EdPsychEd Ltd
Company No: 12925284
Registered in England and Wales
Registered Address: 81-83A ALLERTON ROAD, MOSSLEY HILL, LIVERPOOL, L18 2DA
1. Introduction
The EBSA Partnership Initiative, operated by EdPsychEd Ltd, is committed to protecting your privacy. This policy explains how personal data is collected, used, shared, and protected in connection with the EBSA Horizons training programmes.
This policy applies to all users of the EBSA Horizons training and related platforms, including (but not limited to) Headteachers, School Leads, School Staff Users, Local Authority Heads of Service, Local Authority Professionals, and Parents/Carers accessing Family Horizons. By participating in the EBSA Horizons training, visiting, or otherwise consuming content from this website, you agree to these terms.
The EBSA Horizons programme is delivered as a commissioned service to Local Authorities. Your commissioning Local Authority is the Data Controller and determines the purposes and means of processing your personal data. EdPsychEd Ltd is the Data Processor, processing personal data on behalf of and under the documented instructions of your Local Authority, in accordance with a Data Processing Agreement under Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have any comments or enquiries regarding the practices outlined here, you can contact us via email:
2. Definitions
Personal Data: Any information relating to an identifiable person.
Data Subject: An individual who can be identified by personal data.
Data Controller: The entity determining the purposes and means of processing personal data. For EBSA Horizons, this is your commissioning Local Authority.
Data Processor: An entity processing personal data on behalf of the controller. For EBSA Horizons, this is EdPsychEd Ltd.
Sub-Processor: A third party engaged by the Data Processor to process personal data on behalf of the Data Controller.
Processing: Any operation performed on personal data.
3. Personal Data We Collect
EdPsychEd Ltd collects and processes the following types of personal data on behalf of your Local Authority, depending on your role:
Headteachers, School Leads, Local Authority Heads of Service:
• Name, email address
• Role or job title
• Organisation (school name or LA service)
• Progress within training courses (module completion status, dates, progression tags, completion percentages)
• Assessment responses (pre/post training measures)
• School or organisation’s progress
• Email engagement data (delivery status, bounces, opens)
School Staff Users, Local Authority Professionals:
• Name, school or work email address
• Role or job title
• Organisation (school name or LA service)
• Progress within training courses (module completion status, dates, progression tags, completion percentages)
• Assessment responses (pre/post training measures)
• Email engagement data (delivery status, bounces, opens)
Parents and Carers (Family Horizons, where applicable):
• Name, personal email address
• First part of postcode (e.g. “M1”, “B15”)
• School child attends (optional, provided voluntarily)
• Course progress and completion status
• Email engagement data (delivery status, bounces, opens)
For full details of how parent/carer data is handled, see the Family Horizons Privacy Policy at ebsahorizons.org/family-horizons-privacy-notice.
4. How Your Data Is Used
Your personal data is processed on behalf of your Local Authority to:
• Administer the EBSA Horizons training programmes
• Track individual, school-wide, and service-wide progress
• Communicate about training and progress
• Provide progress information to your Local Authority via dashboards and reports
• Improve and optimise the training programmes
• Provide support and respond to queries
• Comply with legal obligations
Your personal data is not used for any marketing communications.
5. Legal Basis for Processing
Your Local Authority, as Data Controller, determines the legal basis for processing your personal data. The appropriate legal basis depends on your role:
School staff and LA professionals: Your Local Authority typically relies on public task under Article 6(1)(e) of the UK GDPR, on the basis that processing is necessary for the performance of the authority's statutory functions in relation to school attendance, SEND, and workforce development. These functions include:
• Ensuring effective delivery and management of the training programme
• Tracking and improving the initiative's success
• Providing targeted support to participants
• Maintaining consistency across participating schools and Local Authorities
Parents and carers (Family Horizons): Processing is typically based on consent under Article 6(1)(a) of the UK GDPR, given through the voluntary registration process. You can withdraw your consent at any time by contacting EdPsychEd Ltd or your Local Authority, which will result in your account being deleted within 30 days.
Your Local Authority's legal team confirms the appropriate basis for their context. If you have concerns, you have the right to object to processing by contacting your Local Authority or EdPsychEd (see section 14).
