PREPARING PATHWAYS LTD

Privacy Policy and Privacy Notice

Last updated: September 2026
Review date: September 2027
Policy owner: Preparing Pathways Ltd
Applies to: Employees, workers, volunteers, students, children, young people, adults, parents/carers, customers, visitors, contractors and other individuals whose personal information is processed by Preparing Pathways Ltd.

1. Introduction

Preparing Pathways Ltd ("Preparing Pathways", "we", "us" or "our") is committed to protecting the privacy and security of the personal information entrusted to us.

We recognise that we work with children, young people, adults with SEND and other individuals who may require additional support. We therefore take particular care when collecting, using, storing and sharing personal information, including sensitive and special category information.

This Privacy Policy explains:

• what personal information we collect;
• how we collect it;
• why we use it;
• the lawful bases we rely upon;
• when we share information;
• how we protect information;
• how long we keep information;
• your data protection rights; and
• how you can contact us or make a complaint.

This Privacy Policy applies to information collected through our services, website, forms, correspondence, telephone calls, email, meetings, referrals and other interactions with Preparing Pathways.

We will regularly review this Privacy Policy and update it where necessary to reflect changes to our services, legal requirements or data protection practices.

2. Who we are

Preparing Pathways Ltd is the data controller for the personal information we process for the purposes described in this Privacy Policy, unless otherwise stated.

Preparing Pathways Ltd 
18 Pullman Road, Wigston, Leicestershire, LE18 2DA

Email: hello@preparingpathways.com

Where another organisation is the data controller for information we process on its behalf, such as a local authority or other commissioning organisation, that organisation's privacy notice may also apply.

3. Data Protection Lead

Preparing Pathways has responsibility for overseeing data protection and privacy.

Our current data protection contact is:

Data Protection Lead: Zara Groves
Email: hello@preparingpathways.com

Preparing Pathways will appoint a Data Protection Officer (DPO) where required by law.

4. What is personal information?

Personal information is information that relates to an identified or identifiable individual.

Depending on how you interact with us, this may include:

Basic personal information

• name;
• date of birth;
• age;
• gender;
• address;
• telephone number;
• email address;
• emergency contact details;
• parent/carer details;
• relationship information.

Education and support information

Where relevant to our services, we may process:

• school, college or educational setting information;
• EHCP information;
• educational history;
• assessment information;
• learning needs;
• support plans;
• progress information;
• communication needs;
• behavioural/support information;
• attendance information;
• outcomes and targets;
• information about preparation for adulthood;
• employment and work experience information.

Health and medical information

Where necessary to provide safe and appropriate support, we may process:

• medical information;
• disabilities and SEND information;
• allergies;
• medication information;
• dietary requirements;
• mobility information;
• personal care requirements;
• mental health information where relevant;
• information about health conditions;
• emergency medical information;
• therapy or clinical information where provided to us.

Some of this information is special category personal data and is subject to additional legal protection.

Safeguarding information

We may process information relating to safeguarding and welfare where necessary to protect children, young people and adults.

This may include:

• safeguarding concerns;
• disclosures;
• allegations;
• incident information;
• risk assessments;
• information about potential harm or abuse;
• information received from safeguarding partners;
• records of actions taken;
• information relating to referrals to appropriate agencies.

Safeguarding information will only be accessed and shared where there is a lawful basis for doing so.

Employment information

For employees, workers, applicants and volunteers, we may process:

• recruitment information;
• application forms;
• references;
• employment history;
• qualifications;
• training records;
• DBS information where applicable;
• right-to-work information;
• payroll and bank details;
• sickness and absence information;
• performance information;
• disciplinary information;
• safeguarding and suitability information.

Website and technical information

When you use our website, we may collect information such as:

• IP address;
• browser type;
• device information;
• operating system;
• website usage information;
• pages visited;
• approximate location derived from technical information;
• cookies and similar technologies.

5. Information relating to children and young people

Preparing Pathways provides services that may involve children and young people.

We recognise that children require particular protection in relation to their personal information. We will therefore process children's information in a way that is fair, transparent and appropriate to their age and understanding.

Where appropriate, we will provide privacy information in a clear and accessible format and may communicate information through parents, carers or other appropriate adults.

