Home » Website Privacy Policy – YoungEducation

Privacy that supports trust YoungEducation uses personal information carefully, explains its choices clearly and gives children, families, professionals and other website users meaningful control wherever the law allows.

Privacy at a glance

Our promise We collect only information we reasonably need, use it for clear purposes, apply stronger safeguards to children’s and sensitive information, and do not sell personal information. We do not use the public website to make solely automated decisions with legal or similarly significant effects.

What you need to know	Summary
Controller	YoungEducation Ltd, company number 07209035.
Main uses	Operating the website; responding to enquiries and referrals; arranging and delivering services; safeguarding; recruitment; security; legal compliance; and marketing where lawful.
Sensitive information	Health, SEND, safeguarding and other special-category information is used only where necessary and an additional legal condition applies.
Children	We use clear explanations, high-privacy defaults where the Children’s Code applies, and information appropriate to age and understanding.
Your choices	You can manage optional cookies, object to direct marketing and exercise data-protection rights.
Contact	info@youngeducation.co.uk | 0800 888 6221

1. Who is responsible for your information?

YoungEducation Ltd (we, us or our) is the controller of personal information used for its own website, enquiries, direct customer relationships, recruitment, administration, security and legal obligations.

Controller details	Information
Legal name	YoungEducation Ltd
Company number	07209035
Registered office	152 Wisden Road, Stevenage, England, SG1 5JB
Email	info@youngeducation.co.uk
Telephone	0800 888 6221

For a service commissioned by a school, local authority or another organisation, responsibilities depend on the arrangement. The commissioner and YoungEducation may be separate controllers, joint controllers or controller and processor. The contract, referral information or a service-specific privacy notice will explain the arrangement where it affects you. Contact either organisation if you are unsure; we will help route the request.

2. Scope of this policy

This policy explains how we use personal information when you visit a YoungEducation website, use an online form or portal linked to this notice, make an enquiry or referral, apply for work, subscribe to updates, attend an online event, or otherwise communicate with us through the website.

It applies to children and young people, parents and carers, prospective and current customers, school and local-authority professionals, website visitors, applicants, tutors, suppliers and other contacts. A separate workforce or learner privacy notice may provide more detail once a person works with us or receives a service. That specific notice should be read with this one.

External services have their own privacy notices. Please review them before use.

3. Information we collect

Category	Examples
Identity and contact	Name, title, organisation, role, postal address, email, telephone number, account identifiers and preferred contact method.
Learner and referral	Date of birth, school or setting, year group, attendance, educational history, learning needs, EHCP or SEND information, referral reason, desired outcomes, support plan and funding or commissioner details.
Health and safeguarding	Disability, medical needs, allergies, mental health, risk assessments, family circumstances, safeguarding concerns, professional involvement and information needed to protect a child or adult at risk.
Enquiry and communications	Form entries, emails, call notes, requested services, preferences, feedback, complaints and records of our response.
Account and service	Portal access, bookings, attendance, session records, uploaded documents, progress information and account activity where the relevant service uses the website or a linked portal.
Payment and commercial	Payer and billing details, transaction reference, invoices and payment status. A regulated payment provider normally processes full card details.
Recruitment	Application, work history, qualifications, references, right-to-work and safeguarding checks, interview notes, availability and reasonable-adjustment information.
Website and device	IP address, browser, device, operating system, pages and links used, date and time, approximate location derived from IP, security events, cookie identifiers and consent choices.
Media and feedback	Photographs, video, audio, case studies, reviews and testimonials where lawfully collected.
Marketing	Subscription, campaign engagement, event interest and records of consent, opt-out or objection.

Please give us only information that is accurate, relevant and necessary. If you provide information about another person, you must have authority or another lawful reason to do so and, where appropriate, make this notice available to them. This does not prevent a person sharing a genuine safeguarding concern.

4. Where information comes from

• you, a parent, carer or learner;
• a school, local authority, commissioner, health or social-care professional, previous provider or authorised advocate;
• our staff, tutors, mentors and systems when arranging or delivering a service;
• recruiters, referees, public professional registers, DBS or other lawful vetting sources for applicants;
• our website, consent manager, security tools and service providers;
• public sources where the information is relevant, proportionate and lawful, such as an organisation’s website or Companies House.