6. Data Sharing
Your personal data is shared only with relevant parties as directed by your Local Authority:
Headteachers and School Leads:
• Data shared with involved Local Authority employees
School Staff Users:
• Personal data shared with school’s Senior Leadership Team and staff supporting the initiative
• Anonymised, aggregated data shared with involved Local Authority employees
Local Authority Heads of Service:
• Data shared with involved Local Authority employees
Local Authority Professionals:
• Personal data shared with Service’s Senior Leadership Team and staff supporting the initiative
• Anonymised, aggregated data shared with involved Local Authority employees
We do not sell any personal information to third parties or use it for any marketing purposes.
7. Sub-Processors
EdPsychEd Ltd uses the following sub-processors, each authorised by your Local Authority under the Data Processing Agreement:
GoHighLevel (HighLevel Inc.): Platform hosting, workflows, data storage, and email delivery. Hosted in the United States (Google Cloud Platform / Amazon Web Services). DPF certified; Standard Contractual Clauses with UK Addendum; DPA executed.
Make.com (Celonis SE): Dashboard aggregation and automation orchestration. Hosted in the EU (Czech Republic). SOC 2 Type 2 certified; GDPR compliant.
Zapier Inc.: Automation orchestration. Hosted in the United States (AWS). SOC 2 Type 2 certified; DPA executed. Data transits through Zapier but is not stored beyond execution logs (retained 30 days).
Cloudflare Inc.: Website security, DDoS protection, and performance optimisation. Data processed at the nearest edge location globally. Standard Contractual Clauses in place; DPA available.
Notion Labs Inc.: Internal task management and project coordination. Hosted in the United States (AWS). DPF certified (including UK Extension); SOC 2 Type 2; ISO 27001; DPA executed.
Google LLC (Analytics): Course usage analytics with IP anonymisation; no user IDs. DPF certified; cookie consent obtained.
Google Cloud Platform / Amazon Web Services: Infrastructure (via GoHighLevel). SOC 2 Type 2; ISO 27001; DPF certified.
These sub-processors are contractually obligated to process personal data only for the purposes of delivering services to EdPsychEd Ltd and in compliance with all applicable data protection laws. Your Local Authority is notified of any intended changes to this list at least 30 days in advance, in accordance with the Data Processing Agreement.
8. Data Minimisation and Retention
We collect and process only the personal data necessary for delivering the EBSA Horizons programme. Personal data is retained for the duration of the commissioning arrangement between EdPsychEd Ltd and your Local Authority, plus a maximum of 3 years thereafter to:
• Support longitudinal impact evaluation across annual training cohorts
• Maintain continuity of accreditation records in the event of partnership renewal
• Meet audit and accountability requirements
Your Local Authority may request earlier deletion at any time, which will be actioned within 30 days. After the retention period, all individual records are securely deleted from the platform. Only fully anonymised, aggregated statistics from which no individual can be identified are retained.
Where individual training records are incorporated into a Local Authority’s employee CPD or training records, they may be retained by the Local Authority in accordance with the Local Authority’s own Records Review and Retention Schedule.
If you request earlier deletion of your personal data, we will comply within 30 days unless legally obligated to retain it, and will confirm deletion to both you and your Local Authority.
9. Your Rights Under UK GDPR
Under UK GDPR, you have the following rights:
1. To be informed about the collection and use of your personal data
2. To access your personal data
3. To have inaccurate personal data rectified
4. To request erasure of your personal data in certain circumstances
5. To restrict processing of your personal data
6. To data portability
7. To object to processing based on legitimate interests
8. Rights related to automated decision making and profiling
Your Local Authority, as Data Controller, is responsible for responding to requests to exercise your rights. EdPsychEd Ltd will assist your Local Authority in fulfilling these requests. You may contact either EdPsychEd or your Local Authority to make a request.
To exercise your rights via EdPsychEd, please contact our Data Protection Officer using the details provided in section 14. We will acknowledge your request within 3 working days and coordinate with your Local Authority. A full response will be provided within one month (extendable to three months for complex requests).
