CLIENT PRIVACY NOTICE

This privacy notice describes how we, (Baker Education), collect and use personal information during and after the provision of our services to our clients (Data Subjects), in accordance with UK data protection law.

Following Brexit, Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) is retained EU law and known as UK GDPR. The UK GDPR sits alongside an amended version of the Data Protection Act 2018 that relate to general personal data processing, powers of the Information Commissioner and sanctions and enforcement. The GDPR as it continues to apply in the EU is known as EU GDPR.

It applies to all clients (whether prospective, current or former). Data Subjects may include third parties who are not our clients, but whose data is processed through our provision of services to clients eg. where our client is a school, we may process data about pupils.

Who collects this information?

Baker Education is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you.

We are required under data protection legislation to notify you of the information contained in this privacy notice. This notice does not form part of any contract to provide services and we may update this notice at any time.

It is important that you read this notice with any other policies mentioned within this privacy notice, so that you understand how we are processing your information and the procedures we take to protect your personal data.

Data protection principles

We will comply with the data protection principles when gathering and using personal information, as set out in our data protection policy.

Categories of information we collect, process, hold and share

Personal data is currently defined as information from which an individual can be identified i.e. a

client’s full name.

There are “special categories” of more sensitive personal data which require a higher level of

protection.

We may collect, store and use the following categories of personal information about you:

Personal information such as name, pupil number, date of birth, gender and contact information
Emergency contact and family lifestyle information such as names, relationship, phone numbers and e-mail addresses
Characteristics (such as ethnicity, language, nationality, country of birth)
Attendance details (such as sessions attended, number of absences and reasons for absence)
Financial details (in order to ensure effective payment is made)
Performance and assessment information
Behavioural information (including exclusions)
Recordings of pupils and/or parents from the Company’s video conferencing platform
Information about the use of our IT, communications and other systems and other monitoring information
We may also collect, store and use ‘special category’ information such as relevant medical

information and special educational needs information

Please see the appendix for further information regarding processing activities.

How we collect this information

Personal data is most commonly collected directly from clients, for example, when you make a enquiry on our website about our services, or in the normal course of the provision of our services to clients.

The lawful basis on which we use this information

We will only use your information when the law allows us to. Most commonly, we will use your information in the following circumstances:

Consent: the individual has given clear consent to process their personal data for a specific purpose;

Eg. we ask for your permission to share a testimonial you provided on our website.

Contract: the processing is necessary for a contract with the individual;

Eg. we process your personal data in order to achieve the service which you have engaged with us for a detailed in our contract or terms of service.

Legal obligation: the processing is necessary to comply with the law (not including contractual obligations);

Eg, we are required make returns to government organisation relating to our clients by law.

Legitimate Interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party

Eg. we email you regarding further services which we provide, based on your past interest in a similar product.

How we use your information

We hold client data and use it for:-

Providing education services and extra-curricular activities to pupils, and monitoring progress and educational needs

To provide tutoring and educational services as agreed
Assessing performance and to set targets
Safeguarding pupils' welfare and providing appropriate pastoral (and where necessary medical) care
Support teaching and learning
Giving and receive information and references about past, current and prospective pupils and to provide references
Managing internal policy and procedure
Enabling pupils to take part in assessments and to record pupil achievements
To carry out statistical analysis for diversity purposes
Legal and regulatory purposes (for example child protection, diversity monitoring and health and safety) and to comply with legal obligations and duties of care
Enabling relevant authorities to monitor performance
Monitoring use of the Company’s IT and communications systems in accordance with the

Company's IT security policy

Making use of photographic images on social media and on the website
Security purposes; and
Where otherwise reasonably necessary for the Company's purposes, including to obtain appropriate professional advice and insurance.

How we use particularly sensitive information

Sensitive personal information (as defined under the UK GDPR as “special category data”) require higher levels of protection and further justification for collecting, storing and using this type of personal information. We may process this data in the following circumstances:

In limited circumstances, with your explicit written consent;
Where we need to carry out our legal obligations in line with our data protection policy;
Where it is needed in the public interest, such as for equal opportunities monitoring.
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent.

Marketing

From time to time, the Company will provide marketing communications to you. This will normally be either by email or SMS. This is in order to provide you with a personalised and targeted service but we also wish for you to have the choice in what communications you receive from us.

The content of these communications will include providing: -

Updates about progress of the Company
Details about services offered the Company
Subscription services such as weekly updates and newsletters. This will normally require the

user’s opt in

Opportunities and events promoted by the Company such as research programmes, webinars and training sessions

We follow laws and guidelines when sending marketing communications including: -

Sending marketing communications to a work email address where possible
When communicating with a non-work email address, we will ensure that we do so either

under the soft opt in principles or with the user’s explicit consent to carry out marketing.

