This notice explains what personal information we hold about students, families and staff, why we hold it, and what rights you have over it.
Last updated: August 2026.
Who we are
Pledge2Learn is operated by Solutions Pledge2Learn Limited, a company registered in England and Wales, company number 12454511, registered office Suite 6, Haldenby House, Berkeley Business Centre, Doncaster Road, Scunthorpe DN15 7DQ.
We are the data controller for the information described in this notice. We are registered with the Information Commissioner’s Office under registration number ZA747218.
Data Protection Lead: Sam Batty
dataprotection@pledge2learn.co.uk
What we hold
About students: name, date of birth, address and contact details; the Education, Health and Care Plan and any assessments or reports that come with it; details of special educational needs, disabilities and diagnoses; attendance; behaviour and incident records; safeguarding and child protection records; medical and dietary information; attainment, assessment and qualification records; and previous school or placement history.
About parents and carers: name, relationship to the student, contact details, parental responsibility status, and any court orders or arrangements we need to know about to keep a child safe.
About staff and applicants: contact and identity details, right to work, references, qualifications, DBS and other pre-employment checks, employment records, training records, and payroll information.
Some of this is special category data, including health information and, in some cases, ethnicity. We handle it with additional care and only where the law allows.
Why we hold it, and our lawful basis
We use this information to educate students, to deliver the provision set out in Section F of an EHCP, to keep children safe, to report to the local authorities who place students with us, to meet our duties as a registered independent school, and to employ staff.
Our lawful bases under the UK GDPR are:
- Legal obligation — where the law requires us to hold or share information, for example safeguarding duties and returns to the Department for Education.
- Contract — where we are delivering a placement agreed with a local authority, or employing a member of staff.
- Legitimate interests — for the day-to-day running of the school, where this does not override your rights.
- Vital interests — where information must be used or shared to protect someone from serious harm.
- Consent — for things that are genuinely optional, such as using a photograph of a student in our publicity. You can withdraw consent at any time.
For special category data we rely on the additional conditions in Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018, most often the safeguarding of children and the provision of education and social care.
Who we share it with
We do not sell personal information and we do not share it for marketing. We share it where we are required to, or where it is necessary to educate or protect a student. That includes:
- the local authority that placed the student, and North Lincolnshire Council as our host authority
- children’s social care, the police and the Local Authority Designated Officer, where there is a safeguarding concern
- health services, including CAMHS, school nursing and therapists involved in a student’s care
- the Department for Education and Ofsted
- awarding organisations, including NCFE, and exam centres, so students can be entered for qualifications
- a student’s next school, college or provider when they move on
- our professional advisers, auditors and insurers where necessary
Systems we use
We use a small number of suppliers who process information on our behalf under contract. They may only use it for the purposes we set:
- Arbor — our management information system, holding student records, attendance and assessment data
- MyConcern — our safeguarding and child protection recording system
- Avensure — our HR and employment advisory service, holding staff employment records
- Google Workspace — school email and document storage
How long we keep it
We keep information only as long as we need it. Educational records generally transfer to a student’s next school or are kept until they reach 25. Safeguarding and child protection records are kept for longer, in line with statutory guidance and the requirements of the Independent Inquiry into Child Sexual Abuse. Staff records are generally kept for six years after employment ends, with some exceptions where the law requires longer.
Our full retention schedule is available on request.
Your rights
You have the right to ask for a copy of the information we hold about you, to have inaccurate information corrected, to ask us to delete information or restrict how we use it, and to object to certain uses. Where we rely on consent, you can withdraw it.
These rights are not absolute. We cannot delete records we are required by law to keep, and we may not be able to release information that would identify another person or put a child at risk.
Students have these rights over their own information, and can exercise them themselves where they are able to understand what they are asking for. Parents usually make requests on behalf of younger children.
To make a request, email dataprotection@pledge2learn.co.uk. We will respond within one month.
If you are unhappy
Tell us first and we will try to put it right. If you are still not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You can go to the ICO without coming to us first.
See also our cookie policy and accessibility statement.
