.
10. Security and breaches
- Digital records are held in managed Haven accounts with multi-factor authentication. Personal data is not stored on personal devices.
- Breaches and suspected breaches are reported to the DPO immediately and logged.
- The DPO notifies the ICO within 72 hours where a breach is likely to result in a risk to people, and tells affected individuals without undue delay where the risk is high. The DSL is involved where a breach has safeguarding implications.
- Causes are analysed and training is updated to prevent recurrence.
See the Data Retention Policy and Data Breach Procedure and the Cyber Security Policy.
11. Images and lesson recordings
- Images, video or voice recordings of learners are never published without parental consent, and the learner’s own wishes are respected.
- Any recording of lessons follows the Declaration – Photos, Videos and Lesson Recordings and the Lesson Recording – Operational Controls. Routine recording does not begin until those controls have been approved by the DSL, the DPO and the Proprietor.
- If a recording has to be shared for safeguarding reasons, learners not involved in the incident are obscured.
12. Retention
Data is kept only as long as necessary, in line with the Data Retention Policy. Safeguarding records are kept for the periods set out in that policy.
13. AI tools
Personal data about learners is not entered into AI tools except those approved under the Responsible Use of AI Policy, with a DPIA and appropriate contract terms.
14. Roles and responsibilities
- All staff: use strong passwords and MFA, use only approved systems, report incidents immediately, and complete annual data protection training.
- DPO: leads compliance, the processor register, DPIAs, rights requests, complaints and ICO liaison.
- DSL: makes sure safeguarding practice and data protection work together.
- Systems Architect: manages platform settings, access and technical security.
- Proprietor and governors: oversee compliance and make sure it is properly resourced.
15. Monitoring and review
This policy is reviewed annually, and straight away after changes in law or ICO guidance, a significant breach, or a new core platform. Joint DSL and DPO reviews of incidents, breaches, complaints and rights requests are reported to governors.