In all instances to provide users with an ability to opt out of marketing.
When using third party companies to assist with marketing we ensure data collection and use is done in accordance with data protection laws
We never provide your details to third party companies.

Such marketing activities may include sending promotional and commercial communications regarding services offered by the Company. This may include co- marketing or joint sale opportunities, including promotional events, training and webinars.

In some cases, personal data that you provide us is done via group company platforms. This data may be shared and combined with personal data collected throughout your relationship with the Company. Where this is done, it will be communicated to you and, where necessary, obtain your consent before doing so.

Automated decision making

Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision making in limited circumstances.

Where we have notified the Data Subject of the decision and given him/her 21 days to request a reconsideration.
Where it is necessary in performance of the contract with the Data Subject and appropriate measures are in place to safeguard his/her rights.
With the explicit written consent of the Data Subject and where appropriate measures are in place to safeguard his/her rights.

If we make an automated decision in relation to Data Subjects on the basis of any particularly sensitive personal information, we must have either the explicit written consent of the Data Subject or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard the rights of the Data Subject.

Sharing data

We may need to share your data with third parties, including third party service providers where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so. These include the following:-

Local Authorities
The school attended by the pupil
NHS
Welfare services (such as social services)
law enforcement officials such as police
HMRC
Local Authority Designated Officer
Professional advisors such as lawyers and consultants
Support services (including insurance, IT support, information security) • Providers of learning software and
Government Agencies.

Information will be provided to those agencies securely, or if possible in an anonymised format.

The recipient of the information will be bound by confidentiality obligations, we require them to respect the security of your data and to treat it in accordance with the law.

We house your personal data in the United Kingdom and do not currently share your personal data outside of the EEA. However, in the future if we do share your personal data outside of the EEA, we shall either share data with a country which has received an adequacy decision by the EU Commission or will ensure that there are safeguards in place to provide appropriate levels of protection for your data, such as the use of Standard Contractual Clauses.

National Tutoring Programme

The Company are an approved provider under the Government’s National Tutoring Programme. The aim of this programme is to provide subsidised and assisted tutoring for select individuals during the pandemic to help close the attainment gap.

As part of this programme, we may be required to share personal data with the Government and approved third parties (including Evaluators and the Education Endowment Foundation). This is necessary in order to ensure appropriate funding is provided, appropriate services are offered and to determine effective performance of the programme.

We will also be required to provide evidence of positive pupil progress. We will be required to share the following data: -

Pupil data: Pupil’s name, age or date of birth and year group;
SEN status;
Pupil’s eligibility for Pupil Premium;
Tutor data: Tutor’s name, highest qualification and email address;
Pupil’s attendance record;
Tutor:pupil ratio; and
Type of delivery (face-to-face vs. online).

On some online platforms (e.g. Bramble) the sessions are recorded. Recordings of each tutoring sessions are stored with the platform provider until the end of the agreed length of the service as well as sent electronically to the pupil. Recording is available for the student to review and share with parents/carer. Parents/Carers and schools can put in a request for the session recording to be removed before the end of service delivery by contacting us.

Security

We have put in place measures to protect the security of your information (i.e. against it being accidentally lost, used or accessed in an unauthorised way). In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. Details of these measures are available on request.

Retention

We will only retain personal information about clients for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. This retention period will in most cases be as long as you are our client.

Details of retention periods for different aspects of personal information about Data Subjects are available in our Data Retention Policy which is available upon request.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of the personal data, the purposes for which we process the personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your Rights of Access, Correction, Erasure and Restriction

Under certain circumstances, by law you have the right to:

Access your personal information (commonly known as a “subject access request”). This allows you to receive a copy of the personal information we hold about you and to check we are lawfully processing it. You will not have to pay a fee to access your personal information. However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
Correction of the personal information we hold about you. This enables you to have any inaccurate information we hold about you corrected.
Erasure of your personal information. You can ask us to delete or remove personal data if there is no good reason for us continuing to process it.
Restriction of processing your personal information. You can ask us to suspend processing personal information about you in certain circumstances, for example, if you want us to establish its accuracy before processing it.
To object to processing in certain circumstances (for example for direct marketing purposes).
To transfer your personal information to another party.

If you want to exercise any of the above rights, please contact our data protection officers in writing by emailing info@bakereducation.co.uk.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).

Right to Withdraw Consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact info@bakereducation.co.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

How to Raise a Concern

We have an internal data protection lead who can be contacted at

info@bakereducation.co.uk

You have the right to make a complaint at any time to the Information Commissioner’s Office, the

UK supervisory authority for data protection issues.

Changes to this Privacy Notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.