5. Why we use information and our lawful bases

We use personal information only where we have a lawful basis. More than one basis may apply. Consent is used only where there is a genuine choice; we do not rely on consent where another basis better reflects a legal duty or necessary service use.

Purpose	Normal UK GDPR basis
Operate, maintain, secure and troubleshoot the website; prevent misuse and fraud	Legitimate interests in providing a safe, reliable service; legal obligation where a specific duty applies.
Respond to a service enquiry, assess suitability and take requested steps before a customer contract	Steps at the individual’s request before a contract; legitimate interests for a commissioner or professional enquiry.
Create and administer a customer booking or contract	Performance of a contract; legal obligation for tax, accounting, consumer and safeguarding requirements.
Receive, assess and manage a learner referral or commissioned service	Contract, legal obligation, legitimate interests in delivering safe education support, or another basis identified in the relevant commissioner arrangement.
Protect children and adults at risk; respond to concerns, incidents or emergencies	Legal obligation, vital interests, and/or legitimate interests; additional special-category or criminal-data conditions also apply.
Recruit and onboard staff, tutors, mentors or volunteers	Steps before a contract; legal obligations; legitimate interests in safe and effective recruitment.
Process payment, invoices and debt; prevent financial abuse	Contract, legal obligation and legitimate interests.
Handle questions, feedback, service complaints, claims and legal rights	Contract, legal obligation and legitimate interests in resolving concerns and establishing or defending legal claims.
Handle a data-protection complaint	Legal obligation under the Data (Use and Access) Act 2025 and legitimate interests in fair resolution and service improvement.
Send direct marketing or event updates	Consent where PECR requires it; otherwise legitimate interests, including the business-customer or soft-opt-in rules where all conditions are met. Every message offers an easy opt-out.
Use optional cookies, pixels or similar technologies	Consent where required by PECR and UK GDPR. A statutory PECR exception is used only where every condition is met.
Publish a testimonial, case study, child image or optional media	Consent or another clearly explained lawful basis appropriate to the context; sensitive or child-related publication receives additional scrutiny.
Improve services, analyse trends and plan capacity using proportionate information	Legitimate interests, or consent for tracking where required; information is aggregated or de-identified where reasonably possible.

 

6. Legitimate interests

Where we rely on legitimate interests, we identify a real and lawful purpose, consider whether the use is necessary, and balance it against the person’s rights and reasonable expectations. We apply additional care where a child, vulnerable person, sensitive information, monitoring or an unexpected use is involved. You may ask for information about a particular balancing assessment and may object as explained in section 15.

7. Special-category and criminal-offence information

Health, disability, SEND, ethnicity, religion, sexual orientation and some safeguarding information may be special-category data. We use it only where an Article 9 condition and, where required, a Data Protection Act 2018 Schedule 1 condition apply. Depending on the facts, this may include safeguarding children or people at risk, health or social care, employment and social-protection law, substantial public interest, legal claims, vital interests, or explicit consent for a genuinely optional use.

Information about criminal allegations, convictions or offences is used only under official authority or where Article 10 UK GDPR and an appropriate Data Protection Act 2018 condition permit it—for example safe recruitment, safeguarding, preventing or detecting unlawful acts, or establishing legal claims. Access is restricted and our appropriate policy document is used where the law requires one.

We do not ask for detailed sensitive information through a general enquiry form unless it is necessary and the form is designed and secured for that purpose. We may move a conversation to a more secure channel.

8. Children and young people

A message for children and young people You can ask us what information we have about you and why we use it. We will explain it in a way you can understand. We will not ask you to share more than we need. If something worries you, speak to a trusted adult or contact us. If you are in immediate danger, call 999.

 

• A child’s data-protection rights belong to the child. A parent or carer may help exercise them where the child authorises this or it is appropriate in light of age, understanding, best interests and the law.
• Information is explained in concise, prominent and age-appropriate language. We provide “just in time” explanations where a form or feature could have an unexpected effect.
• Where an online service is likely to be accessed by children and the Children’s Code applies, privacy settings are high by default unless a documented compelling reason based on the child’s best interests justifies otherwise.
• We collect and retain the minimum information needed for the service a child is actively using and do not use manipulative design or nudge children to reduce privacy.
• Safeguarding may require us to share information without consent where this is necessary and lawful to protect a child or another person. We explain this unless doing so would create risk or prejudice lawful action.

