Privacy Policy

1. Website chat and email follow-up

2. Who We Are

ANCHOR Inclusion® provides early-help support, training and guidance for schools, families and professionals, with a focus on inclusion, wellbeing and practical strategies.

We are the Data Controller for personal data collected through this website and in the delivery of our services. We are not required to appoint a Data Protection Officer. Data-protection responsibilities are overseen by S Asha. If this changes, this policy will be updated accordingly.

3. What Information We Collect

We may process personal data relating to:

• Individuals making enquiries about our services
• Parents or carers seeking support for their child
• Children and young people, through parents, carers or schools
• School staff and education professionals
• Funders and partner organisations

The types of data we may collect include:

• Name and contact details, including email address and phone number
• Information provided through enquiries, referrals or bookings
• Information relevant to delivering support or training
• Limited sensitive information where necessary, as explained in Section 6
• Website-usage data, including IP addresses, as explained in Section 12

We apply the principle of data minimisation: we collect and use only the information necessary for each specific purpose.

4. How We Use Your Information

We use personal data to:

• Respond to enquiries and communications
• Deliver services, support and training
• Manage bookings and professional relationships
• Maintain appropriate records
• Send newsletters or service updates where you have subscribed
• Improve and develop our services

Information collected for research, evaluation or service-development activities will be used only for those stated purposes and handled in accordance with applicable data-protection law.

5. Lawful Basis for Processing

We process personal data under the following lawful bases:

• Legitimate interests: responding to enquiries and providing appropriate support
• Contract: delivering agreed services or training
• Consent: where information is provided voluntarily and specific consent is required
• Legal obligation: where we must comply with safeguarding or other legal duties, including relevant UK legislation and statutory guidance

Where we rely on legitimate interests, we do so only where processing is necessary for the operation of our services. We have carried out a Legitimate Interests Assessment to ensure that processing is fair, balanced and does not override your rights and interests.

6. Data Use Overview

• Names, email addresses and contact details used to respond to enquiries: legitimate interests; retained for up to 12 months after last contact.
• Contact and booking details used to deliver services and training: contract; retained for up to 6 years.
• Service-related information used to provide appropriate support and tailor services: legitimate interests and/or contractual necessity; retained for up to 6 years.
• Sensitive information used for safeguarding and support where applicable: legal obligation and/or consent; retained for up to 6 years.
• Funder and stakeholder contact details used to manage relationships and communications: contract and/or legitimate interests; retained for up to 6 years.
• Website analytics used to improve user experience: consent; retained according to the applicable analytics settings.
• IP addresses and device data used for functionality, security and performance: legitimate interests; retained according to the website-hosting provider’s retention policies.

7. Special Category Data (Sensitive Information)

In some cases, we may process limited sensitive information, such as information relating to wellbeing, additional needs or safeguarding concerns. We do this only where it is necessary to provide appropriate support, explicit consent is given, or there is a safeguarding or legal obligation.

Where we process special-category data, we do so under Article 9 UK GDPR, including substantial public interest for safeguarding and explicit consent where applicable. All such information is handled with strict confidentiality and care.

8. Safeguarding and Confidentiality

We operate within a safeguarding-informed framework. Information shared in a professional context is treated respectfully and confidentially. If there are concerns about the safety or wellbeing of a child or individual, relevant safeguarding procedures will be followed in line with UK guidance.

9. Data Sharing

We do not sell personal data. We may share information where necessary with:

• Schools or professionals directly involved in support, where appropriate
• Safeguarding authorities where required
• Trusted third-party service providers, including the tools described in Section 12

All sharing is purposeful, carefully considered and carried out in line with our legal obligations. Third-party providers act as processors under contractual agreements. Schools and safeguarding authorities may act as separate Data Controllers.

10. Data Retention

We retain personal data only for as long as necessary:

• Enquiry data: up to 12 months after last contact
• Service-related records: up to 6 years, in line with safeguarding and legal requirements
• Funding and financial records: up to 6 years

Data is securely deleted when no longer required.

