Privacy Notice

 Last updated:

19 June 2026

School Consulting Ltd (‘SCL’, ‘we’, ‘us’ or ‘our’) provides data protection, safeguarding, online search, sustainability and other education consultancy services.

SCL is the Data Controller for personal information used to administer its own business, website, enquiries and client relationships.

When we process personal information on behalf of a school, Trust or other client in delivering contracted services, that organisation will normally remain the Data Controller and SCL will act as a Data Processor. The client’s Privacy Notice will apply to that processing.

Privacy and data protection enquiries can be sent to DPO@schoolconsulting.co.uk.

Depending on your relationship with us, we may collect:

• your name, Job Title and organisation 
• your business email address, telephone number and other contact details 
• information contained in enquiries, correspondence and meeting records 
• information needed to prepare quotations, contracts and invoices 
• payment and accounting information 
• records relating to services provided 
• technical information about visits to our website, such as an IP address, browser, device and pages visited 
• information supplied by clients where this is necessary to deliver a contracted service 

We normally receive information directly from you or your organisation. When delivering services for a client, information may also be provided by the client or obtained from publicly available sources under the client’s instructions.

We use personal information to:

• respond to enquiries and provide information about our services 
• prepare quotations and take steps towards entering into a contract 
• manage client relationships and deliver contracted services 
• arrange meetings and maintain appropriate service records 
• issue invoices, process payments and maintain accounting records 
• provide important service, legal or regulatory updates 
• manage and protect our website, systems and business 
• establish, exercise or defend legal claims 
• meet legal, regulatory, insurance and taxation requirements 

Our lawful bases will depend on the circumstances. They include taking steps before entering into a contract, performing a contract, complying with a legal obligation and pursuing our legitimate interests in operating, protecting and developing our business and providing services to clients.

Where consent is the appropriate lawful basis, it can be withdrawn at any time. Withdrawal will not affect processing that took place before consent was withdrawn.

We do not use personal information to make solely automated decisions that have legal or similarly significant effects.

Clients may provide personal information relating to employees, job applicants, pupils, parents, carers or other individuals where this is necessary for SCL to deliver a service.

Where SCL acts as a Data Processor, we will:

• process the information only under the client’s documented instructions 
• use it only to deliver the contracted service 
• limit access to authorised people who need the information 
• maintain appropriate confidentiality and security 
• assist the client with its data protection responsibilities where required 
• return or securely delete the information in accordance with the contract and agreed retention arrangements 

The client is responsible for establishing the lawful basis for the processing and providing any required privacy information to the individuals concerned.

SCL undertakes online searches on behalf of schools and other education organisations as part of safer recruitment processes.

The client may provide information needed to identify the individual, such as their name, photograph, previous workplace or education history. SCL may then review relevant information that is publicly available online and report its findings to the client.

SCL acts as a Data Processor for this activity. The client remains responsible for deciding whether a search should be undertaken, establishing its lawful basis and informing the shortlisted candidate that an online search may be completed.

Information collected while undertaking the search is not used for SCL’s own purposes. Working search information is securely deleted after the search has been completed. The completed certificate and essential service record may be retained for the period necessary to manage the service and respond to any subsequent query.

We do not sell personal information.

Where necessary, information may be shared with:

• authorised SCL personnel and subcontractors 
• website, email, cloud storage and IT service providers 
• accounting, payment and business administration providers 
• professional advisers and insurers 
• regulators, law enforcement agencies, HM Revenue and Customs or other public authorities where required 
• a client where the information relates to a service provided on its behalf 

Access is limited to what is reasonably necessary. Appropriate contractual and confidentiality arrangements are used where required.

SCL uses services provided by organisations including Microsoft and Google. Some providers may store or access information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate legal safeguard is in place. This may include UK adequacy regulations, the UK International Data Transfer Agreement or an approved UK Addendum to standard contractual clauses.

We retain personal information only for as long as it is reasonably needed.

Enquiries that do not result in a client relationship will normally be retained for up to two years after the last meaningful contact.

Routine client contact information will be reviewed after the relationship ends. Contracts, material service records and relevant professional correspondence may be retained for up to six years after the client relationship ends where this is necessary for contractual, insurance or legal purposes.

Invoices and accounting information may be retained for up to seven years to meet taxation and accounting requirements.

Information processed solely on behalf of a client will be returned or deleted in accordance with the client’s instructions, the contract and any applicable legal requirements.

Information may be retained for longer where this is required by law, necessary for an active complaint or legal claim, or requested by a regulator or law enforcement body.

We use appropriate technical and organisational measures to protect personal information. These include password protection, multi-factor authentication where available, encryption, access controls, secure devices, backups and confidentiality requirements.

If a personal data breach occurs, it will be assessed, recorded and reported to the Information Commissioner’s Office or affected individuals where legally required.

Depending on the circumstances, you may have the right to:

• be informed about how your personal information is used 
• request access to your personal information 
• ask for inaccurate information to be corrected 
• ask for information to be erased 
• ask us to restrict how information is used 
• object to particular uses of your information 
• receive certain information in a portable format 
• withdraw consent where processing is based on consent 

These rights are not absolute and exemptions may apply. We may need to confirm your identity before responding to a request.

Where SCL holds information solely as a Data Processor for a client, the request should normally be made to that client as the Data Controller. We will assist the client where required.

If you have concerns about how SCL has used your personal information, please contact DPO@schoolconsulting.co.uk.

We will acknowledge a data protection complaint within 30 days, make appropriate enquiries and respond without undue delay. We will keep you informed where an investigation takes longer and will explain the outcome.

You also have the right to complain to the Information Commissioner’s Office. Further information is available through the ICO website.

Our website provider uses essential cookies and similar technologies to operate, protect and maintain the website.

Website analytics may also collect information about how the site is used, including an IP address, device and browser information, pages visited and the approximate time of a visit. This information helps us understand and improve the website.

Where consent is legally required for non-essential cookies or similar technologies, they will only be used after the appropriate consent has been provided. Cookie preferences can be managed through the website controls or browser settings.

Our website is intended for schools, education organisations and adults seeking information about our services. We do not intentionally collect personal information directly from children through the website.

We may process information about children when acting on behalf of a school or other client. In those circumstances, the client remains responsible for the processing and SCL will handle the information under the client’s instructions.

We will review this Privacy Notice regularly and update it when our services, systems or legal obligations change. The latest version will be published on this website.