Last updated: May 2nd 2026

Bettws Lifehouse ("we", "us", or "our") is committed to protecting the privacy and security of personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

 

As an independent special school operating in Wales and England, we act as a data controller for the personal data we collect and process.

 

This Privacy Policy explains how we collect, use, share, and protect your personal information when you interact with our website, services, or school.

 

This policy applies to all individuals, including pupils, parents/carers, staff, and visitors.

 

We process data fairly, lawfully, and transparently, ensuring it is accurate, relevant, and retained only as long as necessary.

 

For children under 13, we obtain parental consent before processing their personal data, in line with age-appropriate protections.If you have any questions about this policy or our data practices, please contact us.

 

1. Information We Collect

 

We collect personal data to provide educational services, manage our operations, and comply with legal obligations. Personal data includes any information relating to an identified or identifiable individual.

 

Types of Data Collected:

​

• Pupil and Family Data: Names, contact details (e.g., addresses, phone numbers, emails), date of birth, educational records, medical/health information (special category data), behavioural notes, attendance records, assessments, and details of any special educational needs (e.g., anxiety, PDA, trauma, or autism spectrum conditions).

• Staff and Applicant Data: Names, contact details, CVs, references, DBS checks, qualifications, payroll information, and performance reviews.

• Website Visitors: IP addresses, browser types, cookies (for analytics), and contact form submissions (e.g., name, email, inquiry details).

• Other: CCTV footage (where applicable for security), photographs/videos (with consent for educational or promotional purposes), and financial data for fees or funding.

• ​

We collect this data directly from you (e.g., enrolment forms, website forms), third parties (e.g., local authorities for EHCPs, previous schools), or automatically via our website.

 

2. How We Use Your Information

 

We process personal data for specific, legitimate purposes under UK GDPR lawful bases:

​

• Article 6(1)(c) – Legal Obligation: To comply with education laws, such as reporting to the Department for Education (DfE), Welsh Government, Ofsted, or Estyn; conducting school censuses; safeguarding children; and health/safety requirements.

• Article 6(1)(e) – Public Task: To deliver education services, including tailored curriculums, nurture group activities, and holistic support for pupils aged 5-19 with social/emotional needs, mental health issues, autism, or moderate learning difficulties.

• Article 6(1)(a) – Consent: For marketing (e.g., newsletters) or non-essential uses like sharing photos on our website/social media (parental consent required).

• Article 9(2)(b) – Substantial Public Interest (with DPA 2018 Schedule 1):

• For special category data (e.g., health/medical info) to provide education, welfare, or social care, always with explicit consent or legal necessity.

• Article 6(1)(b) – Contract: For staff employment or pupil enrolment agreements.

​

Examples include: personalizing learning plans, monitoring progress, communicating with parents, recruiting staff, and improving our services through analytics.

 

3. Sharing Your Information

 

We share data only when necessary and under strict confidentiality:

​

• Internal: With staff on a need-to-know basis for educational purposes.

• Third Parties: Local authorities (for funding/EHCPs), DfE/Welsh Government (statutory returns), Ofsted/Estyn (inspections), healthcare providers (with consent), or IT providers (e.g., secure cloud storage) under data processing agreements.

• Safeguarding: To social services or police if there's a risk to welfare (legal obligation).

• International Transfers: We do not transfer data outside the UK/EEA without safeguards (e.g., adequacy decisions or standard contractual clauses).

​

We never sell data. All processors are required to comply with UK GDPR.

 

4. Data Security

 

We protect data with appropriate technical and organizational measures:

• Secure servers and encryption for sensitive data.

• Access controls (e.g., password-protected systems).

• Regular staff training on data protection.

• Breach reporting to the Information Commissioner's Office (ICO) within 72 hours if a high-risk breach occurs.

​

In the event of a breach, affected individuals will be notified promptly.

 

5. Data Retention

 

We retain data only as long as necessary:

• Pupil records: Until age 25 (or longer for legal claims/safeguarding).

• Staff records: 6 years post-employment.

• Website inquiries: 1 year unless a service is provided.

• CCTV: 30 days.

​

Data is securely deleted or anonymized when no longer needed, per our retention policy.

 

6. Your RightsUnder UK GDPR, you have rights regarding your data:

• Access: Request a copy (Subject Access Request – free, response within 1 month).

• Rectification: Correct inaccurate data.

• Erasure: Delete data (unless legal obligations prevent it).

• Restriction: Limit processing during disputes.

• Portability: Receive data in a structured format.

• Objection: Oppose processing (e.g., for marketing).

• Withdraw Consent: At any time (without affecting prior processing).

• Automated Decisions: Rights against solely automated decisions with legal effects.

​

To exercise rights, contact the DPO. Complaints can be made to the ICO (ico.org.uk).

 

7. Cookies and Website Tracking

 

Our website uses cookies for functionality and analytics (e.g., Google Analytics).

 

We use essential cookies (no consent needed) and non-essential ones (consent via banner).

 

You can manage preferences in browser settings. 

 

8. Changes to This Policy

 

We may update this policy to reflect changes in law or practices. Significant changes will be notified via email or website. Continued use constitutes acceptance.

 

9. Contact Us

 

For data protection queries:

Data Protection Officer
Bettws Lifehouse
The Old School, Bettws Cedewain, Newtown, Powys, SY16 3DS
Email:  Kay.Jones@bettwslifehouse.org.uk
Phone:01686 651166

Supervisory Authority: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Tel: 0303 123 1113.

 

This policy ensures transparency and compliance, supporting our mission to nurture every child's potential in a safe, secure environment.