Confidentiality and Data Protection Policy

May 2025

Introduction

HSA Send Consulting Ltd (hereinafter "HSA") is a UK-based Special Educational Needs Consultancy specializing in child inclusion and parenting support.This policy outlines our commitment to protecting your personal data and explains how we collect, process, store, and manage information in compliance with applicable data protection regulations.

Data Controller

HSA serves as the data controller for any personal information you provide to us. We are committed to ensuring that your privacy is protected, and that data is handled in accordance with relevant legislation.

Collection and Processing of Personal Information

Clients, Potential Clients, and Suppliers

HSA may collect and process the following information:

• Names
• Home addresses
• Email addresses
• Telephone/mobile numbers
• Bank account details

This information is processed for the following purposes:

• Fulfilment of contractual obligations
• Compliance with legal requirements
• Maintaining professional relationships with potential clients (with consideration for individual rights and freedoms)
• Collection of witness or third-party information as required by HSA's insurance obligations

We may also collect non-personally identifiable information such as geographical location or process-related details to facilitate service delivery. This information cannot be used to identify individuals and is utilized solely to enhance our service provision.

Data Usage

Personal and non-personal information will only be used for the purposes for which it was collected or otherwise agreed by you, including:

• Identity verification and security confirmation
• Fulfilment of contractual obligations
• Service updates and notifications
• Fraud detection and prevention
• Market research and statistical analysis
• Audit and record-keeping compliance
• Legal proceedings
• Regulatory compliance
• Response to inquiries

Data Concerning Children, Young People, and FamiliesThe following categories of information may be collected, held, or shared:

• Personal identifiers (names, addresses, parent/carer national insurance numbers)
• Contact details and communication preferences
• Demographic information (ethnicity, religion, language, nationality, country of birth)
• School attendance records
• Academic assessment data
• Medical information relevant to educational needs
• Special educational needs documentation (EHCPs, CAMHS reports, tuition referrals, care/support plans)
• Safeguarding information
• Disciplinary records
• Behavioural assessments
• Photographs (only with explicit consent)

Purpose of CollectionThis information enables HSA to:

• Provide optimal support and professional guidance to schools, organizations, and parents/carers
• Support educational development
• Monitor and report on progress
• Fulfil safeguarding obligations
• Assess service quality
• Ensure regulatory compliance

Data Processing Systems

HSA utilizes secure systems and platforms for data management:

• Sync: Encryption system for data storage
• Egress/Tresorit: Encrypted communication for sensitive information
• Google Workspace: Secure storage and management of operational records

Data Sharing

HSA may share personal data with partners as required by regulatory or statutory obligations. All data sharing activities:

• Are conducted in accordance with a lawful basis for processing
• Follow comprehensive risk assessments
• Implement appropriate safeguards and control measures

Data Retention

HSA retains records only for as long as necessary for the purposes for which they were collected or as required by law:

• Financial and pension data: 6 years
• Contract data: 3 years
• Family and child data: Retained during active engagement, then transferred to the commissioning data controller (school, local authority, or parents/carers) with HSA copies deleted after 3 months unless otherwise instructed

Safeguarding Obligations

HSA has a legal duty to share information regarding safeguarding concerns if a child is believed to be at risk of harm. Such concerns are reported to:

• The Safeguarding Lead of the commissioning data controller
• Relevant local authority Social Services when necessary

Data Subject Rights

You have the following rights regarding your personal data:

• Right to Access: Request a copy of all data HSA holds about you
• Right to Rectification: Correct any inaccurate information
• Right to Erasure: Request deletion of your data where appropriate
• Right to Restrict Processing: Limit how your data is used

Parents/carers may exercise these rights on behalf of children under 13 years of age or those lacking capacity under the Mental Capacity Act (unless the child has provided consent).In response to a subject access request, HSA will:

• Provide a description of data held
• Explain the purpose and retention period of data processing
• Disclose the source of information (if not obtained directly)
• Identify recipients or categories of recipients
• Provide copies of information in an intelligible format

Complaints Procedure

If you believe your information has been incorrectly processed, you may request to review, correct, or delete this information. For concerns regarding data handling, please contact HSA directly. If you remain dissatisfied with our response or believe your data has not been processed in accordance with the law, you may lodge a complaint with the Information Commissioner's Office.

Contact Information

Data Protection Lead: Samantha Cohen
Email: [samcohen27@gmail.com]
Telephone: [07961121924]Last updated: May 2025