Privacy Notice

Last updated: November 2025

1. Introduction

This Privacy Notice outlines how we collect, use, store, transfer, and protect personal data about pupils and school staff, as well as parents/guardians, clients, and contractors. It explains your rights and our obligations under the UK General Data Protection Regulation (UK GDPR) and related laws.

All the information you need to know about how and why we collect, use, store, transfer and keep secure personal data about you which relates to you parents/guardians, clients, and contractors ('Data').

We are committed to protecting the privacy and security of your Data in accordance with the UK General Data Protection Regulation (UK GDPR) and relevant UK law.

This Privacy Notice should be read in conjunction with our Data Protection Policy / Privacy Standard and Data Retention Policy.

1.1 For Employee, Worker, or Self-Employed Consultant

IT IS IN YOUR INTERESTS TO READ THIS PRIVACY NOTICE AS IT CONTAINS IMPORTANT INFORMATION ON HOW AND WHY WE ARE USING YOUR DATA AND WHAT WE WILL DO WITH IT EVEN AFTER YOU HAVE STOPPED WORKING FOR US.

For ease, throughout this notice, we use employee to cover all staff, contract of employment to cover all types of work or provision of service contracts, job offers to cover offers of work or provision of services.

This Privacy Notice does not form part of your employment contract and may be updated by us at any time.

2. UK GDPR Data Protection Principles

We comply with UK data protection law and UK GDPR. This says that any Data we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any other way.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

These principles apply to Data about you, from which you can be identified. It does not include data where your identity has been removed (anonymous data).

3. The different types of Data we hold and why we hold them.

3.1 These are the types of Data we may hold about you:

DATA THAT MAY BE ENTERED INTO PROCESSOR HR SOFTWARE SPECIFIC FIELDS

DATA THAT MAY BE HELD BY THE COMPANY AS CONTROLLER IN EMPLOYEE DOCUMENTS / FILE NOTES ON OUR HR SOFTWARE SYSTEM OR ELSEWHERE, INCLUDING ON PAPER

DATA THAT MAY BE HELD BY THE COMPANY ABOUT CLIENTS

We have good reason for wanting to hold all this Data.

3.2 Under the GDPR, we need to have a legal basis for processing your Data.

There are 6 acceptable reasons why we are allowed to hold your Data.

Mostly we rely on 3 of these:

• Where we need it to perform your employment contract (such as Data about your working hours or holiday entitlement),
• Where we need it to comply with a legal obligation (such as tax Data)
• Where it is necessary for our legitimate interests (or those of a third party), and where your interests and fundamental rights do not override those interests. (such as Employee of the Month Data)

Occasionally we may need to rely on 2 further reasons:

• Where we need it to protect your vital interests or someone else's (such as when there are serious Health and Safety issues),
• Where it is needed in the public interest.

And if none of these reasons apply, we will ask for your consent to hold Data. (see below under section 3.7)

3.3 And here's how these reasons relate to the Data we may hold about you:

3.4 Special Category Data

A small amount of the Data we may collect from you can be classified as 'Special Category Data'. Understandably, we have to be especially careful with this data, and we have to be satisfied that there are additional lawful reasons for holding it. This is Data that reveals:

• Racial or ethnic origin,
• Political opinions,
• Religious and philosophical beliefs,
• Trade union membership,
• Genetic data,
• Biometric data,
• Health data, or
• Sex life and sexual orientation.

Within the categories of information we have listed above in section 3.1, we may collect the following Special Category Data, and have outlined the lawful reasons for processing it:

• Sickness absence records and family leave records in order to comply with employment and other laws
• Other information about your physical, mental health or disability status, to ensure your health and safety in the workplace, to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence, and to administer any benefits.
• Covid-19 testing data and vaccination data to ensure the health, safety and welfare of employees in the workplace.

If we need to hold any other Special Category Data, we will ask for your explicit consent to hold it. (see below under section 3.7)

3.5 Criminal Convictions Data

We may hold Data about any criminal convictions you may have. We will only collect this Data if it is appropriate given the nature of your role and where we are legally able to do so.

We may collect Criminal Convictions Data in the following ways:

• In our recruitment process
• As part of a DBS Checking process
• Where you have notified us directly during your employment

We are permitted to hold this Data for one of the following reasons:

• You have voluntarily supplied it to us
• You have consented to carrying out a DBS check (see section 3.7 below)
• It is necessary to carry out employment rights and obligations, including, for example, where the employee is dealing with large amounts of sensitive data or is working with vulnerable individuals
• You have made the Data public, or
• It is necessary for us to establish or defend a legal claim

3.6 Consent

Here's what you need to know about the limited circumstances in which we may need your explicit, written consent to process specific elements of your Data:

a. Employee Photo

The use of your personal photo on our HR software system which identifies you as an employee of the company is entirely optional, and we will only use a photo of you if you consent. Please have a look at the information on your Personal Details Summary page about how to upload, edit or remove your photo on the HR software system.

b. Special Category Data and Criminal Convictions Data

In the limited circumstances where we are relying on your consent to provide us with either additional health or other Special Category Data, or to provide us with additional Criminal Convictions Data not covered by the reasons explained in sections 3.5 and 3.6 above, we will provide you with full details of the information we wish to collect and the reason we need it so that you can carefully consider whether you wish to consent. It is not a condition of your employment contract with us that you will agree to such a request. Our HR software system will alert you where consent is needed before you disclose the information there.

