Privacy Notices
Info
Status: live (signed off 19 October 2026) · Version: 10.26 · Last reviewed: 2026-10-19 · Next review: 2027-05-21 Owner: Data Protection Officer · Approved by: Proprietor + Governing Body
Introduction
Autistic Girls Network (the ‘Charity’) is the data controller for personal data processed in connection with its specialist online education provision, The Haven. It is registered with the Information Commissioner’s Office (registration ZB867479). Contact details:
- The Haven, 68 South Green Drive, Stratford upon Avon, CV37 9HP
- Registered charity: 1196655 (England and Wales) and SC054837 (Scotland)
- Data Protection Officer: dpo@thehavenonline.co.uk
- The service providers who process data for The Haven are listed on the Service Providers and Data Processors page. This document contains four separate Privacy Notices, each tailored to a category of data subject. Each is intended to be read on its own and is published in summary form on our website.
Our lawful bases for processing are set out in each notice. Across all notices, you have the right to: be informed; access your data; rectify inaccurate data; request erasure (subject to legal limits); restrict processing; object to processing; data portability; and to complain to the Information Commissioner’s Office (ICO). You can exercise any of these rights by contacting the Data Protection Officer at dpo@thehavenonline.co.uk. We respond within one month.
Notice 1: Privacy Notice for Employees, Volunteers and Contractors
What we collect
- Name, contact details, address, date of birth, national insurance number.
- Right-to-work documentation.
- Bank details for payment.
- DBS check details (certificate number and date only).
- References, application materials, interview notes.
- Employment contract and HR records.
- Supervision, appraisal, training and performance records.
- Records relating to grievance, disciplinary or whistleblowing matters where these arise.
- Sickness, leave and reasonable adjustment information.
- Equality monitoring data, on an optional and anonymised basis.
Why we collect it and our lawful basis
- To enter into and perform your contract of employment or engagement (contract).
- To comply with employment, tax and safeguarding law (legal obligation).
- For HR management, supervision and quality assurance (legitimate interest).
- For equality monitoring and reasonable adjustment (legitimate interest and, where required, consent).
Special category and criminal offence data
- Health information (sickness absence, reasonable adjustments, occupational health) is special category data. It is processed to meet employment and health and safety obligations, under Article 9(2)(b) UK GDPR and Data Protection Act 2018, Schedule 1, paragraph 1 (employment).
- DBS information (the date and certificate number of your check, and any disclosure or barred-list information) is criminal offence data. It is processed for safer recruitment under the same condition, Schedule 1, paragraph 1.
- Equality monitoring information is optional. Where it identifies you, it is processed under Schedule 1, paragraph 8 (equality of opportunity or treatment).
- How this data is protected and how long it is kept are set out in The Haven’s Appropriate Policy Document.
Who we share it with
- HMRC and pension providers.
- DBS service for safer recruitment checks.
- Auditors and accountants.
- Regulators where required (e.g. Charity Commission, OSCR, Ofsted).
- Insurers and professional advisers.
- Statutory authorities where there is a legal requirement (e.g. LADO referrals).
Retention
In line with the Data Retention Policy: employment records are kept for the duration of employment plus six years.
Notice 2: Privacy Notice for Visitors
Context
The Haven is an online provision and does not host learners on a physical site. ‘Visitors’ in this notice refers to people attending in-person The Haven events, professional training delivery, virtual visitors to our online sessions in a professional capacity, and visitors to our website.
What we collect
- Name and contact details if you register for an event or training.
- Organisation and role, where relevant.
- Dietary or access requirements, where you choose to provide them.
- Feedback you choose to give about an event or training.
- If you visit a virtual session as a professional visitor: name, organisation and reason for attendance.
- Website analytics data, in line with our cookie practice.
Why we collect it and our lawful basis
- To organise and deliver the event or training you have registered for (contract).
- To meet our safeguarding and health and safety obligations (legal obligation, vital interests).
- To improve our services (legitimate interest).
- To communicate with you, where you have consented (consent).
Who we share it with
- Venue providers and event partners where strictly necessary.
- Statutory authorities where there is a legal requirement.
Retention
Event records are kept for one year unless a longer period is required (e.g. financial records, accreditation evidence).
Notice 3: Privacy Notice for Students and Parents/Carers
What we collect
- Learner’s name, date of birth, address and contact details.
- Names and contact details of parents, carers and emergency contacts.
- Education history, including prior attainment, EHCP (where held), and previous school details.
- SEND information, EHCP (where held) and reasonable adjustment requirements.
- Medical and mental health information relevant to the placement.
- Gender identity and pronouns, where the learner or family chooses to share them.