We will not assume that parental consent is always required for every processing activity. The appropriate lawful basis will depend upon the purpose for which the information is being processed.

Where children are using online services, we will consider their particular privacy and safety needs when determining appropriate technical and organisational measures.

6. Special category personal information

Some information we process is particularly sensitive and is known as "special category data" under UK data protection law.

This may include information concerning:

• health;
• disability;
• SEND;
• medical conditions;
• racial or ethnic origin where relevant;
• religious or philosophical beliefs where relevant;
• biometric data where applicable;
• information concerning a person's sex life or sexual orientation where relevant.

Preparing Pathways will only process special category information where we have a lawful basis under Article 6 of the UK GDPR and an appropriate additional condition under Article 9, or where another applicable legal provision permits the processing.

Depending upon the circumstances, this may include processing necessary for:

• provision of health or social care and management of health or social care systems;
• employment and social protection law;
• safeguarding and substantial public interest;
• protecting an individual's vital interests;
• establishing, exercising or defending legal claims;
• explicit consent where appropriate; or
• another applicable lawful condition.

Consent will not be treated as the automatic lawful basis for all processing of sensitive information.

7. Information relating to criminal offences

Where necessary and lawful, Preparing Pathways may process information relating to criminal convictions, offences or allegations.

This may be relevant to:

• safer recruitment;
• DBS checks;
• safeguarding;
• assessing suitability for particular roles;
• protecting children, young people and adults;
• meeting legal or regulatory requirements.

Such information will only be processed where permitted by UK data protection law and other applicable legislation.

8. How we collect personal information

We may collect personal information directly from you, or from other appropriate sources.

This may include information obtained from:

• you;
• parents or carers;
• children or young people;
• adult service users;
• schools and colleges;
• local authorities;
• social care services;
• health professionals;
• other education or care providers;
• employers or work-experience providers;
• commissioning organisations;
• safeguarding agencies;
• Ofsted or other regulators where applicable;
• professional advisers;
• previous employers;
• referees;
• DBS and other employment-checking services;
• our website;
• online forms;
• email;
• telephone conversations;
• written correspondence;
• CCTV or other security systems where applicable.

Where we obtain information about you from another organisation, we will provide privacy information where required by law.

9. Why we use personal information

We use personal information only where there is a lawful and legitimate reason for doing so.

Depending on the circumstances, we may use information to:

Deliver our services

We use information to:

• provide education, childcare, support and other services;
• understand individual needs;
• develop person-centred support;
• plan appropriate activities;
• assess progress and outcomes;
• provide reasonable adjustments;
• communicate with individuals and families;
• coordinate support;
• manage attendance;
• provide safe transportation where applicable;
• arrange activities, placements and work experience;
• support preparation for adulthood.

Safeguarding and welfare

We may use and share information to:

• identify and respond to safeguarding concerns;
• protect children and adults from harm;
• assess and manage risks;
• respond to incidents;
• make safeguarding referrals;
• cooperate with safeguarding partners;
• comply with legal duties.

Legal and regulatory requirements

We may process information to:

• comply with legal obligations;
• meet regulatory requirements;
• respond to lawful requests from public authorities;
• comply with education, childcare, employment, health and safety or safeguarding requirements;
• cooperate with inspections or audits.

Administration and management

We may use information to:

• maintain records;
• manage contracts;
• process payments;
• communicate with families and service users;
• manage staffing;
• monitor service quality;
• manage complaints;
• investigate incidents;
• maintain business records.

Recruitment and employment

We process staff and applicant information to:

• recruit staff;
• carry out safer recruitment;
• verify qualifications and references;
• undertake DBS and other appropriate checks;
• manage employment;
• administer payroll;
• provide training;
• manage performance;
• meet employment and safeguarding obligations.

Improving our services

We may use information to:

• monitor service quality;
• evaluate outcomes;
• identify areas for improvement;
• plan future services;
• maintain appropriate records;
• conduct audits.

Where possible, information used for analysis and improvement will be anonymised or minimised.

10. Our lawful bases for processing

Under the UK GDPR, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely upon:

Contract

Where processing is necessary to enter into or perform a contract with an individual or organisation.

Legal obligation

Where we are required to process information to comply with a legal obligation.