You have the right to withdraw your consent in relation to processing under (a) or (b) above at any time. To withdraw your consent, please contact your Manager. Once we have received your withdrawal of consent, we will no longer process your information for the purposes you originally agreed to, unless we have another legal basis for doing so which we will advise you of at the time.

4. Data Sharing

a. We will only share your personal information with third parties where required by law, where it is necessary to carry out our working relationship with you or where we have another legitimate interest in doing so.

Third parties will only process your Data on our instructions and where they have agreed to treat the Data confidentially and to keep it secure. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

A list of third-party service providers can be found in our Record of HR Processing Activity or by contacting your Manager.

b. On occasion we have data shared with us by third parties who collect and process personal data and then share this with us for such purposes as After School Clubs and Holiday Camps as part of our business model. It is important to note that we treat any data received in line with this privacy notice.

The third parties we have agreements with are:

• a) Class for Kids
• b) Holiday Activities

It is important to note that we do not control these third parties and are not responsible for their privacy statements. We advise that you take the time to read the privacy policies and notices directly.

[OPTIONAL IF PART OF A GROUP - We will share your personal information with other entities in our group for the following reasons:

• as part of our regular reporting activities on company performance
• in the context of a business reorganisation or group restructuring exercise
• for system maintenance support
• for hosting of data].

c. We may share pupil data with:

• a) Parents/guardians (for emergencies or updates).
• b) External safeguarding organizations (e.g., child protection agencies).
• c) Providers of educational and extracurricular programs (e.g., Class for Kids).

Currently none of your Data is transferred outside the UK. If this changes, we will notify you and you can expect a similar degree of protection in respect of your Data.

5. Data Security

We have put in place measures to limit access to your Data through our employment policies and the use of our HR software system. In addition, we limit access to your Data to those employees, agents, contractors and other third parties who have a business need to know. Appropriate security measures are in place to protect pupil and staff data, including limited access and encryption where needed. Breach notifications affecting pupils will involve parental/guardian notification.

We have put in place appropriate security measures to prevent your Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Further details about the security of your Data can be found in in the Privacy Policy on the HR software system and in our employment policies.

All our third-party service providers are required to take appropriate security measures to protect your Data in line with our policies. For further information please review the third-party service providers' Privacy Policies which can be found on their websites or by contacting your Manager.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

6. Data Retention

We also don't want to keep your data for any longer than is necessary. We do have legal obligations to keep your Data even after you have left, for example, under legal requirements from HMRC. We have created an HR Data Retention Policy, using the same categories of Data that are used in this HR Privacy Notice, and defined a retention period for each category. In situations where we are able to anonymise your Data, we may continue to process the anonymised data without reference to the HR Data Retention Policy.

Pupil data is retained for the duration of their participation in programs and as required by law for safeguarding purposes.

Staff data is retained for the duration of their employment or agreement with us as required by law.

7. Your rights in relation to your Data

It is important that you know what rights you have in relation to your Data.

7.1 Right to Request Access

You have the right to request – through a Subject Access Request – that we provide you with a copy of the Data we hold about you and to check that we are lawfully processing it. You already have direct access to the majority of the current data we hold on our HR software system, which you can access at any time. The only Data that is not accessible to you immediately is either any fields or Employee Documents or File Notes where your Manager, or a senior person within the company has decided, for legitimate business reasons, that it is not appropriate for you to have access, or some historic Data.

7.2 Right to Request Correction

You have the right to request that inaccurate or incomplete Data be corrected. Our HR software system gives you access to be able to correct much of your own Data, and we rely on you to ensure that you provide us with details of any changes in your personal circumstances.

7.3 Right to Object to Processing

Where we are processing Data only on the basis that it is necessary for our legitimate interests (or those of a third party) (see above section 3.4), you have the right to object to that processing and it is then for us to establish whether your interests and fundamental rights override those interests.

7.4 Right of Erasure (the 'right to be forgotten')

You have the right to request that we delete your Data where there is no good reason for us continuing to process it. You will appreciate that much of your Data is essential for you and us to be able to work effectively. For instance, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers). This right mainly applies when you have objected to processing (see section 7.3 above) or you are withdrawing your consent.

7.5 Right to Restrict Processing

You have the right to ask us to suspend processing your Data whilst its accuracy or reason for processing is established. However, there may be certain circumstances where we cannot suspend processing if it prevents us complying with a legal obligation, or without impacting our ability to continue to employ you. If this situation occurs, we will advise you at the time the reason why we cannot suspend processing.

7.6 Right of Data Portability

You have the right to request that we transfer your Data to another organisation when you leave our employment.

To exercise any of these rights, please put a request in writing to your manager. You will not have to pay a fee to access your Data or to exercise any of these rights. However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been breached. You can do this by visiting their website at https://ico.org.uk/

Data protection officers (DPOs) Commissioner details:

Ellis Remy
Email: info@firstkickseducation.uk

If you have any questions or concerns about our Privacy Notice Policy or our data practices, please contact us at:

First kicks Education Ltd
Contact: 07984165626
850 Green Lanes London N21 2RS
Samuel Okikiolu
Email: info@firstkickseducation.uk