For a simpler explanation, read Your information, for young people.
Who is responsible?
Sumkids Education Centre is responsible for the information described here. Contact us at corrina@sumkidslimavady.co.uk or at Unit E, Limavady Business Park, 89 Dowland Road, Limavady, BT49 0HR about privacy or a complaint.
Information we use
We use parent and guardian contact details, pupil enrolment details, emergency contacts, agreed lesson arrangements, attendance, practice activities, recorded marks, feedback, learning reports and invoices. We also record form acknowledgements, photography choices and access activity needed to protect staff accounts and private links. Optional health information is restricted to people who need it for safe participation.
Why we use it
We use information to answer enquiries, arrange and provide tuition, communicate with families, support learning, manage payments and keep the centre and its accounts safe. We rely on contract for relevant arrangements with parents, legitimate interests for proportionate teaching administration and account security, and legal obligations where applicable. We assess children's interests carefully. Optional photography relies on consent. If optional medical details are shared through a form, we ask for explicit consent for that purpose. Speak to us if you prefer another way to share necessary health information.
Photographs on this website
The photographs on this website show the centre and some of its pupils. They are published only where the centre holds the family's written permission for website use, which can be withdrawn at any time by contacting us. We remove a photograph from the website as soon as reasonably possible after a withdrawal.
Permissions and your choices
Enrolment does not require photography consent or marketing consent. Photography choices are recorded separately by purpose. You can change or withdraw them using a secure permission form or by contacting us. Withdrawal does not affect tuition or the lawfulness of earlier use. We stop new use within our control and discuss what can reasonably be removed. We cannot guarantee recall of printed material already distributed or independent media publication.
Who receives information
Authorised centre staff see information according to their responsibilities. Authorised parents receive selected records through private email links protected by an email code. Hosting, database and email providers process information under agreed instructions. Where enabled, a secure scanning provider checks uploaded documents and Stripe handles hosted card payments. We do not store card numbers, sell pupil information, use advertising trackers or publish pupil profiles. If information must be disclosed to protect a child or comply with law, we limit it to what is necessary.
Hosting and international transfers
The application uses Hostinger for hosting and Neon for database storage. The selected regions and processor contracts must support the centre's data protection requirements. Where a provider or its subprocessors transfer information outside the UK, the centre must establish a lawful transfer mechanism and assess appropriate safeguards. Contact us for the current provider and transfer information.
How long we keep it
We retain information only for the purpose for which it is needed. Unverified forms expire after seven days. Unsuccessful enquiries and enrolment requests are normally reviewed for deletion after 90 days. Teaching records are normally reviewed 12 months after a pupil leaves. Financial records follow the retention period applicable to the centre's legal and tax obligations. Security logs are normally retained for 90 days. A legal or safeguarding hold may require a different period. Backups expire according to the contracted backup schedule.
Your rights
You can ask to see information, correct errors, restrict certain use, object where applicable, request erasure or portability where applicable, and withdraw consent. These rights are not absolute. We check identity and parental authority proportionately, and consider a child's own rights and understanding. Use the privacy rights form or contact us. We normally respond to rights requests within one month, subject to lawful extensions. We acknowledge privacy complaints within 30 days, investigate them without undue delay and explain the outcome. You can complain to the Information Commissioner's Office at ico.org.uk.
Keeping information safe
We restrict access, use encrypted connections and protect stored pupil records. Staff accounts use two-step verification. Keep private links and access codes secure. Staff should use a unique passphrase and sign out on shared devices. A lost or compromised account should be reported promptly. No service can promise absolute security.
Contact details supplied for someone else
Please tell an emergency contact that you have supplied their details and direct them to this notice. Share only information needed for the centre to contact them in an emergency.