Legitimate interests

Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the individual's rights and interests.

Our legitimate interests may include:

• operating and managing our organisation;
• providing safe and effective services;
• maintaining appropriate records;
• communicating with families and service users;
• protecting our staff and service users;
• preventing fraud or misuse;
• improving our services;
• maintaining appropriate security.

Where we rely on legitimate interests, we will consider the impact on individuals and ensure that the processing is necessary and proportionate.

Vital interests

Where processing is necessary to protect someone's life or another person's life in an emergency.

Public task

Where applicable, we may process information where necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Consent

Where we rely on consent, we will ensure that consent is freely given, specific, informed and unambiguous.

Where consent is relied upon, individuals can withdraw their consent at any time. Withdrawal of consent will not affect processing that took place lawfully before consent was withdrawn.

11. Lawful bases for special category information

Where we process special category information, we will also identify an appropriate Article 9 condition.

Depending on the circumstances, this may include:

• explicit consent;
• employment and social protection law;
• provision of health or social care;
• public interest in the area of public health;
• substantial public interest;
• vital interests;
• legal claims; or
• another applicable Article 9 condition.

We will only process special category information where the processing is necessary and proportionate for the relevant purpose.

12. Safeguarding and information sharing

Safeguarding is a fundamental responsibility of Preparing Pathways.

We will share information where necessary and lawful to protect a child, young person or adult from abuse, neglect, exploitation or other harm.

We will not allow data protection concerns to prevent appropriate safeguarding action.

Where information needs to be shared without consent, we will consider the applicable lawful basis and relevant safeguarding requirements.

Information may be shared with appropriate organisations including:

• local authorities;
• children's social care;
• adult social care;
• schools and colleges;
• health professionals;
• police;
• safeguarding partners;
• regulatory bodies;
• emergency services;
• other organisations where there is a lawful basis to share information.

Information will only be shared where appropriate, relevant and proportionate to the circumstances.

13. Who we may share information with

Depending upon the services being provided, we may share information with:

• parents and carers where appropriate;
• local authorities;
• schools and colleges;
• commissioning organisations;
• health and social care professionals;
• safeguarding organisations;
• emergency services;
• Ofsted and other regulators where applicable;
• examination and awarding organisations;
• employment and work-experience organisations;
• professional advisers;
• insurers;
• accountants;
• solicitors;
• IT and software providers;
• secure cloud-storage providers;
• communication providers;
• payment providers;
• payroll providers;
• DBS and recruitment-checking providers;
• other service providers processing information on our behalf.

Where another organisation processes personal information on our behalf, we will take appropriate steps to ensure that suitable data protection arrangements are in place.

14. Data minimisation

Preparing Pathways will only collect and process personal information that is:

• relevant;
• adequate;
• necessary;
• accurate;
• proportionate to the purpose for which it is being used.

We will not collect personal information simply because it may be useful in the future.

15. Accuracy

We take reasonable steps to ensure that personal information is accurate and kept up to date where necessary.

Individuals should tell us if their information changes or if they believe information we hold about them is inaccurate.

16. Data security

We take appropriate technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• damage;
• alteration;
• inappropriate disclosure;
• misuse.

Security measures may include:

• password protection;
• access controls;
• secure systems;
• staff confidentiality requirements;
• staff data protection training;
• secure storage;
• encryption where appropriate;
• secure disposal;
• appropriate backup arrangements;
• incident management procedures.

Access to personal information will be limited to people who need it for legitimate work purposes.

17. Confidentiality

All employees, workers, volunteers and contractors are expected to maintain confidentiality.

Staff will only access personal information where they have a legitimate reason to do so.

Confidentiality does not prevent staff from sharing information where there is a safeguarding concern, legal obligation or other lawful reason to do so.

18. Data breaches

A personal data breach may include:

• loss of personal information;
• sending information to the wrong person;
• unauthorised access;
• hacking;
• theft;
• accidental disclosure;
• loss of a device containing personal information.

Any suspected data breach must be reported to Preparing Pathways immediately.

We will assess breaches and take appropriate action, including notifying the ICO and/or affected individuals where legally required.

