Privacy POLICY

Last Updated: February 2026

Review Date: February 2027

This Privacy Policy explains how The Complete Education Solution (TCES) collects, uses and protects personal information when you use our website or engage with our services.

TCES is committed to protecting the privacy and security of children, young people, families, staff and partners. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection laws.

1. Who We Are

The Complete Education Solution (TCES) is the Data Controller for the personal data described in this policy.

If you have any questions about this policy or how we handle your data, please contact:

Data Protection Officer
TCES
3rd Floor, Beacon House
26–28 Worple Road
London SW19 4EE

• If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
  www.ico.org.uk

2. The Information We Collect

The information we collect depends on how you interact with us.

We collect personal data either directly from individuals (for example, through enquiry forms, admissions processes or job applications) or from third parties such as Local Authorities, previous education settings, regulatory bodies or recruitment agencies where this is necessary for education provision, safeguarding or employment processes.

a) Website Visitors

When you visit our website, we may collect:

• IP address
• Browser type and device information
• Pages visited and time spent on the site
• Cookie preferences

This information helps us improve our website and user experience.

b) Enquiries and Admissions

If you contact us or complete a form, we may collect:

• Name
• Email address
• Telephone number
• Address
• Information about your child’s needs
• Any details you choose to share regarding education history

We use this information to respond to your enquiry and support admissions processes.

c) Pupils and Families

For children and young people placed in our services, we may collect:

• Personal details (name, date of birth, address, unique pupil number)
• Attendance and progress data
• Educational history
• Safeguarding information
• Medical or therapeutic information
• EHCP documentation
• Ethnicity and language information (where required by law)

Most pupil data is provided by Local Authorities or previous education settings as part of statutory processes.

d) Job Applicants

If you apply for a role with TCES, we may collect:

• Contact details
• Employment history
• Qualifications
• References
• Right to work documentation
• DBS and safeguarding checks (where required)

If employment is offered, a separate Employee Privacy Notice will apply.

3. How We Use Personal Information

We use personal data to:

• Provide education and therapeutic services
• Support pupil learning and wellbeing
• Safeguard children and young people
• Communicate with families and professionals
• Meet statutory reporting requirements (e.g. Department for Education)
• Manage admissions and referrals
• Process job applications
• Improve our website and services

We do not use pupil or safeguarding records for marketing purposes.

TCES does not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.

4. Our Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

• Legal obligation – where we are required to process data by law (e.g. school census returns).
• Public task – to provide education and related services in the public interest as an independent special school and alternative provision provider.
• Contract – where processing is necessary for employment or service agreements.
• Legitimate interests – for service improvement, operational management and relevant professional communications.
• Consent – where required, such as certain marketing communications.

Where we process special category data (such as health information, ethnicity or safeguarding records), this is carried out in accordance with Article 9 of UK GDPR and Schedule 1 of the Data Protection Act 2018, including conditions relating to education, safeguarding and employment.

5. How We Share Information

We only share personal data where necessary and lawful. This may include:

• Local Authorities
• The Department for Education (DfE)
• Ofsted
• Schools or colleges following transition
• Healthcare or therapeutic professionals
• Regulatory bodies
• Securely contracted IT and data service providers

We do not sell personal information to third parties.

Data Sharing Within the TCES Group

TCES works closely with its associated organisations:

• National Online School
• Great Minds Therapy and Training

These organisations operate within the wider TCES Group and share aligned governance, safeguarding standards and data protection procedures.

How and Why Information Is Shared Within the Group

Personal information may be shared between TCES Group organisations where this is necessary and lawful, including to:

• Ensure continuity of education and therapeutic provision
• Support transitions between services
• Deliver integrated therapy services
• Maintain safeguarding oversight
• Meet regulatory, funding or statutory requirements
• Support quality assurance and operational management

Information is shared only where it is relevant, proportionate and in accordance with UK GDPR and the Data Protection Act 2018.

Marketing and Service Updates

We may share limited contact details (such as name, email address and organisation) within the TCES Group to provide information about:

• Related education services
• Post-16 or alternative provision pathways
• Professional training delivered by Great Minds Therapy and Training
• Events or service developments relevant to your role or previous engagement with TCES

Marketing communications will only be sent where we are legally permitted to do so. This will be based on:

• Consent, where required; or
• Legitimate interests, where we have an existing relationship and the communication is relevant to that relationship.

We do not share pupil personal data for marketing purposes.

You may opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us directly.

We do not sell personal data within or outside the TCES Group.

6. International Transfers

Where we use trusted third-party providers (such as secure cloud or analytics services), some data may be processed outside the UK.

In such cases, we ensure appropriate safeguards are in place, such as UK adequacy regulations or approved contractual clauses.

7. How We Keep Information Secure

We take data security seriously. Personal information is stored securely in electronic systems and, where necessary, paper files.

We use:

• Secure IT systems and encryption
• Access controls and permissions
• Staff data protection training
• Clear data handling procedures

Access to personal data is limited to staff who need it to perform their role.

8. How Long We Keep Information

We retain personal information in line with statutory guidance and legal requirements for education and employment records. We follow statutory guidance on retention of education records, including Department for Education guidance where applicable. Retention periods vary depending on the type of data. Details of our retention schedule are available upon request.
We do not keep personal information longer than necessary.

9. Your Rights

Under UK GDPR, you have the right to:

• Request access to your personal data (Subject Access Request)
• Request correction of inaccurate information
• Request deletion of data (where legally permitted)
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Withdraw consent where consent is the lawful basis
• Request data portability (where applicable)
• Lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise any of these rights, please contact our Data Protection Officer.

10. Cookies

Our website uses cookies to improve your experience and help us understand how the site is used.

We use:

• Essential cookies – required for website functionality
• Analytics cookies – to understand website usage (e.g. Google Analytics)
• Optional cookies – where consent is provided

You can manage your cookie preferences through your browser settings or our website cookie banner.
For more detailed information, please see our Cookie Policy.

11. Updates to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.