GDPR Policy

Owner: Shaun Jarvis, Founder & CEO  |  Version: 1.0  |  Date: July 2026  |  Review: Annually, or following relevant legislative or operational change

This GDPR Policy sets out how Jarvis Education Ltd meets its obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It should be read alongside our Privacy Policy, which explains in practical terms what data we collect and how we use it.

1. Our commitment

Jarvis Education Ltd is committed to protecting the personal data of the individuals we work with, including the staff of the schools, academy trusts, local authorities and other settings we support, our associates and consultants, event attendees, and website visitors. We handle personal data lawfully, fairly and transparently, and we take our responsibilities as a data controller seriously.

2. Scope

This policy applies to all personal data processed by Jarvis Education Ltd, and to everyone who processes personal data on our behalf, including the Founder & CEO, employees, associates, education consultants and contractors.

3. Data protection principles

We follow the principles set out in the UK GDPR. Personal data must be:

• processed lawfully, fairly and in a transparent manner;
• collected for specified, explicit and legitimate purposes, and not further processed in a way incompatible with those purposes;
• adequate, relevant and limited to what is necessary;
• accurate and, where necessary, kept up to date;
• kept in a form that permits identification for no longer than is necessary;
• processed securely, protecting against unauthorised or unlawful processing and against accidental loss, destruction or damage.

As the data controller, Jarvis Education Ltd is responsible for, and able to demonstrate compliance with, these principles.

4. Lawful bases for processing

We will only process personal data where we have a lawful basis to do so. Depending on the circumstances, the basis we rely on will usually be one of the following:

• Consent – where you have given clear consent for us to process your data for a specific purpose, such as sending you marketing.
• Contract – where processing is necessary to deliver a service you or your organisation has engaged us for, or to take steps at your request before entering into a contract.
• Legal obligation – where we need to process data to comply with the law, such as tax and accounting requirements.
• Legitimate interests – where processing is necessary for our legitimate interests as an education consultancy, provided these are not overridden by your rights and interests.

5. Your rights

Under the UK GDPR you have a number of rights in relation to your personal data. These are:

• the right to be informed about how your data is used;
• the right of access to the personal data we hold about you;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure (the “right to be forgotten”) in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability;
• the right to object to processing, including for direct marketing;
• rights in relation to automated decision-making and profiling.

To exercise any of these rights, please email hello@jarviseducation.co.uk. We will respond to a valid request within one month, as required by the UK GDPR. There is normally no charge, although we may charge a reasonable fee, or decline to act, if a request is manifestly unfounded or excessive.

6. How we keep data secure

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or damage. These include restricting access to those who need it, using reputable and secure systems and service providers, applying secure passwords and, where appropriate, encryption, and ensuring that those working on our behalf understand their data protection responsibilities.

7. Data processors and third parties

Where we use third-party service providers to process personal data on our behalf – for example for website hosting, email, analytics or payments – we ensure that appropriate agreements are in place and that those providers offer sufficient guarantees to meet the requirements of the UK GDPR. We do not sell personal data, and we only share it where we have a lawful basis to do so.

8. Working in educational settings

When our consultants work in schools and other settings, they may see or come into contact with personal data belonging to that setting, including information about children. In these circumstances the setting remains the data controller for its own information, and our consultants act in accordance with the setting’s data protection and safeguarding policies. We handle any such information only as necessary to carry out our work, keep it confidential, and do not retain it beyond what is required.

9. Data breaches

We have procedures in place to detect, report and investigate personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will report it to the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to individuals, we will also inform those affected.

10. Data retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet any legal, regulatory, tax or accounting requirements. When data is no longer needed, it is securely deleted or anonymised.

11. Responsibility and review

The Founder & CEO holds overall responsibility for data protection within Jarvis Education Ltd and acts as the point of contact for any data protection query. This policy will be reviewed annually, or sooner in response to changes in legislation or guidance.

12. How to contact us

For any question about this policy or about how we handle your personal data, or to exercise any of your rights, please contact:

Shaun Jarvis, Founder & CEO
Jarvis Education Ltd
07984 645089
hello@jarviseducation.co.uk

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.