19. Data retention

We will not retain personal information for longer than is necessary for the purpose for which it was collected, unless we are legally required or otherwise permitted to retain it for longer.

Our retention periods will take into account:

• legal requirements;
• regulatory requirements;
• safeguarding requirements;
• contractual requirements;
• the nature of the information;
• the purpose for which it was collected;
• potential legal claims;
• operational requirements.

Preparing Pathways will maintain a separate Data Retention Schedule setting out the specific retention period or retention criteria for different categories of information.

Retention schedule – to be completed and maintained by Preparing Pathways

Information type	Retention period/criteria
Student records	7 years
EHCP/education records	7 years
Safeguarding records	Until age 25 or longer if required
Accident/incident records	3 years
Attendance records	7 years
Staff records	6 years after employment ends
Recruitment records	6 months (unsuccessful candidates)
Payroll/financial records	6 years
CCTV	30 days

When information is no longer required, it will be securely deleted, destroyed or anonymised.

20. International transfers

Some of our service providers may process information outside the United Kingdom.

Where personal information is transferred outside the UK, we will ensure that the transfer is made in accordance with applicable UK data protection law.

Depending on the destination and circumstances, this may involve:

• an adequacy regulation;
• appropriate safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to EU Standard Contractual Clauses;
• another lawful transfer mechanism.

Where required, we will provide information about relevant safeguards.

21. Cookies and website technologies

Our website may use cookies and similar technologies.

Cookies may be used to:

• make the website function correctly;
• remember preferences;
• understand how visitors use the website;
• improve website performance;
• provide analytics;
• support marketing or advertising where applicable.

We will obtain consent where required for non-essential cookies and similar technologies.

Our website will provide appropriate information about the cookies and technologies actually in use.

We will review our cookie settings periodically to ensure that they accurately reflect our website.

The use of cookies is also subject to the Privacy and Electronic Communications Regulations (PECR).

22. Direct marketing

Where we send marketing communications, we will comply with applicable data protection and electronic communications legislation.

Marketing may include:

• email;
• SMS;
• postal communications;
• social media or online advertising.

Where consent is required, we will obtain appropriate consent before sending marketing communications.

Individuals can unsubscribe from marketing communications at any time.

Unsubscribing from marketing will not normally prevent us from sending essential service-related communications.

23. Individual rights

Under UK data protection law, individuals have a number of rights.

Depending on the circumstances, these include:

Right to be informed

You have the right to understand how and why we use your personal information.

Right of access

You may request a copy of the personal information we hold about you.

This is commonly known as a Subject Access Request (SAR).

Right to rectification

You may ask us to correct inaccurate or incomplete information.

Right to erasure

In certain circumstances, you may ask us to delete personal information.

This right is not absolute and does not apply where we have a lawful reason to retain the information.

Right to restrict processing

In certain circumstances, you may ask us to restrict how we use your information.

Right to object

You may have the right to object to particular types of processing, including certain processing based on legitimate interests.

Where we rely on legitimate interests, we will consider objections in accordance with applicable law.

Right to data portability

In certain circumstances, you may request personal information in a structured, commonly used and machine-readable format and ask us to transmit it to another organisation.

Rights relating to automated decision-making

Where applicable, individuals have rights in relation to solely automated decisions that have legal or similarly significant effects.

Preparing Pathways does not currently make solely automated decisions that have legal or similarly significant effects on individuals.

24. Exercising your rights

To exercise your data protection rights, please contact:

Data Protection Lead
Preparing Pathways Ltd
18 Pullman Road, Wigston, Leicestershire, LE18 2DA

Email: hello@preparingpathways.com

We may need to verify your identity before responding to a request.

We will respond within the applicable legal timeframe.

There may be circumstances where we are legally permitted to refuse or limit a request. Where this happens, we will explain the reason where we are permitted to do so.

25. Children's rights

Children have their own data protection rights.

The extent to which a child can exercise their rights independently will depend on their age, maturity and understanding and the circumstances of the request.

We will consider the child's best interests and capacity when responding to requests concerning children's personal information.

Where appropriate, we may communicate with a parent, carer or other person with parental responsibility.

However, we will not automatically assume that a parent or carer is entitled to access all information relating to a child.

