GDPR Policy | The SEND Solution

Our commitment

The SEND Solution Ltd (Company Number: 17223181) is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognise that the families we work with often share sensitive information about their children, and we take our responsibility to protect that information extremely seriously.

Data controller

The SEND Solution Ltd is the data controller for all personal data processed in connection with our services and website. Our registered office is at Suite G04, 1 Quality Court, Chancery Lane, London, England, WC2A 1HR.

For all GDPR-related enquiries, please contact us at [email protected].

The six principles of UK GDPR

We process all personal data in accordance with the six data protection principles under UK GDPR:

Lawfulness, fairness, and transparency: We process personal data lawfully, fairly, and in a transparent manner. We are clear about why we collect data and how it will be used.
Purpose limitation: We collect personal data for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes.
Data minimisation: We only collect personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
Accuracy: We take reasonable steps to ensure that personal data is accurate and kept up to date. We will correct or delete inaccurate data promptly upon request.
Storage limitation: We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law.
Integrity and confidentiality: We process personal data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage.

Lawful basis for processing

We rely on the following lawful bases to process personal data:

Contract performance: processing necessary to deliver our SEND consultancy and advocacy services;
Legal obligation: processing required to comply with applicable law;
Legitimate interests: processing for our legitimate business interests, balanced against your rights and freedoms;
Explicit consent: for special category data (such as health or disability information relating to a child), we always obtain explicit consent before processing.

Special category data

In the course of providing SEND advocacy services, we may process special category data under Article 9 of UK GDPR, including information about a child's health, disability, or educational needs. We process such data only:

With your explicit consent;
Where necessary for the establishment, exercise, or defence of legal claims (such as tribunal proceedings);
Where required by law.

Data subject rights

Under UK GDPR, you have the right to:

Be informed about how your data is used (this policy and our Privacy Policy fulfil this obligation);
Access the personal data we hold about you (Subject Access Request);
Rectify inaccurate or incomplete personal data;
Erasure of your personal data ('right to be forgotten') in certain circumstances;
Restrict the processing of your personal data;
Data portability — receive your data in a structured, commonly used, machine-readable format;
Object to processing based on legitimate interests or for direct marketing purposes;
Not be subject to solely automated decision-making (we do not use automated decision-making).

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month.

International transfers

We do not routinely transfer personal data outside the United Kingdom. Where any transfer is necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Data breaches

We have procedures in place to detect, report, and investigate personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform affected individuals without undue delay.

How to complain

If you have concerns about our data processing practices, please contact us in the first instance at [email protected]. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.