- Records of attendance, engagement and assessment at The Haven.
- Mentor notes, educator observations and reviews.
- Safeguarding records, where these arise.
- Communication between The Haven and the family.
- Lesson recordings and transcripts of sessions in which the learner participates.
- Where applicable, photographs and videos for which consent has been given.
- Information relating to the funding route (private, school, Local Authority).
Why we collect it and our lawful basis
- To provide the educational placement (contract with the family or the commissioning body).
- To meet our statutory safeguarding, education and equality duties (legal obligation, vital interests in some cases).
- To assess and improve quality of provision (legitimate interest).
- To share information with funders, commissioners and statutory partners where required (legal obligation, contract).
- Some of this information is special category data: health, mental health, SEND and EHCP information, and any information about sexual orientation, or gender identity where it reveals health or sex life. Safeguarding records may also contain criminal offence data. The Haven processes this information:
- to keep learners safe and protect their wellbeing (Data Protection Act 2018, Schedule 1, paragraph 18: safeguarding of children and individuals at risk, and paragraph 36 for criminal offence data);
- to make reasonable adjustments under the Equality Act 2010 (Schedule 1, paragraph 6);
- in an emergency, to protect someone’s life or health (vital interests);
- or with explicit consent where sharing is optional.
- How this data is protected and how long it is kept are set out in The Haven’s Appropriate Policy Document.
Who we share it with
- Local Authorities, where the placement is commissioned or where statutory duty requires.
- Schools where the learner is on roll and the placement is AP.
- Awarding bodies for examination purposes.
- Statutory safeguarding partners where required (children’s social care, LADO, police).
- Health professionals where consent or necessity requires.
- Auditors, regulators (including Ofsted) and professional advisers where required.
Retention
Education records are retained until the learner reaches age 25, in line with DfE guidance. Safeguarding records are retained in line with Keeping Children Safe in Education and IICSA guidance. Full detail is set out in the Data Retention Policy.
Notice 4: Privacy Notice for Children Looked After
Context
This notice applies to learners at The Haven who are Looked After by a Local Authority (also referred to as children in care or care-experienced young people). It supplements the Privacy Notice for Students and Parents/Carers. Where there is any inconsistency, this notice and statutory duty take precedence.
What we collect (in addition to the standard learner record)
- The young person’s Looked After status and the placing Local Authority.
- Personal Education Plan (PEP) information.
- Pupil Premium Plus arrangements where applicable.
- Contact details for the Virtual School Head, social worker, carer(s) and Independent Reviewing Officer.
- Information necessary to deliver the placement safely, including care arrangements that affect learning.
Why we collect it and our lawful basis
- To meet statutory duties owed to Looked After children (legal obligation).
- To deliver and review the placement in partnership with the placing authority and Virtual School (legal obligation, public task).
- To protect the young person’s welfare (vital interests, legal obligation).
Who we share it with
- The placing Local Authority and the Virtual School.
- The social worker, IRO and (where appropriate) carer(s).
- Other statutory partners where there is a legal duty or vital interest.
- Awarding bodies for examination purposes.
Particular safeguards
- Information about Looked After status is treated as sensitive and shared only with those who need to know.
- Decisions affecting the young person are made in line with statutory expectations and in partnership with the placing authority.
- The young person’s voice is sought and respected in line with their age, capacity and wishes.
Retention
As for standard learner records, in line with the Data Retention Policy. Safeguarding records are retained in line with statutory guidance.
Common provisions across all notices
How we keep your data safe
Personal data is held on secure systems with access restricted to authorised staff. Data is encrypted in transit and at rest where applicable. We use UK-based providers wherever possible. Where data is transferred outside the UK, appropriate safeguards (including adequacy decisions or standard contractual clauses) are used.
Your rights
You have the right to be informed, access your data, request rectification, request erasure (subject to legal limits), restrict processing, object to processing, and data portability. Contact the Data Protection Officer at dpo@thehavenonline.co.uk to exercise these rights. Response within one month.
Complaints about how your data is handled
You can complain to The Haven about how your personal information has been handled by emailing dpo@thehavenonline.co.uk. Complaints are acknowledged within 30 days and dealt with without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk at any time.
Cookies and website use
Use of cookies on our websites is set out in our cookie notice on each website. Non-essential cookies are only set with consent.
Changes to this document
These notices are reviewed annually and updated as required. The current version is published on our website.
Review
These notices are reviewed annually by the Data Protection Officer and approved by the Proprietor and governing body.
| Document version | 10.26 |
|---|---|
| Date issued | October 2026 |
| Next review | May 2027 |
| Document owner | Data Protection Officer |
| Approved by | Board of Governors |