RISE Inclusion and Wellbeing is a trading name of RISE Educators Ltd, a company registered in England and Wales (Company No. [INSERT]), with a registered address at [INSERT REGISTERED ADDRESS].

We are the data controller for the personal data we collect and process in connection with our website and services. This means we are responsible for deciding how and why your personal data is used.

If you have any questions about this policy or about how we handle your data, please contact us:

• Email: [INSERT PRIVACY/DATA CONTACT EMAIL]
• Post: Data Protection, RISE Educators Ltd, [INSERT REGISTERED ADDRESS]

We are registered with the Information Commissioner's Office (ICO) under registration number [INSERT ICO REGISTRATION NUMBER].

This policy applies to all personal data processed by RISE Inclusion and Wellbeing in connection with:

• Use of our website at [INSERT WEBSITE URL] and any contact forms or sign-up tools on it
• Email enquiries and marketing communications
• Assessment services, online and in-person, and the preparation of written assessment reports
• School consultancy, training, and CPD services
• Rent-A-SENCO and SENCO supply arrangements
• Family advocacy and support services
• Any other services we provide

It explains what data we collect, why we collect it, how long we keep it, who we share it with, and what rights you have in relation to it.

This policy does not apply to third-party websites linked from our site. We encourage you to read the privacy policies of any external sites you visit.

3.1 Website visitors

When you visit our website we may collect:

• Technical data, IP address, browser type and version, operating system, referring URL, pages visited, time spent on pages
• Cookie data, as described in our Cookie Policy

This data is collected automatically and is used to maintain the security and performance of the website and, where you have consented, to understand how visitors use it.

3.2 Enquiries and contact forms

When you contact us via our website form, email, or telephone, we collect:

• Your name and contact details (email address, telephone number)
• Whether you are a school professional or a family/parent
• The nature of your enquiry and any information you choose to include in your message

3.3 Email marketing and mailing list

If you subscribe to our mailing list or opt in to marketing communications, we collect:

• Your name and email address
• Your preferences and interests (where provided)
• Engagement data (e.g. whether you open or click on emails), collected via our email platform

3.4 School service clients and school staff

When we provide consultancy, training, Rent-A-SENCO, or other services to schools, we may collect and process:

• Contact and professional details of school staff (name, role, email, phone)
• Details about the school (name, address, URN, size, type, SEND provision)
• Information about individual pupils shared with us in the course of our work, including names, needs, EHCP status, provision, and other educational records
• Staff wellbeing data, including, where relevant, anonymised or identifiable information about staff health, stress, and working conditions
• Meeting notes, reports, and communications produced as part of our service delivery

Where schools share information about individual pupils or staff members with us, that data will typically be special category data (relating to health, disability, or educational needs). We treat this data with the highest level of care. See section 5 for more detail.

3.5 Assessment clients (children and families)

When we carry out learning assessments, we collect and process:

• The child's name, date of birth, year group, and school
• Parent or guardian name(s), contact details, and relationship to the child
• Background information provided by parents or school, including previous assessments, educational history, concerns, and any known diagnoses or health conditions
• Assessment data, the child's responses to standardised assessment tasks and the standardised scores derived from them
• Observations and notes made during the assessment session
• The written assessment report and any correspondence relating to it

3.6 Family support and advocacy clients

When we provide family advocacy or support services, we may collect:

• Family contact details and background information
• Details of the child's SEND history, school situation, and any legal proceedings or appeals
• Copies of EHCPs, school reports, and other documentation you share with us
• Notes from meetings we attend on your behalf

3.7 Data we do not collect

We do not carry out cognitive ability testing or diagnostic assessments. We do not collect biometric data, financial data (beyond what is needed to process payments), or data about criminal offences except where this is disclosed incidentally and relates to safeguarding.

UK GDPR requires us to have a lawful basis for processing your personal data. The table below sets out our purposes and the legal bases we rely on.

4.1 Legitimate interests

Where we rely on legitimate interests as our legal basis, we have carried out a balancing test to ensure our interests do not override the rights and freedoms of individuals. If you wish to receive further information about our legitimate interests assessments, please contact us.

4.2 Marketing communications

You can unsubscribe from our marketing emails at any time by clicking the unsubscribe link in any email we send you, or by contacting us directly. We will act on your request promptly.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

Some of the data we process is special category data under UK GDPR Article 9. This includes data relating to health conditions, disability, and, in the context of our work, information about children's educational and developmental needs that is health-related in nature.

We process special category data in the following circumstances:

• With explicit consent, for assessment and family services, we obtain explicit written consent from parents or guardians (and from young people themselves where appropriate) before processing health-related or SEND data about a child
• Substantial public interest, in the context of school consultancy and SENCO services, processing pupil SEND data supports the provision of education and the safeguarding of children, which constitutes substantial public interest under Schedule 1 of the Data Protection Act 2018
• Safeguarding, where processing is necessary to protect the vital interests of a child or vulnerable adult, and consent cannot reasonably be obtained

We apply additional safeguards to all special category data:

• Access is restricted to the founder and any authorised subcontractors bound by confidentiality obligations
• It is stored securely using appropriate encryption and access controls
• It is retained only for as long as necessary, see section 9
• It is never sold or shared for commercial purposes

5.1 Staff wellbeing data

Where school staff voluntarily share information about their health, stress, or personal circumstances as part of a staff wellbeing engagement or audit, this may constitute special category data relating to health. We process this data:

• On the basis of explicit consent given by the individual staff member
• In anonymised or aggregated form where possible, individual identifiable data from wellbeing audits is only shared with the commissioning school where the individual has consented to this

A significant part of our work involves personal data relating to children and young people. We take our responsibilities in this area extremely seriously and apply heightened safeguards to all data relating to individuals under 18.

