Privacy Notice for Pupils, Parents and Mentors

We are Academy21 (the “School”), trading as part of the company ACADEMY21 LIMITED

with address Sixth Floor, 3 Burlington Gardens, London, England, W1S 3EP and company registration number 07596235.  The School is a member of the Inspired Education Group (the “Group”).

This Privacy Notice is intended to provide information about how the School will collect, use and hold (or “process”) personal data about individuals, including: current, past and prospective pupils; and their parents, carers or guardians (referred to in this policy as “parents“); and the persons commissioning the provision, responsible for payments and overseeing students while at the provision and making decisions about their placement (referred to in this policy as “Mentors”). Please note that the School has a separate Privacy Notice applicable to its employees and other staff.

This Privacy Notice applies alongside any other information the School may provide about a particular use of personal data. This Privacy Notice also applies in addition to the School’s other relevant terms and conditions and policies, including:

• any contract between the School and the commissioner of Pupil’s places;
• the School’s policy on taking, storing and using images of children;
• the School’s and/or Group’s Data Retention Policy;
• The School’s Data Protection Rights Policy;
• The School’s Cookies Policy;
• the School’s safeguarding, pastoral, or health and safety policies, including as to how concerns or incidents are recorded; and
• the School’s or the Group’s (as applicable) IT policies.

This Privacy Notice may be updated from time to time to ensure continued compliance with applicable laws and to reflect best practice.

The types of personal data the School may process include:

• name and contact information such as the address, email and telephone number of the pupil, parent, guardian, next of kin ;
• Name and contact information, such as email, work address and telephone number for Mentors;
• pupil date and country of birth, ethnicity, gender and country of domicile;
• information relating to pupil education history such as previous schools, courses completed, dates of study, attendance, disciplinary and safeguarding records and examination results;
• pupils’ academic data including examination and assessment results, prior attainment, expected attainment, reports and curriculum timetables;
• information about pupils’ health and medical conditions, special educational needs, related assessments and family circumstances / living arrangements;
• safeguarding information and supervision arrangements
• correspondence with and concerning pupils, parents and Mentors (past and present);
• references given or received from previous schools or education establishments, and relevant information provided by previous educational establishments and/or other professionals or organisations working with pupils;
• information relating to fees such financial information (including any source of funds and/or anti-money laundering information we are required to collect by law);
• information which may assist with the provision of appropriate medical and pastoral care of the pupil such as any disability or medical issues. This may also include information about family or personal circumstances where this is relevant to the tailoring provision; and
• images of pupils (and occasionally other individuals) engaging in School activities, and images (in accordance with the School’s policy on taking, storing and using images of children).

Please note that the School will routinely anonymise and/or aggregate personal data, such that it is no longer considered “personal data” under applicable data protection law, or otherwise apply appropriate data minimisation procedures such as pseudonymization. We use this data set for evaluation and analytical purposes, and we may also share it with third parties for these purposes.

Generally, the School receives personal data from the individual directly (including, in the case of pupils, from their parents and mentors). However, in some cases personal data will be supplied by third parties (for example another school, or other professionals or authorities, or third party service providers who credit and identity check parents and their source of funds); or collected from publicly available resources.

With the above in mind, the following are the primary ways the School collects personal data about pupils, parents and mentors:

• information provided during the admission process and when the pupil is attending the School;
• information generated during the course of studies and time at the School (e.g. attendance, academic achievement, behaviour or safeguarding information);
• information received from previous places of education (whether part of the Group or not);
• information received from statutory agencies;
• information provided by third parties in relation to the pupil’s right to study at the School or in relation to funding (for example for bursaries or scholarships); and
• information from access to and use of the School’s website, or other online educational tools and software including the Group’s Global Study Platform.

The primary use of the personal data we collect is to support the learning and development of pupils during their time at the School, whilst ensuring the wellbeing and safeguarding of the pupils. In order to do so, the School needs to process a wide range of personal data about our community as part of our daily operations.

