The Willows is committed to protecting the privacy and personal data of all young people, families, referring schools, local authorities, and staff. This policy sets out how we collect, use, store, and protect personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to all personal data held by The Willows, whether in paper or digital form, and covers all individuals whose data we process — including young people, parents and carers, referring professionals, and any staff or volunteers.

The data controller for The Willows is Nicola Bevan, Lead Practitioner, Oakridge, Buddenfield Lane, Shedfield, Hampshire, SO32 2HP. Contact: [email protected].

We may collect and hold the following categories of personal data:

About young people:

• Full name, date of birth, gender, and address.
• School name and year group.
• Details of SEND needs, EHCP status, and relevant diagnoses.
• Social, emotional, and mental health (SEMH) background and history.
• Risk assessment information, including behavioural history and known triggers.
• Session records, monitoring forms, and progress notes.
• Attendance records.
• Photographs, where explicit consent has been obtained.

About parents, carers, and referring professionals:

• Full name, role, organisation, and contact details.
• Correspondence and communications relating to a young person's placement.
• Consent and declaration records from referral forms.

We do not collect more personal data than is necessary for the purposes described in this policy.

We use personal data for the following purposes:

• Delivering and managing placements — to assess suitability, plan sessions, monitor progress, and communicate with families and schools.
• Safeguarding and child protection — to fulfil our legal duties to keep young people safe, including sharing information with statutory agencies where required.
• Risk management — to ensure sessions are safe for the young person, staff, and animals.
• Record keeping and reporting — to maintain accurate records of attendance, progress, and incidents, and to provide reports to schools and local authorities as agreed.
• Legal compliance — to meet our obligations under education, health and safety, and data protection law.
• Communication — to respond to enquiries and referrals, and to keep families and schools informed about their young person's placement.

We process personal data on the following lawful bases under UK GDPR:

• Legitimate interests — for the day-to-day management of placements and communication with families and schools.
• Legal obligation — where we are required by law to process data, including for safeguarding and health and safety purposes.
• Consent — where we ask for explicit consent, for example for photography or for sharing information beyond what is strictly necessary. Consent can be withdrawn at any time.
• Vital interests — in emergency situations where processing is necessary to protect the life of the young person or another individual.

Where we process special category data (such as health information or details of SEND needs), we do so under Article 9(2)(b) UK GDPR (employment, social security, and social protection law) and/or Article 9(2)(g) (substantial public interest), as well as Schedule 1 of the Data Protection Act 2018.

The Willows takes the security of personal data seriously. We take the following steps to protect the information we hold:

• Paper records containing personal data are stored securely and are not left unattended in accessible areas.
• Digital records are stored on password-protected devices and/or secure cloud services.
• Personal data is not shared with third parties except where required by law, necessary for safeguarding, or where explicit consent has been given.
• Emails containing sensitive personal data are sent securely and only to verified recipients.
• We do not use personal data for marketing or commercial purposes.

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Session records and monitoring forms: retained for a minimum of 7 years after the young person's placement ends, or until the young person reaches the age of 25 — whichever is later. This is in line with guidance for educational and child welfare records.
• Referral forms and correspondence: retained for 7 years after the end of the placement.
• Safeguarding records: retained indefinitely where there has been a child protection concern, in line with statutory guidance.
• Enquiry and contact data (where no placement resulted): deleted within 12 months of the last contact.

When data is no longer required, paper records are securely shredded and digital records are permanently deleted.

We will only share personal data with third parties in the following circumstances:

• Safeguarding referrals — where we have a legal duty to share information with children's services, the police, or other statutory agencies to protect a young person from harm.
• With the referring school or local authority — to provide progress updates and reports as agreed at the point of referral.
• With parents and carers — as appropriate and in line with the young person's best interests.
• With other professionals involved in the young person's care — only where consent has been given or where there is a lawful basis to do so.
• Legal requirements — where we are required to disclose information by law or court order.

We do not sell, rent, or share personal data with any commercial third parties.

Under UK GDPR, individuals have the following rights in relation to their personal data:

• Right of access — you can request a copy of the personal data we hold about you or your child.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — in certain circumstances, you can ask us to delete personal data we hold.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to object — you can object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact Nicola Bevan at [email protected]. We will respond within one calendar month.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

The Willows website may use cookies or similar technologies to improve the user experience. Where this is the case, users will be informed and given the opportunity to consent. We do not use tracking or advertising cookies. Any data collected through the website (such as enquiry form submissions) is handled in line with this policy.

This policy will be reviewed annually, or sooner if there is a change in legislation or the way we operate. The current version will always be available on our website. The policy owner is Nicola Bevan.