• Consent: For children under 13, we obtain consent from a parent or guardian before collecting or processing their data. For young people aged 13–17, we obtain consent from both the young person and a parent or guardian where practicable.
• Minimisation: We collect only the minimum data about a child that is necessary to carry out the assessment or service requested.
• Security: All data relating to children is stored with the highest level of security measures available to us.
• Access: Assessment reports relating to children will normally be shared with the commissioning parent or guardian and, where appropriate and agreed, with the child's school. Reports are not shared with any other party without explicit consent.
• Retention: Assessment data relating to children is retained for a minimum period to meet professional standards and to allow for follow-up or appeals, but no longer than necessary, see section 9.

We do not sell your personal data. We share your data only in the following circumstances:

7.1 Service delivery

• Subcontractors and associates, where we engage qualified associates to assist with assessment, training, or consultancy delivery. All associates are bound by written confidentiality obligations and data processing agreements.
• IT and platform providers, including our website host, email marketing platform, video conferencing tool, and cloud storage provider. These processors act on our instructions and are bound by data processing agreements.
• Payment processors, to process fees for our services. We do not store payment card data ourselves.

7.2 Legal requirements

• Safeguarding, we may share information with appropriate authorities (Local Authority Designated Officer, Children's Services, police) without your consent where we have a safeguarding concern about a child or vulnerable adult. See section 11.
• Legal obligation, we may share data where required to do so by law, court order, or regulatory authority.

7.3 Professional referrals

Where we identify that a client needs a service we cannot provide (for example, a diagnostic assessment by an educational psychologist), we may, with your explicit consent, share relevant context with a referred specialist to avoid duplication of effort.

RISE Educators Ltd is a UK-registered company. However, our founder and some operational activity is based in Vietnam. As a result, some personal data may be accessed or processed outside the UK.

Vietnam is not currently recognised by the UK government as a country providing an adequate level of data protection. Accordingly, where personal data is transferred to or accessed from Vietnam, we rely on:

• International Data Transfer Agreements (IDTAs), the UK's approved mechanism for international transfers in the absence of an adequacy decision. We have put in place appropriate IDTA-based safeguards for any transfer of personal data to Vietnam.
• Technical measures, including encrypted storage, secure remote access controls, and access restricted to authorised individuals only.

If you have questions about international transfers or wish to see a copy of the safeguards we have in place, please contact us using the details in section 1.

Note for solicitor review: A Transfer Risk Assessment (TRA) should be completed and documented before data processing begins. The IDTA or UK Addendum to EU SCCs should be executed as appropriate.

8.1 Third-party platforms

Some of our third-party service providers (for example, cloud storage or email platforms) may also process data outside the UK. We ensure that all such providers have appropriate international transfer mechanisms in place and we only use providers that meet our security standards.

We retain personal data only for as long as is necessary for the purposes for which it was collected, and in line with legal, professional, and regulatory obligations. Our retention periods are as follows:

When the relevant retention period expires, data is securely deleted or anonymised. Anonymised data (from which no individual can be identified) may be retained for longer for statistical or quality purposes.

Under UK GDPR, you have the following rights in relation to your personal data:

10.1 Right of access

You have the right to request a copy of the personal data we hold about you (a Subject Access Request or SAR). We will respond within one month of receiving a valid request. We may ask you to verify your identity before releasing information.

10.2 Right to rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it. We will do so promptly.

10.3 Right to erasure ("right to be forgotten")

You may request that we delete your personal data in certain circumstances, for example, where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent. This right is not absolute: we may need to retain certain data to comply with legal obligations or to defend legal claims.

10.4 Right to restriction of processing

You may ask us to restrict our use of your data in certain circumstances, for example while we are considering a rectification request or an objection.

10.5 Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format.

10.6 Right to object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to marketing, we will stop immediately. Where you object to legitimate interests processing, we will consider your objection and stop unless we have compelling legitimate grounds to continue.

10.7 Rights relating to automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.

10.8 Rights relating to special category data

Where we process special category data on the basis of explicit consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10.9 How to exercise your rights

To exercise any of the above rights, please contact us at [INSERT PRIVACY EMAIL]. We will respond within one calendar month. In complex cases we may extend this by a further two months, in which case we will inform you of the extension and the reason for it within the first month.

We do not charge for handling rights requests unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request, and will explain our reasons.

Our duty of confidentiality is subject to our overriding obligation to safeguard children and vulnerable adults.

If, in the course of our work, including during an assessment session, a school visit, advocacy support, or any other service, we receive information that gives us a concern about the safety or welfare of a child or vulnerable adult, we may be required to share that information with the appropriate authorities without your consent and without prior notice to you.

This includes disclosures to the school's Designated Safeguarding Lead, the Local Authority Designated Officer (LADO), Children's Social Care, or the police, as the circumstances require.

The founder of RISE Inclusion and Wellbeing holds a current Disclosure and Barring Service (DBS) check and is a trained Designated Safeguarding Lead (DSL). We follow current statutory safeguarding guidance including Keeping Children Safe in Education (KCSIE) and Working Together to Safeguard Children.

We will always seek to inform you of any safeguarding referral we make, unless doing so would put a child or vulnerable adult at greater risk.

If you are unhappy with how we have handled your personal data, please contact us in the first instance at [INSERT PRIVACY EMAIL]. We will investigate your concern and respond within 30 days.

If you remain unsatisfied, or if you prefer to complain directly to the regulator, you have the right to make a complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Making a complaint to the ICO does not affect your right to bring civil proceedings against us.

We review this Privacy Policy regularly and will update it when our practices change or when required to do so by changes in law or guidance. When we make material changes, we will notify active clients by email and will post a notice on our website.

The version number and "last updated" date at the top of this page indicate when the current version was published.