10. Data Security
EdPsychEd Ltd implements appropriate technical and organisational measures to protect your personal data, including:
• Data encryption in transit (TLS) and at rest across all sub-processors
• Dedicated sub-accounts for each Local Authority with logical data segregation
• Platform access restricted to named personnel with two-factor authentication mandatory
• Quarterly access reviews to ensure permissions remain appropriate
• All personnel with platform access have completed data protection training, refreshed annually
• Regular security assessments
• Incident response plans
Our sub-processors maintain equivalent or higher security standards, which we regularly review. Full details of technical and organisational security measures are set out in the Data Processing Agreement between EdPsychEd Ltd and your Local Authority.
11. Comments and User-Generated Content
The EBSA Horizons training platform from EdPsychEd allows users to comment on courses. These comments are visible to users within your organisation/school and to the EBSA Horizons team. Please exercise caution when disclosing personal information in public areas of the platform, and do not share any identifiable information about others.
12. Links to Other Websites
The EBSA Horizons training platform (hosted by EdPsychEd) may contain links to external websites. We are not responsible for the content or privacy practices of these sites. Review the privacy policy of any site you visit.
13. Updates to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices or for operational, legal, or regulatory reasons. We will notify you of any material changes via email or through a prominent notice on our website prior to the change becoming effective. We encourage you to periodically review this policy.
14. Contact Information
For questions about this Privacy Policy or your personal data, contact EdPsychEd's Data Protection Officer:
Email: [email protected]
Registered Address: 81-83A ALLERTON ROAD, MOSSLEY HILL, LIVERPOOL, L18 2DA
Please include "Privacy Policy Inquiry" in the subject line of your email.
You may also contact your Local Authority’s Data Protection Officer directly. Your Local Authority, as Data Controller, is ultimately responsible for the processing of your personal data.
15. Complaints
If you have concerns about how your data is processed:
1. Contact EdPsychEd's Data Protection Officer at: [email protected], or your Local Authority’s Data Protection Officer
2. If unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
16. Specific Privacy Notices
We provide specific privacy notices for different user groups, which should be read alongside this main Privacy Policy:
• Headteachers and School Leads: ebsahorizons.org/schools-privacy-notice
• School Staff Users: ebsahorizons.org/schools-privacy-notice
• Local Authority Heads of Service: ebsahorizons.org/services-privacy-notice
• Local Authority Professionals: ebsahorizons.org/services-privacy-notice
• Parents and Carers (Family Horizons): ebsahorizons.org/family-horizons-privacy-notice
In case of conflict, the specific notices take precedence for the respective user categories.
17. Data Breach Procedures
EdPsychEd Ltd has procedures to address suspected personal data breaches:
1. Detection and reporting
2. Containment and recovery
3. Risk assessment
4. Notification to your Local Authority (as Data Controller) without undue delay, and in any event within 72 hours
5. Evaluation and response
Your Local Authority, as Data Controller, is responsible for determining whether notification to the ICO or affected Data Subjects is required. EdPsychEd Ltd will cooperate fully with your Local Authority in the investigation, mitigation, and remediation of any breach.
18. International Data Transfers
Some of our sub-processors are located in the United States or process data globally. Personal data entered into the platform is therefore subject to a restricted international transfer under UK GDPR. The following safeguards are in place:
• HighLevel Inc. (GoHighLevel) is certified under the EU–US Data Privacy Framework, with the UK Extension providing equivalent protection for UK–US transfers. Standard Contractual Clauses (EU 2021 SCCs) adopted for UK use with the ICO’s UK Transfer Addendum are also in place.
• Zapier Inc. is SOC 2 Type 2 certified with a DPA executed. Data transits through Zapier but is not stored beyond execution logs (retained 30 days).
• Notion Labs Inc. is certified under the EU–US Data Privacy Framework (including the UK Extension), with SCCs in place and a DPA executed.
• Cloudflare Inc. has Standard Contractual Clauses in place and a DPA available.
• Data is encrypted in transit (TLS) and at rest across all sub-processors.
EdPsychEd Ltd will not transfer personal data to any country outside the UK without appropriate safeguards in place in accordance with the Data Protection Legislation.
