Data Protection & Privacy Policy
Data Protection & Privacy Policy
Policy 2 of 3
Data Protection & Privacy Policy
IWS Online School · UK GDPR & DPA 2018 compliant · Version 1.0 · 14 June 2026
This policy explains what personal data we collect about you and your child, why we collect it, how we use and protect it, how long we keep it, and your rights under UK law.
1. Who we are
IWS Online School ("IWS", "we", "us") is the data controller for personal data collected through the IWS Summer Short Programme. Our platform is hosted at my.iwsonlineschool.co.uk.
Data Protection contact: info@iwsonlineschool.co.uk · Designated Safeguarding Lead: Michelle
IWS processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
2. Data we collect and why
| Data | Why we collect it | Legal basis (UK GDPR) |
|---|---|---|
| Student name, email, date of birth, year group / key stage | Account creation, enrolment, age-appropriate content delivery | Contract (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f)) |
| Parent/guardian name, email, phone, relationship to student | Safeguarding, communication, emergency contact, survey distribution | Legitimate interests (Art. 6(1)(f)); Legal obligation (Art. 6(1)(c)) |
| Login activity, session attendance, activity completion | Monitoring engagement and attendance as required for safeguarding and programme delivery | Legitimate interests (Art. 6(1)(f)) |
| Policy acceptance records (timestamp, IP address) | Evidence of consent / agreement for UK GDPR compliance | Legal obligation (Art. 6(1)(c)) |
| Parental consent record (checkbox + timestamp) | Lawful processing of data relating to children under 16 | Consent (Art. 6(1)(a)); Art. 8 (child's consent) |
| Session recordings (video/audio) | Educational review, access for enrolled students who missed a session, quality assurance | Legitimate interests (Art. 6(1)(f)); Consent (Art. 6(1)(a)) |
| Survey responses (end of Week 1 & 2) | Programme improvement and satisfaction monitoring | Legitimate interests (Art. 6(1)(f)) |
3. Special category data & children
IWS does not routinely collect special category data (health, ethnicity, religion, etc.). Where a family voluntarily shares information relevant to a student's learning needs or welfare, this is held strictly confidentially and accessed only by the DSL (Michelle) and the relevant teacher.
Under UK GDPR Article 8 and the DPA 2018, the age of digital consent in the UK is 13. For students under 13, IWS requires a parent or guardian to provide consent. For students aged 13–15, parental consent is additionally sought as best practice. Students aged 16 and over may consent themselves.
We do not use children's data for any purpose beyond programme delivery, safeguarding, and direct communication with the enrolled family.
4. Who we share data with
We do not sell personal data to any third party.
Data may be shared with: the BigBlueButton conferencing platform (session hosting and recording); our Moodle hosting provider (platform infrastructure); survey tools (Google Forms or Microsoft Forms) for end-of-programme surveys; and statutory authorities (e.g. police, children's services) where required by law or for safeguarding purposes.
All third-party processors are subject to a data processing agreement and are required to process data only on our instructions.
BigBlueButton: recording data is stored on servers located in the EEA or UK. Where data is transferred outside the UK, appropriate safeguards (UK adequacy decision or Standard Contractual Clauses) are in place.
5. How long we keep data
| Data type | Retention period |
|---|---|
| Student & parent account data | 1 year after the programme ends, then deleted unless the student re-enrols |
| Session recordings | 90 days after the programme ends, then permanently deleted |
| Attendance & engagement logs | 1 year after the programme ends |
| Policy acceptance records (consent audit trail) | 6 years (UK GDPR compliance / limitation period for legal claims) |
| Parental consent records | Until the student turns 18, or 6 years after collection, whichever is longer |
| Survey responses (anonymised) | Up to 3 years for programme improvement purposes; identifiable responses deleted after 1 year |
| Safeguarding records | As required by KCSIE and statutory guidance — minimum until the student's 25th birthday |
6. Your rights under UK GDPR
You have the following rights in relation to your personal data:
- Right of access — you may request a copy of the personal data we hold about you (Subject Access Request).
- Right to rectification — you may ask us to correct inaccurate data.
- Right to erasure — you may ask us to delete your data where there is no lawful reason to continue processing it. Note: some data (policy acceptance records, safeguarding records) must be retained by law and cannot be deleted on request.
- Right to restrict processing — you may ask us to pause processing of your data while a dispute is resolved.
- Right to object — you may object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent (e.g. recording consent), you may withdraw at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
- Right to lodge a complaint — you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
To exercise any of these rights, contact us at: info@iwsonlineschool.co.uk. We will respond within 30 days.
7. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction, including encrypted connections (HTTPS), access controls, and role-based permissions on the Moodle platform.
All staff and teachers with access to student data are subject to confidentiality obligations and, where required, enhanced DBS checks.
In the event of a data breach affecting your personal data, we will notify you and the ICO as required by UK GDPR (within 72 hours of becoming aware).
8. Cookies
The IWS Moodle platform uses essential session cookies to keep you logged in. No advertising or tracking cookies are used. You can manage cookies in your browser settings; disabling session cookies will prevent you from accessing the platform.
9. Changes to this policy
This policy will be reviewed annually or when required by changes in law or practice. The current version is always published at my.iwsonlineschool.co.uk. Where changes are material, users will be asked to re-accept on next login.
10. Contact & complaints
Data Protection contact: info@iwsonlineschool.co.uk
DSL (safeguarding): Michelle — info@iwsonlineschool.co.uk
Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113
The policies were prepared in accordance with UK GDPR, the Data Protection Act 2018, the Children Act 1989 & 2004, and Keeping Children Safe in Education (KCSIE) 2025. They should be reviewed annually and whenever there is a material change in law or practice. Next review: June 2027.