-
Home
-
Privacy Policy
Privacy Policy
Privacy Policy
Version 1.3 · Approved: September 2026 · Next review: September 2027 · The Sprout School Ltd (company no. 17162414), 11 Portland Road, Edgbaston, Birmingham, B16 9HN · info@thesproutschool.com
How we collect, use, protect, record and retain personal information.
Contents
Part 1: Privacy Notice
Part 2: Recording, Photography & Video Policy
Part 3: Data Security, Retention & Breach Policy
References in this document to another named policy (for example "our Privacy Policy" or "Safeguarding Policy") mean the relevant Part of our five policy documents: Terms & Conditions; Fees, Refunds & Sales Policy; Privacy Policy; Cookie Policy; and Safeguarding & School Policies Handbook.
Part 1: Privacy Notice
1.1 Who we are
The Sprout School Ltd is the data controller for the personal information described here. Company number 17162414. Registered office: 11 Portland Road, Edgbaston, Birmingham, B16 9HN, United Kingdom. ICO registration number: [insert]. Data Protection Lead: the Director, info@thesproutschool.com. We comply with the UK GDPR, the Data Protection Act 2018, PECR and, where applicable, the EU GDPR.
1.2 What we collect
Parent/guardian, or adult learner: name, contact details, address, billing and payment records, communications.
Student: name, date of birth, year group, prior school, academic records, attendance, work, assessments, reports, lesson participation and chat logs.
Special category data (only where needed): health, medical and SEND information, and information relevant to safeguarding.
Lesson recordings (see Recording Policy), and technical data such as IP address, device and cookies on our website and platform.
Exam booking data: candidate details needed by a third-party exam centre.
1.3 Why we use it and our lawful basis
To deliver the education contract (contract).
To keep children safe and share safeguarding concerns with authorities (legal obligation / vital interests / substantial public interest — safeguarding of children).
To make reasonable adjustments for SEND or medical needs (explicit consent or substantial public interest).
To run our business, improve teaching and prevent fraud (legitimate interests).
To meet tax, accounting and legal requirements (legal obligation).
To send marketing emails (consent, which you can withdraw at any time).
1.4 Who we share it with
We do not sell personal data. We share only what is necessary with: our learning and video-conferencing platform (Microsoft Teams), email and payment providers (acting as processors under written contracts); third-party exam centres you ask us to book with (with your consent); local authority children's services, police or LADO where required for safeguarding; professional advisers and insurers; and regulators or courts where legally required.
1.5 International transfers
Some providers may process data outside the UK. We only transfer data where adequate safeguards exist, such as UK adequacy regulations or the International Data Transfer Agreement/Addendum.
1.6 How long we keep it
In line with our Data Security, Retention & Breach Policy — for example, lesson recordings 90 days, student academic records 6 years after leaving, financial records 6 years plus current year, safeguarding records until the student's 25th birthday or longer where required.
1.7 Your rights
You have the right to access, rectify, erase, restrict, object to processing, data portability, and to withdraw consent. Students aged about 12 or over are generally considered able to exercise their own rights. Email us to make a request; we respond within one month. You may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we would appreciate the chance to resolve concerns first.
1.8 Security
We use access controls, encryption, multi-factor authentication and staff training to protect your data (see our Data Security Policy).
1.9 Changes
We will post updates here and notify you of significant changes. Last updated: September 2026.
Part 2: Recording, Photography & Video Policy
2.1 Lesson recordings
Live group lessons and all 1:1 sessions are recorded to safeguard students and staff and to support learning. Participants are told at the start of each lesson that it is being recorded.
2.2 Access and retention
Recordings are stored on Microsoft Teams / our approved storage, accessible only to enrolled students of that class (for learning), relevant staff and a Safeguarding Specialist. They are deleted after 90 days unless needed for a safeguarding, complaints or legal matter.
2.3 Prohibited
Students, parents and staff must not make their own recordings, screenshots or photos of lessons or other participants.
2.4 Marketing use
We will only use a student's image, voice, name or work in marketing with specific, written, opt-in consent from the parent (and the student where aged 12+). Consent can be withdrawn at any time. We never publish full names with images of children.
Part 3: Data Security, Retention & Breach Policy
3.1 Security measures
Teams meeting recordings are set to expire automatically after 90 days.
Multi-factor authentication for all staff accounts; strong unique passwords managed with a password manager.
Role-based access: staff see only the data they need.
Data stored only on approved, encrypted systems (Microsoft 365, including Teams, OneDrive and SharePoint, and our payment provider). Our cookie banner blocks non-essential cookies until consent is given; no student data on personal devices or USB drives.
Devices kept updated, with antivirus and screen locks. Staff complete annual data protection and cyber awareness training.
Processors are bound by written data processing agreements.
3.2 Retention schedule (summary)
Registration and deposit records: 6 years plus current year.
Enquiries not converted: 12 months.
Student academic and attendance records: 6 years after leaving.
SEND and medical records: 6 years after leaving (or until age 25 if longer).
Safeguarding/child protection files: until the student's 25th birthday; longer where legal proceedings or inquiries require.
Allegations against staff: until retirement age or 10 years, whichever is longer.
Lesson recordings: 90 days unless required for an investigation.
Financial records: 6 years plus current year.
Staff personnel files: 6 years after employment ends; recruitment records of unsuccessful candidates: 6 months.
Records are securely deleted at the end of retention.
3.3 Data breaches
Every breach or near miss is recorded in our breach log: date found, what happened, data and people affected, risk assessment, actions taken, whether the ICO and individuals were told, and lessons learned.
Any suspected breach must be reported to the Data Protection Lead immediately.
We contain, assess risk and record every breach.
Where there is a risk to individuals, we notify the ICO within 72 hours of becoming aware; where the risk is high, we inform those affected without undue delay.
3.4 Subject access requests
Handled within one month by the Data Protection Lead, with safeguarding-sensitive information reviewed by a Safeguarding Specialist before release.