Some of this activity the School will need to carry out is because it is necessary for the performance of a contract with our staff, or the commissioning body.

Other uses of personal data will be made in accordance with the School’s legitimate interests, or the legitimate interests of others, provided that these are not outweighed by the impact on individuals. The School expects that the following uses will fall within that category of our (or our community’s) “legitimate interests”:

• To confirm the identity of prospective pupils, their parents and Mentors, and retain a record (if appropriate) for the purposes of future applications or openings;
• To provide education services (including spiritual development, career services, and extra-curricular activities to pupils), and monitoring pupils’ progress and educational needs, including where such services are provided remotely / via apps or other technology platforms (either temporarily or permanently), including where assisted by AI (in accordance with the School’s AI Policy);
• To report to and liaise with Mentors about children they are responsible for and their progress, welfare and development including by way of regular report ;
• To organise and manage meetings, events and social engagements for pupils ;
• To maintain relationships with current and former commissioning organisations and the School community, including by direct marketing;
• For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as tax, diversity or gender pay gap analysis);
• To promote diversity and equality;
• To monitor and evaluate the performance and effectiveness of the School, and to maintain and improve the academic, corporate, financial, estate and human resource management of the School;
• To enable relevant authorities to monitor the School’s performance and to intervene or assist with incidents as appropriate;
• To give and receive information and references about past and current pupils, , to/from any educational institution that the pupil attended or where it is proposed they attend; and to provide references to potential employers of past pupils;
• For debt collection purposes;
• To enable pupils to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils of the School;
• To safeguard pupils’ health and welfare and provide appropriate pastoral care;
• To monitor (as appropriate) use of the School’s IT and communications systems in accordance with the School’s Acceptable Use Policy;
• To make use of images (including photographs and videos) of pupils for administrative and day to day internal uses such as newsletters and year books, in accordance with the School’s policy on taking, storing and using images of children;
• For the prevention and detection of crime, and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities;
• To carry out or cooperate with any School or external complaints, disciplinary or investigation process;
• To contact current or former Mentors to promote the Group’s services on matters such as , opportunities for new services or provisions, or for CPD and thought leadership events and other promotional activities;
• To promote the School to prospective Mentors and pupils; and
• Where otherwise reasonably necessary for the School’s purposes, including to obtain appropriate professional advice and insurance for the School;

The School may also process your personal data for our compliance with our legal obligations. In this respect, we may use your personal data for the following:

• To meet our compliance and regulatory obligations, including in order to comply with any requirement of any applicable statute, regulation or regulatory rule, such as compliance with anti-money laundering laws and safeguarding requirements;
• For the prevention, detection and investigation of crime;
• To assist with investigations, including criminal investigations carried out by the police and other competent authorities; and
• To administer and maintain such records as may be required by applicable laws and regulations from time to time.

We may also process your personal data for additional reasons where:

• It is necessary to protect the vital interests of the pupil or another person;
• It is necessary for the establishment, exercise or defence of legal claims (for example, to protect and defend the School’s rights, property, or those of any affiliates, including the Group); or
• We have the consent of the data subject to do so (for example, we seek parental and/or pupil consent for certain external marketing uses of pupil images).

In addition, the School will on occasion need to process more ‘sensitive’ types of data (sometimes referred to as special category personal data) (concerning health, ethnicity, religion, biometrics or sexual life) or criminal records information in accordance with rights or duties imposed on us by law, including as regards safeguarding, or from time to time by explicit consent where required. These reasons will include:

• To safeguard pupils’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual’s health / medical condition or other relevant information where it is in the individual’s interests to do so: for example for emergency medical care, to arrange the assessment and diagnosis of a pupil’s health and medical conditions and special educational needs, for social protection, safeguarding, and cooperation with police or social services, for insurance purposes ;
• To comply with public health requirements;
• To provide educational services in the context of making reasonable adjustments for a pupil’s disability and/or any special educational needs of a pupil;
• As part of any School or external complaints, disciplinary or investigation process that involves such data, for example if there are SEND, health or safeguarding elements; or
• For legal and regulatory purposes (for example child protection, diversity monitoring, attendance / absence reporting, health and safety and immigration / visa sponsorship compliance) and to comply with its legal obligations and duties of care.

