1. Who we are

Bloom Academy · Barkingside (“we”, “us”, “our”) is the data controller for the personal information described in this notice. We provide small-group 11+ tuition from Fullwell Cross Library, Barkingside High Street, Ilford IG6 2LL. You can contact us about anything in this notice by emailing hello@bloomacademy.org.uk or calling 07927 213771.

2. What data we collect

Because we work with children, we are careful to collect only what we genuinely need to teach safely and track progress.

From the parent or guardian:

• Name, email address, postal address and telephone number.
• Billing and Direct Debit details (processed by our regulated payment provider — see section 7).
• Records of your enquiries, bookings and correspondence with us.
• Emergency contact details and any consent preferences you give us.

About the child:

• Name, date of birth, year group and current school.
• Target schools and catchment information you choose to share with us.
• Diagnostic results, mock and re-test scores, per-strand benchmark bands, attendance and homework records that power the parent progress dashboard.
• Where you choose to disclose it, any special educational need, medical condition, allergy or reasonable-adjustment requirement. This is “special category” data and we hold it only to keep your child safe and supported.

3. Children and parental consent

Our service is bought and managed by parents and guardians, not by children. We do not knowingly create accounts for, or market directly to, children. Where a child is under 13, any processing that relies on consent (for example, optional photography for marketing) is authorised by the parent or guardian who holds parental responsibility, never by the child. Children of any age can ask us, through their parent, to see or delete the information we hold about them.

4. Why we use your data, and our lawful bases

• To deliver tuition and run your account — scheduling classes, marking attendance and homework, and giving you the progress dashboard. Lawful basis: performance of our contract with you.
• To take payment — collecting monthly fees by Direct Debit and issuing receipts. Lawful basis: performance of our contract; legal obligation for tax records.
• To safeguard children — recording and acting on welfare concerns. Lawful basis: legal obligation and our legitimate interest in child protection; for special category data, the safeguarding condition in the Data Protection Act 2018.
• To keep you informed and improve — service updates, term reminders and (where you opt in) news about results and programmes. Lawful basis: our legitimate interests, and your consent for optional marketing.
• To meet legal and regulatory duties — accounting, insurance and responding to lawful requests. Lawful basis: legal obligation.

Where we rely on consent, you can withdraw it at any time without affecting tuition; where we rely on legitimate interests, you can object and we will review the processing.

5. Where your data is stored (data residency)

We store and process personal data on servers located in the United Kingdom and the European Economic Area (EEA). We do not routinely transfer your data outside the UK/EEA. If a carefully chosen supplier ever needs to process data elsewhere, we will only allow it under safeguards approved for UK transfers (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).

6. How long we keep it

• Enquiries that do not lead to enrolment: up to 12 months, then deleted.
• Active pupil and parent records: for as long as your child is enrolled.
• After your child leaves: progress and tuition records for up to 3 years, so we can answer queries and provide references on request.
• Financial and tax records: 6 full financial years, as UK law requires.
• Safeguarding records: retained in line with statutory guidance and held securely with restricted access.

7. Who we share it with

We never sell your data. We share it only with trusted processors who help us run the service — for example our payment provider (for Direct Debit), our cloud hosting and email providers, and our learning and dashboard platform. Each is bound by a written contract to use the data only on our instructions and to keep it secure. We may disclose information where the law requires it, or where it is necessary to protect a child (see our Safeguarding Statement).

8. Your rights

Under UK GDPR you have the right to:

• be told how your data is used (this notice);
• request a copy of the data we hold (a “subject access request”);
• have inaccurate data corrected;
• ask us to delete data where there is no good reason for us to keep it;
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time.

To exercise any right, email hello@bloomacademy.org.uk. We will respond within one month and will not charge a fee for a reasonable request.

9. ICO registration and complaints

Before we begin teaching and processing families’ data, we will register with the Information Commissioner’s Office (ICO), the UK’s data protection regulator. If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the ICO at ico.org.uk or on 0303 123 1113.