Data Protection & Privacy

 at Roots and Shoots Learning

Introduction

Roots and Shoots Learning is committed to safeguarding the personal data of all involved, this includes the children we work with, their parents or guardians, and our team members - this policy will refer to all individuals involved as ‘data subjects’ throughout.

This policy explains how we collect, store, retain, and share personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Collection

We collect personal data only where it is necessary for our educational and safeguarding activities, as well as basic team member details.

• Children’s data: name, date of birth, educational needs, health and safeguarding information, and progress reports.
• Parents/carers: contact details, consent forms, emergency contacts, and relevant family circumstances.
• Team members: employment records, qualifications, Disclosure and Barring Service (DBS) checks, payment details, and emergency contacts.

All data is collected directly from the individual or their legal representative unless a lawful basis exists for obtaining it from a third party (e.g., schools or local authorities). Lawful bases for processing may include: consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests.

Data Storage

Personal data is stored securely using appropriate technical and organisational measures:

Digital records:

• Encrypted at rest and in transit.
• Hosted on secure cloud platforms with multi-factor authentication.
• Access restricted by role-based permissions.

Paper records:

• Secured behind locked doors, in locked cabinets within our premises.
• Access granted only to authorised personnel - if you aren’t sure, ask your manager or Louise Sullivan.

All team members must follow our internal procedures to report any suspected breach immediately.

Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected and to meet any legal or statutory requirements. Under the UK GDPR’s storage-limitation principle, we define and justify our own retention periods based on processing purpose and regulatory obligations. 

Child records

Until 6 years after last contact

Parent/guardian details

Until 6 years after last contact

Staff employment files

6 years after employment end

Safeguarding records

Until child’s 25th birthday

At the end of each retention period, data will be securely destroyed or irreversibly anonymised.

Privacy & Individual Rights

As we have combined our privacy notice with this Data Protection Policy, we have explained these details in plain language, (as required by Article 14 of the UK GDPR), in brackets after each term.

Roots and Shoots Learning upholds the rights of data subjects under the UK GDPR, including:

• Right of access to personal data (you can see your personal data upon request)
• Right to rectification of inaccurate information (you can correct any false information)
• Right to erasure (you can request to have your data deleted when you leave)
• Right to restrict or object to processing (if you feel you don’t want specific data being held or processed by us you can request for us not to do so)
• Right to data portability (you can request to see or be sent your data in a readable and unencrypted way)

We do not sell personal data. We share it only when required by law, by official safeguarding requirements, or with explicit consent. 

Roles, Responsibilities & Contact

Data Controller: Roots and Shoots Learning CIC

Data Protection Leads: Louise Sullivan & Sophie Halliday-Chambers; responsible for policy maintenance, staff training, and breach response.

All staff must follow this policy and report any data-protection concerns to the Data Protection Leads immediately.

For inquiries, data-subject requests, or to report a breach:

Data Protection Lead
Roots and Shoots Learning
Email: admin@rootsandshootslearning.org

 

Requests will be acknowledged within one month and handled in accordance with statutory timescales.