Privacy Notices
Info
Status: pending-signoff · Version: 05.26 · Last reviewed: 2026-05-21 · Next review: 2027-05-21 Owner: Data Protection Officer · Approved by: Proprietor + Governing Body
Introduction
The Haven (the ‘Charity’) is the data controller for personal data processed in connection with the Charity and its specialist online education provision, The Haven. Contact details:
- The Haven, 68 South Green Drive, Stratford upon Avon, CV37 9HP
- Registered charity: 1196655 (England and Wales) and SC054837 (Scotland)
- Data Protection Lead: contact via the Charity’s main contact channel This document contains four separate Privacy Notices, each tailored to a category of data subject. Each is intended to be read on its own and is published in summary form on our website.
Our lawful bases for processing are set out in each notice. Across all notices, you have the right to: be informed; access your data; rectify inaccurate data; request erasure (subject to legal limits); restrict processing; object to processing; data portability; and to complain to the Information Commissioner’s Office (ICO). You can exercise any of these rights by contacting the Data Protection Lead. We respond within one month.
Notice 1: Privacy Notice for Employees, Volunteers and Contractors
What we collect
- Name, contact details, address, date of birth, national insurance number.
- Right-to-work documentation.
- Bank details for payment.
- DBS check details (certificate number and date only).
- References, application materials, interview notes.
- Employment contract and HR records.
- Supervision, appraisal, training and performance records.
- Records relating to grievance, disciplinary or whistleblowing matters where these arise.
- Sickness, leave and reasonable adjustment information.
- Equality monitoring data, on an optional and anonymised basis.
Why we collect it and our lawful basis
- To enter into and perform your contract of employment or engagement (contract).
- To comply with employment, tax and safeguarding law (legal obligation).
- For HR management, supervision and quality assurance (legitimate interest).
- For equality monitoring and reasonable adjustment (legitimate interest and, where required, consent).
Who we share it with
- HMRC and pension providers.
- DBS service for safer recruitment checks.
- Auditors and accountants.
- Regulators where required (e.g. Charity Commission, OSCR, Ofsted).
- Insurers and professional advisers.
- Statutory authorities where there is a legal requirement (e.g. LADO referrals).
Retention
In line with the Data Retention Policy: employment records are kept for the duration of employment plus six years.
Notice 2: Privacy Notice for Visitors
Context
The Haven is an online provision and does not host learners on a physical site. ‘Visitors’ in this notice refers to people attending in-person The Haven events, professional training delivery, virtual visitors to our online sessions in a professional capacity, and visitors to our website.
What we collect
- Name and contact details if you register for an event or training.
- Organisation and role, where relevant.
- Dietary or access requirements, where you choose to provide them.
- Feedback you choose to give about an event or training.
- If you visit a virtual session as a professional visitor: name, organisation and reason for attendance.
- Website analytics data, in line with our cookie practice.
Why we collect it and our lawful basis
- To organise and deliver the event or training you have registered for (contract).
- To meet our safeguarding and health and safety obligations (legal obligation, vital interests).
- To improve our services (legitimate interest).
- To communicate with you, where you have consented (consent).
Who we share it with
- Venue providers and event partners where strictly necessary.
- Statutory authorities where there is a legal requirement.
Retention
Event records are kept for one year unless a longer period is required (e.g. financial records, accreditation evidence).
Notice 3: Privacy Notice for Students and Parents/Carers
What we collect
- Learner’s name, date of birth, address and contact details.
- Names and contact details of parents, carers and emergency contacts.
- Education history, including prior attainment, EHCP (where held), and previous school details.
- SEND information and reasonable adjustment requirements.
- Medical information relevant to the placement.
- Records of attendance, engagement and assessment at The Haven.
- Mentor notes, educator observations and reviews.
- Safeguarding records, where these arise.
- Communication between The Haven and the family.
- Lesson recordings and transcripts of sessions in which the learner participates.
- Where applicable, photographs and videos for which consent has been given.
- Information relating to the funding route (private, school, Local Authority).
Why we collect it and our lawful basis
- To provide the educational placement (contract, public task where commissioned).
- To meet our statutory safeguarding, education and equality duties (legal obligation, vital interests in some cases).
- To assess and improve quality of provision (legitimate interest).
- To share information with funders, commissioners and statutory partners where required (legal obligation, contract).
- Special category data (e.g. health, ethnicity) is processed on the basis of substantial public interest, vital interests, or explicit consent depending on context.
Who we share it with
- Local Authorities, where the placement is commissioned or where statutory duty requires.
- Schools where the learner is on roll and the placement is AP.
- Awarding bodies for examination purposes.
- Statutory safeguarding partners where required (children’s social care, LADO, police).
- Health professionals where consent or necessity requires.
- Auditors, regulators (including Ofsted) and professional advisers where required.
Retention
Education records are retained until the learner reaches age 25, in line with DfE guidance. Safeguarding records are retained in line with Keeping Children Safe in Education and IICSA guidance. Full detail is set out in the Data Retention Policy.
Notice 4: Privacy Notice for Children Looked After
Context
This notice applies to learners at The Haven who are Looked After by a Local Authority (also referred to as children in care or care-experienced young people). It supplements the Privacy Notice for Students and Parents/Carers. Where there is any inconsistency, this notice and statutory duty take precedence.
What we collect (in addition to the standard learner record)
- The young person’s Looked After status and the placing Local Authority.
- Personal Education Plan (PEP) information.
- Pupil Premium Plus arrangements where applicable.
- Contact details for the Virtual School Head, social worker, carer(s) and Independent Reviewing Officer.
- Information necessary to deliver the placement safely, including care arrangements that affect learning.
Why we collect it and our lawful basis
- To meet statutory duties owed to Looked After children (legal obligation).
- To deliver and review the placement in partnership with the placing authority and Virtual School (legal obligation, public task).
- To protect the young person’s welfare (vital interests, legal obligation).
Who we share it with
- The placing Local Authority and the Virtual School.
- The social worker, IRO and (where appropriate) carer(s).
- Other statutory partners where there is a legal duty or vital interest.
- Awarding bodies for examination purposes.
Particular safeguards
- Information about Looked After status is treated as sensitive and shared only with those who need to know.
- Decisions affecting the young person are made in line with statutory expectations and in partnership with the placing authority.
- The young person’s voice is sought and respected in line with their age, capacity and wishes.
Retention
As for standard learner records, in line with the Data Retention Policy. Safeguarding records are retained in line with statutory guidance.
Common provisions across all notices
How we keep your data safe
Personal data is held on secure systems with access restricted to authorised staff. Data is encrypted in transit and at rest where applicable. We use UK-based providers wherever possible. Where data is transferred outside the UK, appropriate safeguards (including adequacy decisions or standard contractual clauses) are used.
Your rights
You have the right to be informed, access your data, request rectification, request erasure (subject to legal limits), restrict processing, object to processing, data portability, and to make a complaint to the Information Commissioner’s Office (ICO). Contact the Data Protection Lead to exercise these rights. Response within one month.
Cookies and website use
Use of cookies on our websites is set out in our cookie notice on each website. Non-essential cookies are only set with consent.
Changes to this document
These notices are reviewed annually and updated as required. The current version is published on our website.
Review
These notices are reviewed annually by the Data Protection Lead and approved by the Board of Governors.
| Document version | 1.0 |
|---|---|
| Date issued | May 2026 |
| Next review | May 2027 |
| Document owner | Data Protection Lead |
| Approved by | Board of Governors |