11. Data Security

We use appropriate technical and organisational measures to keep personal data secure, including secure email systems, access controls and careful handling of sensitive information. We regularly review our practices against UK GDPR and ICO guidance. Data protection is treated as an active responsibility.

12. International Data Transfers

Some third-party tools listed in Section 12 may process data outside the UK, including website infrastructure, Google Workspace and PayPal services. Transfers are safeguarded using applicable UK adequacy regulations, International Data Transfer Agreements or standard contractual clauses where required.

We do not routinely transfer personal data outside the UK in the course of delivering our own services.

13. Cookies and Third-Party Technologies

What are cookies?

Cookies are small text files placed on your device when you visit a website. Some are essential for the site to work; others help us understand how visitors use it.

What we use and why

• Website hosting and form storage: OpenAI Sites and its infrastructure providers, including Cloudflare, host the website and securely receive information submitted through its forms.
• Device storage: this site stores your accessibility settings and cookie choice on your device so they continue across pages and visits.
• Google Workspace: Gmail and Google Drive are used for operational email, opted-in programme updates and secure document storage.
• Eventbrite: we link to an external ANCHOR event-listing page. Eventbrite applies its own privacy and cookie terms when you visit it.
• PayPal Business: PayPal will process certification payments once checkout is enabled. PayPal receives and processes payment and account information under its own privacy terms. ANCHOR Inclusion® does not receive full card details.

Cookies and consent

This website does not use Google Analytics or advertising cookies. Essential technologies may be used for security, form handling, private-site access and remembering accessibility and privacy choices. They cannot be switched off through our banner because they are needed to provide the service you request.

Optional first-party analytics is disabled unless you select Accept analytics. Rejecting is offered alongside accepting, and you can change your choice at any time using Cookie settings. No advertising technology or session replay is enabled.

Tes SEND Show offer requests

When you request a show offer, we record your name, email, selected audience, consent wording and time, email delivery, payment-link activity, booking and payment status. We use these details to send the requested offer and one reminder on 14 October 2026 if you have not paid or booked. You can stop offer emails using the link in the email or by contacting us. This consent does not subscribe you to a general newsletter.

On stand tablets, an unsent request is encrypted and held locally until it uploads. The visible form clears after submission. Encrypted copies are deleted from that tablet after successful upload. Keep the tablet connected and the signup page open to finish sending queued requests. Resend processes offer email delivery. Admin access to these records is restricted.

Email marketing

If you subscribe to newsletters or email updates, we will contact you only where you have actively opted in. Every communication will include a clear unsubscribe option. We do not use pre-ticked opt-in boxes.

14. Your Rights

Under UK data-protection law, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion where there is no lawful reason for continued retention
• Object to processing in certain circumstances, including where we rely on legitimate interests
• Restrict processing, for example while accuracy or an objection is being considered
• Receive eligible data in a structured, commonly used and machine-readable format
• Withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing

To exercise a right, contact us using the details in Section 20. We will respond within one calendar month.

15. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling in the delivery of our services or processing of personal data. Decisions relating to support, referrals or professional recommendations are made by a person. If this changes, this policy will be updated to explain the change and your rights.

16. Children’s Data and Information Shared by Parents or Carers

Our work with children and families

Some services involve working with or on behalf of children and young people. We take their privacy and safety seriously and handle information with particular care, in line with UK GDPR and the ICO’s Children’s Code.

Information shared by parents or carers

Where a parent or carer contacts us about a child, we may collect the child’s name, age and year group; information about their needs, wellbeing or circumstances; and details relevant to the support sought. We use this information only to provide appropriate early-help support. We do not share it beyond those directly involved without consent, except where safeguarding duties require it.

Parents and carers may ask what information we hold about their child, request correction or deletion, and withdraw consent for non-essential processing. Where a child is old enough to understand, we aim to involve them appropriately in decisions about their information, taking account of age, capacity and best interests.

