Privacy Notice for Headteachers and School Leads
1. Introduction
This Privacy Notice explains how your personal data is collected and used for the EBSA Horizons training initiative, in compliance with UK GDPR. It should be read alongside the main EBSA Partnership Initiative Privacy Policy at ebsahorizons.org/privacy-policy.
2. Data Controller
Your commissioning Local Authority is the Data Controller and determines the purposes and means of processing your personal data. EdPsychEd Ltd (Company No. 12925284) is the Data Processor, processing your personal data on behalf of and under the documented instructions of your Local Authority in accordance with a Data Processing Agreement under Article 28 UK GDPR.
3. Personal Data We Collect
We collect and process the following personal data on behalf of your Local Authority:
• Your name
• Your email address
• Your role or job title
• Your organisation (school name)
• Your progress within Level 1 and Level 3 training (module completion status, dates, progression tags, completion percentages)
• Your assessment responses (pre/post training measures)
• Your school’s progress (e.g., readiness for launch, number of staff achieving Level 1 training)
• Email engagement data (delivery status, bounces, opens)
4. How Your Data Is Used
Your data is processed on behalf of your Local Authority to:
• Administer the EBSA Horizons training
• Track individual and school-wide progress
• Communicate with you about the training
• Provide progress information to Local Authority employees (e.g. Virtual School, Educational Psychology Service) via dashboards and reports
5. Legal Basis for Processing
Your Local Authority, as Data Controller, determines the legal basis for processing. For school staff, this is typically public task under Article 6(1)(e) UK GDPR: processing is necessary for the performance of the authority's statutory functions in relation to school attendance, SEND, and workforce development.
6. Data Sharing
Your personal data is shared only with employees of your Local Authority involved in this initiative (e.g., Virtual Schools Team, Educational Psychology Service), as directed by your Local Authority.
7. Data Minimisation
We only collect and process data necessary for delivering the EBSA Horizons programme. This data is not shared or used for any other purpose.
8. Data Retention
Your data will be retained for the duration of the EBSA Horizons programme and for a maximum of 3 years thereafter for evaluation, continuity, and audit purposes. Your Local Authority may request earlier deletion at any time. You may also request deletion of your personal data at any time, which will be actioned within 30 days.
Where your training records are incorporated into your Local Authority’s employee CPD or training records, they may be retained by the Local Authority in accordance with the Local Authority’s own Records Review and Retention Schedule.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. Full details are set out in the Data Processing Agreement between EdPsychEd Ltd and your Local Authority.
10. Updates to This Privacy Notice
We may update this Privacy Notice from time to time. We will notify you of any significant changes by email.
11. Your Rights Under UK GDPR
You have the right to:
• Access your personal data
• Rectify inaccurate personal data
• Request erasure of your personal data
• Object to processing of your personal data
• Request restriction of processing your personal data
• Request transfer of your personal data
Your Local Authority, as Data Controller, is responsible for responding to these requests. You may contact either EdPsychEd or your Local Authority to make a request.
12. How to Contact Us
For any data protection queries, please contact EdPsychEd’s Data Protection Officer at [email protected], or your Local Authority’s Data Protection Officer directly.
13. Complaints
If you have concerns about how your data is processed, you have the right to complain to the Information Commissioner's Office (ICO).
This privacy notice was last updated on 08.05.2026
Privacy Notice for School Staff Users
1. Introduction
This Privacy Notice explains how your personal data is collected and used for the EBSA Horizons training initiative, in compliance with UK GDPR. It should be read alongside the main EBSA Partnership Initiative Privacy Policy at ebsahorizons.org/privacy-policy.
2. Data Controller and Processor
Your commissioning Local Authority is the Data Controller and determines the purposes and means of processing your personal data. EdPsychEd Ltd (Company No. 12925284) is the Data Processor, processing your personal data on behalf of and under the documented instructions of your Local Authority in accordance with a Data Processing Agreement under Article 28 UK GDPR.
3. Personal Data We Collect
We collect and process the following personal data on behalf of your Local Authority:
• Your name
• Your school email address
• Your role or job title
• Your organisation (school name)
• Your progress within the training courses (module completion status, dates, progression tags, completion percentages)
• Your assessment responses (pre/post training measures)
• Email engagement data (delivery status, bounces, opens)
4. How We Use Your Data
Your data is processed on behalf of your Local Authority to:
• Administer the EBSA Horizons training
• Track individual and school-wide progress
• Communicate with you about the training
• Provide progress information to your school’s Senior Leadership Team
5. Legal Basis for Processing
Your Local Authority, as Data Controller, determines the legal basis for processing. For school staff, this is typically public task under Article 6(1)(e) UK GDPR: processing is necessary for the performance of the authority's statutory functions in relation to school attendance, SEND, and workforce development.
6. Data Sharing
We share your personal data (name, email, and individual progress) with:
• Your school’s Senior Leadership Team and other identified school staff supporting this initiative
• Other staff within your school actively supporting this initiative
We share anonymised, aggregated data about school-wide progress (i.e. no personal information) with:
• Employees of the Local Authority involved in this initiative (e.g. Virtual Schools Team, Educational Psychology Team)
All data sharing is directed by your Local Authority as Data Controller.
7. Data Minimisation
We only collect and process data necessary for delivering the EBSA Horizons programme. This data is not shared or used for any other purpose.
8. Data Retention
Your data will be retained for the duration of the EBSA Horizons programme and for a maximum of 3 years thereafter for evaluation, continuity, and audit purposes. Your Local Authority may request earlier deletion at any time. You may also request deletion of your personal data at any time, which will be actioned within 30 days.
Where your training records are incorporated into your Local Authority’s or school’s employee CPD or training records, they may be retained in accordance with the relevant Records Review and Retention Schedule.
9. Your Rights Under UK GDPR
You have the right to:
• Access your personal data
• Rectify inaccurate personal data
• Request erasure of your personal data
• Object to processing of your personal data
• Request restriction of processing your personal data
• Request transfer of your personal data
Your Local Authority, as Data Controller, is responsible for responding to these requests. You may contact either EdPsychEd or your Local Authority to make a request.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage.
11. Updates to This Privacy Notice
We may update this Privacy Notice from time to time. We will notify you of any significant changes by email.
12. How to Contact Us
For any data protection queries, please contact EdPsychEd’s Data Protection Officer at [email protected], or your Local Authority’s Data Protection Officer directly.
13. Complaints
If you have concerns about our data processing, you have the right to complain to the Information Commissioner's Office (ICO).
This privacy notice was last updated on 08.05.2026