9. Cookies and similar technologies

Cookies and similar storage or access technologies can remember settings, keep a service secure, measure use or support embedded content. Our consent tool gives information about the technologies currently in use at [COOKIE LIST LINK] and lets you review choices at [COOKIE SETTINGS LINK].

Type	How we handle it
Strictly necessary / communications	Used without consent only where necessary to transmit a communication or provide a service the user requested, such as security, session, load-balancing or consent-choice functions.
Low-risk statistics	Used without consent only if the sole purpose is statistical information to improve the service and every PECR condition is met, including clear information and a simple way to object. Otherwise we ask for consent.
Appearance or functionality	Used without consent only if the sole purpose is adapting appearance or functionality to the user’s preference and every legal condition is met. Otherwise we ask for consent.
Preferences, analytics, media or marketing requiring consent	Blocked until the user makes a clear positive choice. Rejecting must be as easy as accepting, and withdrawal is available through cookie settings.

 

Browser controls can also delete or block cookies, but may affect functions you request. The live cookie list identifies purpose, provider and duration. We review the website after releases and supplier changes so the list and controls remain accurate.

10. Direct marketing

We send individual subscribers electronic marketing only with consent or another PECR route that lawfully applies, such as the soft opt-in for our own similar services where all conditions are met. We may contact business professionals about relevant services under the business-to-business rules and legitimate interests, while respecting objections and individual contact protections.

You can stop direct marketing at any time by using the unsubscribe link or contacting info@youngeducation.co.uk. We may keep a minimal suppression record so we do not contact you again. Service, safeguarding, legal and account messages are not marketing and may still be sent where necessary.

We do not sell personal information or provide a marketing list to another organisation for its independent use. If we ever propose a materially different marketing or data-sharing use, we will explain it and obtain any consent the law requires before it starts.

11. Who we share information with

We share the minimum necessary information with recipients that have a lawful role. Depending on the service, these may include:

• website hosting, security, forms, email, document storage, communications, customer-management, booking, learner-management and IT-support providers;
• payment processors, banks, accountants and debt-recovery providers;
• schools, local authorities, commissioners, parents or carers and relevant education, health, social-care or safeguarding professionals;
• staff, tutors, mentors, contractors and approved delivery partners who need information for their role;
• recruitment, identity, right-to-work, qualification, reference and DBS checking services;
• insurers, professional advisers, auditors and certification bodies;
• police, courts, regulators, safeguarding bodies and public authorities where disclosure is required or permitted by law;
• a prospective buyer, funder or restructuring adviser under confidentiality and due-diligence controls if our organisation changes.

A supplier acting for us must follow written instructions, confidentiality, security, deletion and assistance requirements. If a recipient decides its own purposes, it is responsible as a separate controller and should give its own privacy information. We do not share information merely because someone asks; we verify identity, authority, necessity and legal basis.

12. International transfers

Some suppliers may store or access information outside the United Kingdom. Before a restricted transfer, we use a lawful safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted mechanism. We complete the transfer risk assessment required by current law and apply supplementary security where needed.

You may contact us for information about the relevant safeguard. Commercial confidentiality and the rights of others may limit the copy we can provide, but we will explain the protection in a meaningful way.

13. Security

We use proportionate organisational and technical measures designed to protect information against accidental or unlawful loss, alteration, access, disclosure or destruction. These include role-based access, authentication, secure configuration, encryption where appropriate, supplier due diligence, backups, logging, training, incident response and retention controls.

No internet transmission is completely risk-free. Use the secure route we identify for detailed learner, health or safeguarding information and tell us promptly if you believe information or an account has been compromised. We assess incidents and notify affected people and the ICO where the law requires it.

14. How long we keep information

We keep information only as long as reasonably necessary for the stated purpose, safeguarding, law, commissioner terms, tax, insurance, complaints and legal claims. We consider the child’s age, sensitivity, volume, risk, limitation periods and whether de-identification can meet the need.