A note on children using our website

Our website is not directed at children. We do not knowingly collect personal data directly from children under 13. If you believe a child has submitted information without appropriate consent, contact us and we will delete it promptly.

17. Schools as Data Controllers

When we work with schools, ANCHOR Inclusion® and the school may act as separate Data Controllers. In some cases, we may act as a processor for the school. The relationship will be clarified at the point of engagement where relevant.

• Schools remain responsible for their data-protection obligations relating to pupils, families and staff.
• Information received from a school is used only for the purpose for which it was shared.
• We do not retain school-shared information beyond what is necessary for the service.
• Sharing is proportionate, lawful and aligned with both parties’ safeguarding responsibilities.

Schools should ensure that their privacy notices reflect relevant arrangements with external providers, including ANCHOR Inclusion®.

18. Funders and Professional Stakeholders

When working with funders, commissioners or professional stakeholders, we may process names, job titles, contact details and information relevant to applications, reporting or partnerships. We use this information to manage funding relationships, reporting and professional communications, and to meet contractual or legal obligations.

Processing is based on contract where an agreement exists and legitimate interests for ongoing professional communication. Records are retained for up to 6 years.

19. Research and Participant Data

Information collected for research, evaluation, consultation, training feedback or service improvement will be used only for the purpose for which it was collected. We do not use participant information for unrelated marketing, profiling, targeting or commercial purposes. We will not attempt to re-identify people from anonymised or pseudonymised information, or contact participants for unrelated purposes unless they have separately consented.

20. Complaints

If you have concerns about how we handle your data, please contact us first. You may also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

21. Contact

22. Updates to This Policy

We may update this policy to reflect changes in services, legal requirements or best practice. The version number and date will be updated accordingly. We recommend checking this page periodically.

23. Website analytics and workshop waitlist

Workshop waitlist

We collect an adult’s name and email, preferred venues and times, child age bands and broad support interests to plan workshops and respond to the request. The private planning dashboard uses aggregate counts by venue, weekday and time and does not display contact details or free-text answers. Diagnosis is not required and the diagnosis field is not open. Do not include identifying child information or health records in a general challenge description. The shared contact inbox is managed by authorised ANCHOR Inclusion staff. New requests are recorded in a restricted action centre and reviewed twice each working day. Notification messages contain only the enquiry type, reference and priority, not the person’s form answers.

Contact info@anchorinclusion.co.uk to withdraw a waitlist request. General enquiries and waiting-list records are reviewed for deletion or anonymisation 12 months after the last meaningful contact, unless they are needed for an active service, a legal obligation or the establishment, exercise or defence of legal claims. A brief request for contact about a complaint or safeguarding concern is kept in this general queue only until it is triaged; any resulting case record is moved to a separately restricted process with its own retention rule.

24. Consent at Enquiry, Membership and Payment

Consent is requested for a specific purpose and is not bundled with unrelated marketing. Enquiry and waitlist forms ask for permission to respond and link to this privacy information. Newsletter or promotional messages require a separate opt-in and include an unsubscribe route.

Before paid membership or checkout goes live, the purchase journey must present the applicable terms, price and renewal information, this privacy notice, and any parent or carer authority statement needed for the service. Where special-category information is genuinely necessary and consent is the appropriate condition, explicit consent will be requested separately. Safeguarding or legal duties may provide a different lawful basis.

These controls support compliance but do not replace a pre-launch legal, data-protection and safeguarding review of the final payment, account, calendar and third-party service configuration.

25. Practitioner learning, recordings and research consent

Practitioner learning, supervision, family sessions and observations are not recorded. Do not include child names, dates of birth, schools or diagnoses in training records or feedback material. Written information still needs secure handling and retention rules.

Consent for service improvement and anonymised research publication is separate. Declining research use does not change the service received. Children can decline a session or observation without being penalised.

Public practitioner verification will show current active, suspended or inactive status without publishing allegations or annual removal lists.