Processing by third parties.  For the most part, personal data collected by the School will remain within the School, and will be processed by appropriate individuals only in accordance with access protocols (i.e. on a ‘need to know’ basis). However, we use data processors who are third parties who assist us with some functions, including accounting, provision of IT platforms, cloud storage / records management, monitoring, mailing, and to support our delivery of the curriculum and associated education services to pupils (including via AI systems). This type of external data processing is subject to contractual assurances that personal data will be kept securely and used only in accordance with the School’s specific directions.

Data sharing.  The School will from time to time, need to share personal information relating to its community of pupils and parents/guardians with third parties, such as:

• External health professionals such as educational psychologists and speech therapists;
• Appropriate contractors and third-party suppliers;
• Government and local authorities, statutory agencies and/or regulatory bodies;
• Bursary and scholarship funding organisations;
• Examination boards /assessment centres;
• The Group, other entities within the Group, or other schools in the Group;
• Exit/destination schools (including in the form of confidential references);
• Professional advisers (e.g. lawyers, insurers, PR advisers and accountants);
• Third parties and their advisers in the event of a possible or actual sale, merger or other restructuring or financing of the School / Group; and
• Courts or debt collections agencies in the event of non-payment of fees.

International data transfers. Where data is transferred internationally, we will put in place appropriate measures to ensure the adequate protection of your personal data when it is transferred to countries that do not provide the same level of protection for personal data, and ensure that international transfers are carried out in accordance with applicable data protection laws.

The primary purpose of using lookalike audiences is to support our marketing activities by reaching potential clients or mentors who may be interested in our educational services. This is done by leveraging aggregate information such as demographics, interests and behaviours for matching purposes. We process your personal data for lookalike audiences based on our legitimate interests. We have assessed that this processing is necessary for our marketing activities and does not override your rights and freedoms.

You have the right to object to this use of your data at any time. You can do this by contacting the School directly.

The School will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason, including to meet regulatory and legal requirements or for archiving purposes. For further information on data retention, please see the School’s Data Retention Policy which is available upon request.

We may retain certain academic data for longer periods for archiving, research and statistical purposes. Where we do so, we will put in place suitable data minimisation procedures. This will include removing the data from day-to-day processing and putting in place access restrictions.

When a commissioning body engages with Academy21, contact details and account records will be retained to facilitate future service provision to the commissioning body. Academy21 will use the contact details of representatives from the commissioning body to keep them informed about relevant activities, developments, and events that may be of interest. This may include sending updates and newsletters via email. Representatives always have the right to withdraw consent or object to direct marketing communications. However, Academy21 may retain certain details to ensure that no further communications are sent to the specified address, email, or telephone number.

• The right of access: You may request a copy of the personal data that the School holds about you.
• The right to rectification: You may ask the School to correct any information we hold about you if it is incorrect.
• The right to erasure: You may ask the School (in certain circumstances) to delete information that the School holds on you.
• The right to restrict processing: You may ask the School to restrict our data processing activities (and, where the School’s processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal).
• The right to data portability: You may ask the School (in certain circumstances) to transfer your personal data to another data controller in a format that makes it easy for them to use.
• The right to object: You may object, on grounds relating to your particular situation, to any of the School’s particular processing activities where you feel this has a disproportionate impact on your rights.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. The School will endeavour to respond to any such requests as soon as reasonably practicable and in any event within legal time limits. To exercise any of these rights, or if you have any data protection related concerns, please contact: [email protected].

You also have the right to complain to a Data Protection Authority if you believe that your personal information has been collected or used in breach of relevant data protection laws. This will typically be the Data Protection Authority in the country in which you are located.

Last Updated: May 2025