Privacy and Data Protection (GDPR) Policy

SPM Development Services Limited Privacy and Data Protection (GDPR) Policy September 2026

Reviewed and Updated: September 2026
Next Review: September 2027, or sooner if data protection legislation or statutory guidance changes.
Approved by: Simon Piper-Masha

Introduction

SPM Development Services Ltd is committed to protecting personal information and using it lawfully, fairly and transparently. This policy explains how SPM collects, uses, shares, stores and protects personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

Who We Are

SPM Development Services Ltd is the data controller for the personal data it collects and processes.
The Head of Centre is responsible for overseeing data protection compliance and responding to data protection enquiries.
Address: 90 East India Way, Croydon, Surrey, CR0 6RZ

Website: https://spmdevelopmentservices.co.uk

What Information We Collect

SPM may collect and process:
  • Names, addresses, contact details and dates of birth.
  • Information about learners’ education, attendance, progress, support needs and Education, Health and Care Plans.
  • Health, disability, safeguarding and wellbeing information where relevant to providing safe and appropriate support.
  • Information about parents, carers, commissioners and other professionals involved with the learner.
  • Staff and tutor information, including identity checks, qualifications, training, Disclosure and Barring Service information and payment details.
  • Photographs, recordings or online learning information where there is a clear and lawful reason for collecting them.
  • Records relating to complaints, incidents, risk assessments, quality assurance and communication.
SPM will collect only the information necessary for a clear purpose. Health, disability and safeguarding information will be treated as special category data and given additional protection. Information about criminal convictions or offences will only be processed where there is a lawful basis and appropriate safeguards are in place.

How We Use Personal Information

SPM may use personal information to:
  • Arrange and provide education, mentoring and learner support.
  • Understand learners’ needs and make reasonable adjustments.
  • Monitor attendance, progress, outcomes and the quality of provision.
  • Communicate with learners, parents, carers, tutors, professionals and commissioning authorities.
  • Meet safeguarding, health and safety and statutory reporting responsibilities.
  • Register learners for qualifications, support assessment and quality assurance, and claim certification.
  • Recruit tutors and verify their identity, suitability, qualifications and training.
  • Manage contracts, payments, complaints, incidents and organisational records.
  • Meet legal, regulatory, awarding organisation and commissioning requirements.
SPM will not use personal information for purposes that are incompatible with the reason it was collected.

Lawful Bases for Processing

SPM will identify and record an appropriate lawful basis before processing personal data. Depending on the circumstances, this may include:
  • Processing necessary to fulfil a contract or take steps before entering into a contract.
  • Processing necessary to comply with a legal obligation.
  • Processing necessary to protect someone’s vital interests.
  • Processing necessary for a task carried out in the public interest, including education and safeguarding functions delivered on behalf of commissioning authorities.
  • Processing necessary for SPM’s legitimate interests, where these are not overridden by the individual’s rights and interests.
  • Consent, where this is the most appropriate lawful basis and can be freely given and withdrawn.
Where special category data is processed, SPM will also identify an additional condition under data protection law. This may include health or social care, safeguarding, substantial public interest or legal claims. Consent will not be relied upon where another lawful basis is more appropriate.

Safeguarding and Information Sharing

SPM will share information when this is necessary and proportionate to safeguard a child or young person. Consent is not always required where there is a lawful basis for sharing information to prevent harm or protect someone’s vital interests.
Information-sharing decisions will be made in line with Keeping Children Safe in Education (2026), Working Together to Safeguard Children (2026) and current government information-sharing guidance. The Designated Safeguarding Lead will oversee safeguarding information-sharing decisions and ensure that the reasons for sharing, or deciding not to share, are recorded.

Security Measures

SPM uses technical and organisational measures to protect data against loss, damage or unauthorised access. These include secure storage, password protection, restricted access, encryption where appropriate, and regular staff training in data protection.

Staff Responsibilities

  • All staff, tutors and contractors must:
  • Only collect and use data necessary for their role
  • Keep records factual, accurate and secure
  • Report any suspected personal data breach or data protection concern immediately to the Head of Centre.
  • Follow SPM policies on safeguarding, online safety and record keeping

Personal Data Breaches

All suspected personal data breaches must be reported immediately to the Head of Centre. SPM will take prompt action to contain the breach, assess the risk, recover or protect information where possible and record the incident and action taken.
Where a breach is likely to result in a risk to people’s rights and freedoms, SPM will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it.
Where the risk is high, we will also inform affected individuals without undue delay. All breaches will be recorded, including those that do not require notification.

Retention of Information

SPM will keep personal information only for as long as it is needed for the purpose for which it was collected and to meet safeguarding, legal, contractual, commissioning and awarding organisation requirements.
Retention periods will be recorded in SPM’s retention schedule and reviewed regularly. Different types of records may be retained for different periods. Safeguarding records may need to be kept for longer where this is necessary to protect a child or young person or respond to a future concern.
When information is no longer required, it will be securely deleted, destroyed or anonymised. Information subject to an ongoing safeguarding matter, complaint, investigation, legal claim or information request will not be destroyed until the matter has concluded.

Your Data Protection Rights

Depending on the circumstances, individuals may have the right to:
  • Be informed about how their personal information is used.
  • Request access to their personal information.
  • Request correction of inaccurate or incomplete information.
  • Request deletion of their information.
  • Request restriction of processing.
  • Object to the use of their information.
  • Request transfer of information in a portable format.
  • Withdraw consent where processing is based on consent.
  • Raise concerns about decisions made solely by automated means where these significantly affect them.

These rights are not absolute and may be limited by legal, safeguarding or regulatory
requirements. Requests should be made to the Head of Centre and will normally be
answered within one month. This period may be extended by up to two further months
where a request is complex or numerous. SPM will explain any extension or lawful reason
for refusing or limiting a request. There will normally be no charge.

Data Protection Complaints

Anyone who is concerned about how SPM has handled their personal information may make a complaint to the Head of Centre using the contact details in this policy.
SPM will acknowledge the complaint within 30 days, make appropriate enquiries without undue delay, keep the complainant informed and provide a written outcome.
If the complainant remains dissatisfied, they may raise the matter with the Information Commissioner’s Office at www.ico.org.uk.

Policy Review

This policy will be reviewed annually, or sooner if legislation or statutory guidance changes.