Privacy policy

A&J School Limited is a private company registered in England and Wales (Company No. 12096702, UKPRN 10089726) trading as A&J School. Our registered office is 200 Upper Richmond Road, London SW15 2SH, United Kingdom.

For the purposes of UK data protection law (the UK General Data Protection Regulation and the Data Protection Act 2018), A&J School Limited is the data controller for personal data we collect about pupils, parents, carers, applicants, staff, and website visitors.

The categories of personal data we collect depend on your relationship with the school:

Prospective families (admissions enquiries): name, email, phone number, country of residence, pupil's age and current year, and any information you choose to share in the free-text field of an enquiry form.

Enrolled pupils and their parents/carers: contact details, billing details, attendance records, academic assessments, behavioural and pastoral records, safeguarding records, and Special Educational Needs (SEN) documentation including any external reports you choose to share with the school. We treat SEN, medical, and safeguarding records as special category data under Article 9 UK GDPR and apply heightened security controls.

Website visitors: we use first-party analytics to understand how visitors use the site (pages viewed, approximate location at city level, referrer). We do not use third-party advertising or behavioural tracking cookies. See our cookie policy for the full list.

We process personal data on the following lawful bases under Article 6 UK GDPR:

Contract. To deliver education services to enrolled pupils — timetabling, teaching, assessment, reporting, and exam entry administration.

Legal obligation. To meet our safeguarding, equalities, financial-records, and tax obligations as a UK registered company.

Legitimate interests. To respond to enquiries, run admissions processes, monitor and improve our services, and protect the school, our staff, and our pupils. Where we rely on legitimate interests we have completed a balancing test and concluded the impact on individuals is proportionate.

Consent. For any optional uses — e.g. marketing emails, photo or video use beyond strictly internal teaching purposes. Consent can be withdrawn at any time by emailing us at the address below.

For special category data (SEN, medical, safeguarding) we additionally rely on Article 9(2)(g) (substantial public interest — safeguarding) or 9(2)(a) (explicit consent), as appropriate.

We use personal data to:

• Respond to admissions enquiries and run the admissions process.
• Deliver lessons, assessments, and pastoral support to enrolled pupils.
• Produce written reports for parents, conduct parents' meetings, and meet our statutory safeguarding duties.
• Build personalised learning, SEN, and high-performance support plans, in partnership with parents and (where applicable) external clinicians or educational psychologists.
• Administer external exam entries and qualification awards.
• Operate, secure, and improve our learning platform and website.
• Meet legal, regulatory, and audit obligations.

We do not use personal data for behavioural advertising, sell or rent personal data to third parties, or use pupil data to train external generative-AI models.

We share personal data only where necessary, and only with categories of recipient described below:

Service providers acting as our processors: our hosting provider, video conferencing provider, email provider, payment processor, and email transactional provider (Twilio SendGrid) for sending admissions enquiry notifications. Each has a written data-processing agreement with us under Article 28 UK GDPR.

Accreditors and exam boards: WASC (Western Association of Schools and Colleges), Array Global, Cambridge Assessment International Education, Pearson Edexcel, and AP exam centres receive only the data needed to register pupils for assessments and confirm awards.

Safeguarding partners: where statutory safeguarding duties apply, we may disclose information to the relevant local authority designated officer, the police, social services, or other safeguarding partners. We follow the principles of Working Together to Safeguard Children and Keeping Children Safe in Education.

Auditors, legal advisers, and regulators: where we are required by law or in connection with a statutory audit.

Some of our service providers are based outside the UK. Where personal data is transferred outside the UK, we rely on the UK adequacy regulations (where available), the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, as the lawful transfer mechanism. We carry out transfer risk assessments where required.

We keep personal data only as long as we need it for the purposes set out in this policy or as required by law. Indicative retention periods:

• Unsuccessful admissions enquiries: 24 months from last contact, then deleted.
• Pupil academic records: 7 years after a pupil leaves the school, in line with exam-board and audit requirements.
• Safeguarding records: retained until the pupil reaches age 25, in line with Independent Inquiry into Child Sexual Abuse (IICSA) and DfE guidance, or longer if a relevant matter is unresolved.
• Financial records: 6 years after the end of the relevant tax year, as required by HMRC.

We apply layered technical and organisational controls to personal data: TLS encryption in transit; encryption at rest for production databases and pupil records; least-privilege access for staff; mandatory two-factor authentication for staff accounts; logging and monitoring of administrative access; written information-security and incident-response procedures; and annual safeguarding, data-protection, and information-security training for all staff.

If a personal data breach occurs that is likely to result in a risk to individuals' rights and freedoms, we will report it to the Information Commissioner's Office (ICO) within 72 hours and, where required, notify affected individuals without undue delay.

Under the UK GDPR, you have the right to:

• Be informed about the personal data we hold about you (this policy).
• Access your personal data (a Subject Access Request).
• Have inaccurate personal data corrected.
• Have personal data erased where there is no good reason to continue processing it (the "right to be forgotten").
• Restrict or object to processing.
• Data portability — receive your data in a structured, common format.
• Withdraw any consent you have given, at any time.

To exercise any of these rights, email admissions@aandj.school. We will respond within one calendar month.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

A&J School works with pupils aged 13–19. For pupils under 16, parental involvement is integral to enrolment, communications, and the exercise of data protection rights. We do not market directly to pupils under 16. Where we provide accounts directly to pupils (e.g. on the school's learning platform), we make our privacy notice available in age-appropriate language and require parental consent for the account.

We review this policy at least annually and whenever there is a material change to our processing. Substantive changes will be communicated to enrolled families directly. The "last reviewed" date at the top of this page indicates the most recent version.