19. Cookies and Similar Technologies
The EBSA Horizons training platform uses cookies and similar technologies to enhance user experience and collect usage information. We use:
1. Strictly necessary cookies
2. Analytical/performance cookies
3. Functionality cookies
You can set your browser to refuse cookies, but this may affect platform functionality. For more details, see our Cookie Policy below.
20. Children's Privacy
The EBSA Horizons training platform is not intended for children under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data without appropriate consent, please contact us immediately at [email protected], and we will remove the information.
21. Governing Law and Jurisdiction
This Privacy Policy is governed by the laws of England and Wales. Any legal proceedings related to this policy shall be brought exclusively in the courts of England and Wales.
Last updated: 08.05.2026
By using the EBSA Horizons training platform, you acknowledge that you have read, understood, and agree to this Privacy Policy.
Q1: What personal data do you collect?
We collect names, email addresses, and training progress data on behalf of your Local Authority. See our Privacy Policy for details.
Q2: How do you use my data?
We use your data on behalf of your Local Authority to administer the EBSA training programme, track progress, and communicate with you about the training.
Q3: Who is the Data Controller?
Your commissioning Local Authority is the Data Controller. EdPsychEd Ltd is the Data Processor, processing your data on behalf of and under the instructions of your Local Authority.
Q4: Who do you share my data with?
We share data with relevant parties within your school/Local Authority as directed by your Local Authority, and with our sub-processors who help deliver the platform. We never sell your data or use it for marketing purposes.
Q5: How long do you keep my data?
We retain your data for the duration of the EBSA Horizons programme and for up to 3 years afterwards for evaluation and continuity purposes. Your Local Authority may request earlier deletion at any time.
Q6: How do I exercise my GDPR rights?
Contact EdPsychEd's Data Protection Officer at [email protected], or your Local Authority’s Data Protection Officer directly.
Q7: Is my data secure?
Yes, we implement robust security measures including encryption, access controls, two-factor authentication, and regular security assessments.
Q8: Do you use cookies?
Yes, we use essential, analytical, and functional cookies. See our Cookie Policy for more information.
Q9: What if there's a data breach?
We have procedures to detect, report, and investigate breaches. We will notify your Local Authority within 72 hours, and your Local Authority will determine whether to notify you and/or the ICO.
Q10: Can I delete my data?
Yes, you can request deletion of your data at any time. We will action your request within 30 days and confirm deletion to you and your Local Authority.
EdPsychEd Ltd is committed to GDPR compliance. As a Data Processor, we:
1. Process personal data only on documented instructions from the Data Controller (your Local Authority)
2. Ensure that persons authorised to process personal data have committed to confidentiality
3. Implement appropriate technical and organisational security measures
4. Engage sub-processors only with the Data Controller’s authorisation and under equivalent data protection obligations
5. Assist the Data Controller in responding to Data Subject rights requests
6. Assist the Data Controller with security, breach notification, and data protection impact assessments
7. Delete or return all personal data at the end of the service, and delete existing copies unless storage is required by law
8. Make available all information necessary to demonstrate compliance with Article 28 UK GDPR, and allow for audits and inspections
We have implemented measures including:
• Regular staff training on data protection
• Robust data protection policies and procedures
• Data Protection Impact Assessments where necessary
• Appointment of a Data Protection Officer
For questions about our GDPR compliance, contact [email protected].
Your Local Authority, as Data Controller, is responsible for responding to requests to exercise your rights under UK GDPR. EdPsychEd Ltd will assist your Local Authority in fulfilling these requests. You may submit your request to either party.
To submit a request via EdPsychEd:
3. Email [email protected] with “DSAR Request” in the subject line.
4. Provide your full name, email address associated with your EBSA Horizons account, and specify which right(s) you’re exercising.
5. We’ll verify your identity within 3 working days, in coordination with your Local Authority where necessary.
6. We’ll process your request within one month. If complex, we may extend this by two months, but we’ll inform you within the first month.
7. We’ll provide the information electronically unless you request otherwise.
8. There’s no fee for the first request, but a reasonable fee may be charged for repetitive or excessive requests.
For any questions, contact our Data Protection Officer at [email protected].