Record	Indicative period
General website enquiry that does not become a service	Normally up to 24 months after the last substantive contact, then deleted or de-identified unless a complaint, safeguarding matter, consent or legal need justifies longer.
Customer, referral and learner service records	Under the applicable YoungEducation retention schedule, safeguarding requirements and commissioner contract. The relevant learner or service privacy notice gives more detail.
Website security and access logs	Normally up to 12 months, subject to risk, incident investigation and supplier configuration.
Cookie and consent records	For the duration shown in the live cookie list and as needed to evidence or respect the choice.
Marketing contacts	Until consent is withdrawn, an objection is made or the contact becomes inactive under our review cycle; a minimal suppression record may be retained.
Unsuccessful recruitment application	Normally six months after the process ends; up to 12 months for a talent pool only with a clear choice or another lawful basis.
Website or data-protection complaint	Normally up to six years after closure where needed for accountability or legal claims, with earlier review for unnecessary sensitive material.
Financial and tax records	Normally six years after the relevant financial period, or longer where law or an active dispute requires.

 

A legal hold, safeguarding duty, investigation or claim may pause deletion. Information is securely deleted or irreversibly anonymised when no longer required. Backup copies are isolated from normal use and expire under the backup cycle.

15. Your rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• ask for access to your personal information and a copy;
• ask us to correct inaccurate or incomplete information;
• ask for erasure where there is no continuing lawful reason to keep it;
• ask us to restrict use while an issue is resolved;
• receive information you provided in a structured, commonly used, machine-readable format and have it transmitted where data portability applies;
• object to use based on legitimate interests, including profiling, and object at any time to direct marketing;
• withdraw consent at any time, without affecting earlier lawful use;
• request safeguards concerning a solely automated decision with legal or similarly significant effects, if such processing is introduced.

To exercise a right, contact info@youngeducation.co.uk. Please describe the request and relevant relationship or reference. We may ask for proportionate proof of identity or authority, especially where a child or sensitive record is involved. We normally respond within one month, subject to lawful extensions and exemptions. We do not charge unless the law allows a reasonable fee.

A right is not absolute. For example, safeguarding, another person’s rights, legal privilege, statutory retention or an active claim may limit what we can disclose or delete. We will explain a refusal or restriction and the available complaint route.

16. Automated decisions and profiling

The public website does not make a decision about a person based solely on automated processing where that decision has legal or similarly significant effects. Security tools may automatically flag unusual activity, and analytics may group website use, but a significant service, safeguarding, recruitment or learner decision receives meaningful human involvement.

If we introduce relevant automated decision-making, we will complete an impact assessment where required, update this policy before use, explain the logic and likely consequences, and provide the rights and human review required by law.

17. Data-protection complaints

Tell us first so we can put things right Email info@youngeducation.co.uk with “Data protection complaint” in the subject, use the privacy complaint form on our website if available, telephone 0800 888 6221, or write to our registered office. We will help you set out the concern and any outcome you seek.

 

• We acknowledge a data-protection complaint within 30 days of receiving it.
• We begin appropriate enquiries without undue delay, consider the relevant facts and keep the complainant informed where the investigation continues.
• We communicate the outcome without undue delay and explain any action, refusal, review route or next step.
• We make reasonable adjustments and accept a representative where authority is appropriately demonstrated.

You also have the right to complain to the Information Commissioner’s Office (ICO). Information and the complaint service are at https://ico.org.uk/make-a-complaint/. The ICO can be contacted on 0303 123 1113. We would welcome the opportunity to resolve the issue first, but this does not reduce your right to contact the ICO.

18. Changes to this policy

We review this policy at least annually and sooner after a material legal, technology, supplier, service, safeguarding or organisational change. The website shows the current version and effective date. If a change is likely to have a material effect on people, we will make it prominent and provide additional notice where appropriate.

A new purpose that is incompatible with the original purpose will not begin without a new lawful basis and any information or consent required by law. Archived versions are available on reasonable request where this is needed to understand earlier use.

19. Contact us

Questions, rights requests and data-protection complaints may be sent to:

Route	Details
Email	info@youngeducation.co.uk
Telephone	0800 888 6221
Post	YoungEducation Ltd, 152 Wisden Road, Stevenage, England, SG1 5JB

 

If you need this notice in another format or need help understanding it, tell us the format or support that would help. We will respond in an accessible way wherever reasonably possible.

Call 0800 888 6221 or email info@youngeducation.co.uk.

See also our Website Terms and Conditions.