26. Consent

Where we rely on consent, we will:

• explain what the consent is for;
• make consent voluntary;
• avoid making unnecessary services conditional on consent;
• keep appropriate records of consent;
• provide a simple way to withdraw consent.

Withdrawal of consent will not affect processing that took place before consent was withdrawn.

27. Data protection by design and default

Preparing Pathways will consider data protection and privacy when developing new services, systems, processes and activities.

Where appropriate, we will consider:

• whether we actually need the information;
• what information is necessary;
• who needs access;
• how information will be secured;
• how long it needs to be retained;
• whether a Data Protection Impact Assessment (DPIA) is required;
• the particular needs of children and vulnerable individuals.

28. Data Protection Impact Assessments

Preparing Pathways will consider whether a Data Protection Impact Assessment is required where processing is likely to result in a high risk to individuals.

This may be particularly relevant where we introduce:

• new technology;
• large-scale processing;
• monitoring systems;
• new types of sensitive information processing;
• significant changes to how personal information is used.

29. Third-party websites

Our website may contain links to third-party websites.

We are not responsible for the privacy practices, security or content of external websites.

Individuals should review the privacy information provided by third-party organisations before providing them with personal information.

30. Social media

Preparing Pathways may operate social media accounts and may publish photographs, videos or other content relating to our activities where we have an appropriate lawful basis and, where required, appropriate consent.

Particular care will be taken when publishing information relating to children and young people.

Where consent is relied upon for photographs or other optional publicity purposes, consent may be withdrawn in accordance with our consent arrangements.

We will not publish unnecessary personal information alongside photographs or videos.

31. Photographs and video

Photographs and video may be taken during activities, events or services.

The lawful basis for photography or filming will depend upon the purpose.

Where photography is for optional promotional purposes, we may rely on consent where appropriate.

Photography may also be undertaken for legitimate operational, safeguarding, security or evidential purposes where there is a lawful basis.

We will explain the purpose of photography or filming where appropriate.

32. CCTV and security

Where CCTV or other security monitoring is used, it will be operated in accordance with applicable data protection requirements.

CCTV will only be used for legitimate purposes such as:

• safeguarding;
• security;
• prevention and detection of crime;
• protecting staff and service users;
• investigating incidents.

Appropriate signage and privacy information will be provided.

CCTV footage will be retained only for the period necessary for its purpose unless it needs to be retained for an investigation or other lawful reason.

33. Complaints

If you have concerns about the way Preparing Pathways has used your personal information, please contact us first.

We will investigate complaints in accordance with our complaints procedure.

You can contact:

Preparing Pathways Ltd
18 Pullman Road, Wigston, Leicestershire, LE18 2DA

Email: hello@preparingpathways.com

34. Complaining to the Information Commissioner's Office

You have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you believe your personal information has been handled unlawfully.

ICO website: https://ico.org.uk/

ICO helpline: 0303 123 1113

The ICO may investigate concerns about how organisations process personal information.

We would encourage individuals to contact Preparing Pathways first so that we have an opportunity to resolve the matter, but this does not remove your right to complain to the ICO.

35. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

We will update the "Last updated" date whenever significant changes are made.

Where appropriate, we will notify individuals about significant changes before they take effect.

We will not introduce a new use of personal information without ensuring that the appropriate lawful basis, transparency information and other data protection requirements are in place.

36. Contact us

If you have questions about this Privacy Policy, how we use personal information, or your data protection rights, please contact:

Preparing Pathways Ltd
18 Pullman Road, Wigston, Leicester, LE18 2DA

Email: hello@preparingpathways.com

Data Protection Lead: Zara Groves

Document Control

Version	Date	Review date	Author/Owner	Changes
1.0	September 2026	September 2027	Preparing Pathways Ltd	Full review and update

Related Documents

This Privacy Policy should be read alongside, where applicable:

• Data Protection Policy
• Data Retention Schedule
• Data Breach Procedure
• Subject Access Request Procedure
• Safeguarding Policy
• Child Protection Policy
• Information Sharing Policy
• Acceptable Use / E-Safety Policy
• Staff Confidentiality Agreement
• Photography and Media Consent Form
• Cookie Policy
• Recruitment and Safer Recruitment Policy
• Complaints Policy
• Records Management Policy