Last updated: 08.05.2026
Introduction
This Cookies Policy explains how the EBSA Partnership Initiative (“we”, “us”, or “our”) uses cookies and similar technologies on the EBSA Horizons training platform (hosted by EdPsychEd Ltd). We use cookies to enhance your user experience and collect information about how you use our service.
What are Cookies?
Cookies are small text files placed on your device when you visit our website. They help us recognise your device and remember certain information about your visit.
Types of Cookies We Use
We use the following types of cookies:
a. Strictly Necessary Cookies: Essential for the operation of our platform. They enable core functionality such as security, network management, and accessibility.
b. Analytical/Performance Cookies: Allow us to recognise and count the number of visitors and see how visitors move around our platform. This helps us improve the way our platform works.
c. Functionality Cookies: Used to recognise you when you return to our platform. This enables us to personalise our content for you and remember your preferences.
Third-Party Cookies
Some cookies may be set by third-party services we use, such as GoHighLevel, Make.com, Zapier, Cloudflare, and Notion. Please refer to their respective cookie policies for more information.
How to Manage Cookies
Most web browsers allow you to control cookies through their settings preferences. However, if you limit the ability of websites to set cookies, you may impair your overall user experience.
To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org.
Changes to Our Cookie Policy
We may update this Cookie Policy from time to time. Please review this policy periodically for any changes.
Contact Us
If you have any questions about our use of cookies, please contact us at [email protected].
By continuing to use the EBSA Horizons training platform, you consent to the use of cookies as described in this policy.
Terms of Use
EdPsychEd and EBSA Horizons Terms of Use
Last updated: 08.05.2026
Thank you for using EBSA Horizons!
These Terms of Use ("Terms") govern your use of the EBSA Horizons training platform and services provided by EdPsychEd Ltd. Please read these Terms carefully before using the platform. By using the EBSA Horizons training programmes, you agree to be legally bound by these Terms. If you do not agree to these Terms, please do not use the platform.
1. Use of Service
The EBSA Horizons training programmes are intended for use by professionals in educational and related fields for the purpose of training in Emotionally Based School Avoidance (EBSA). You agree to use the service only for its intended purpose.
2. User Accounts
You are responsible for maintaining the confidentiality of your account credentials. You agree to notify us immediately of any unauthorised use of your account.
3. Intellectual Property
All content provided on the EBSA Horizons training programmes, including but not limited to text, graphics, logos, images, audio clips, digital downloads, and data compilations, is the property of EdPsychEd Ltd or its content suppliers and is protected by UK and international copyright laws.
4. User Content
You retain ownership of any content you submit to the platform. However, by submitting content, you grant EdPsychEd Ltd a worldwide, non-exclusive, royalty-free license to use, reproduce, and distribute that content in connection with the service (e.g. to be shown on the platform).
5. Prohibited Conduct
You agree not to:
- Use the service for any unlawful purpose
- Impersonate any person or entity
- Interfere with or disrupt the service or servers
- Attempt to gain unauthorised access to any part of the service
6. Disclaimer of Warranties
The service is provided "as is" without any warranties, express or implied. EdPsychEd Ltd does not warrant that the service will be uninterrupted or error-free.
7. Limitation of Liability
EdPsychEd Ltd shall not be liable for any indirect, incidental, special, consequential, or punitive damages resulting from your use of or inability to use the services, training and related materials.
8. Changes to Terms
We reserve the right to modify these Terms at any time. We will notify users of any significant changes via email or through a prominent notice on our platform.
9. Governing Law
These Terms shall be governed by and construed in accordance with the laws of England and Wales.
10. Data Protection
We process personal data in accordance with our Privacy Policy and all applicable data protection laws. Your Local Authority is the Data Controller; EdPsychEd Ltd is the Data Processor.
11. Termination
We reserve the right to terminate or suspend your access to the service at our sole discretion, without notice, for conduct that we believe violates these Terms or is harmful to other users, us, or third parties, or for any other reason.
12. Contact Information
If you have any questions about these Terms, please contact us at [email protected].
By using the EBSA Horizons training programmes, you acknowledge that you have read, understood, and agree to be bound by these Terms of Use.