Ivy Reign Academy
Data Protection (GDPR) Policy
Reviewed: October 2025 Next Review: October 2026 Version: 1.0
Introduction
Ivy Reign Academy is committed to protecting the privacy and personal data of all students, staff, parents, and partners.
We recognise our legal responsibilities under the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 to ensure that information is collected, stored, and processed securely and fairly.
We value the trust placed in us and take data protection seriously as part of our duty of care and professional practice.
Purpose
The purpose of this policy is to:
-
Explain how we handle personal data within Ivy Reign Academy.
-
Ensure compliance with GDPR and related data protection laws.
-
Protect individuals’ rights and maintain transparency in data use.
-
Provide clear guidance to staff and volunteers on their responsibilities.
Scope
This policy applies to:
-
All personal data held by Ivy Reign Academy in any form (paper or electronic).
-
All staff, volunteers, and third parties handling personal data on behalf of the academy.
It covers data relating to students, parents, staff, suppliers, and partner organisations.
Data Protection Principles
In accordance with GDPR, Ivy Reign Academy ensures that personal data is:
-
Processed lawfully, fairly, and transparently.
-
Collected for specified, explicit, and legitimate purposes.
-
Adequate, relevant, and limited to what is necessary.
-
Accurate and kept up to date.
-
Stored no longer than necessary.
-
Processed securely, protecting against unauthorised access, loss, or damage.
Types of Data We Collect
We may collect and process the following information:
-
Personal details (name, date of birth, address, contact details).
-
Emergency contacts and medical information for safety purposes.
-
Education and attendance records.
-
Safeguarding records where necessary.
-
Staff employment, payroll, and training information.
-
Photographs or videos for marketing, with explicit consent.
Lawful Basis for Processing
We process personal data under the following legal bases:
-
Consent – when individuals have given clear permission.
-
Contract – where processing is necessary to deliver our services.
-
Legal obligation – to comply with safeguarding or employment law.
-
Vital interests – to protect someone’s life.
-
Public task or legitimate interests – for our educational and community work.
Data Security
-
All data is stored securely, either electronically on password-protected systems or in locked storage.
-
Access is limited to authorised personnel.
-
Portable devices (laptops, phones, USBs) are encrypted or password-protected.
-
Data breaches are reported immediately to the Director and recorded in a Data Incident Log.
Individual Rights
Under GDPR, individuals have the right to:
-
Be informed about how their data is used.
-
Access their data upon request.
-
Request correction or deletion of inaccurate information.
-
Restrict or object to data processing in certain circumstances.
-
Data portability (for transferring personal data electronically).
Requests should be made in writing to the Director at ivyreignsalon@gmail.com, and will be responded to within 30 days.
Data Retention
Data is retained only as long as necessary to fulfil its purpose or meet legal obligations.
After this period, data is securely destroyed or deleted.
Training & Compliance
All staff and volunteers receive training on data protection and confidentiality.
Failure to follow this policy may result in disciplinary action.
Monitoring & Review
This policy will be reviewed annually or sooner if changes to data protection law occur.
Updates will be communicated to all staff and relevant stakeholders.
Signed: ✍️ Charlotte Graves
Role: Director & Designated Safeguarding Lead
Date: October 2025
Contact:
Ivy Reign Academy
Audmoor House, 93 High Street, March, Cambridgeshire PE15 9LH
📞 07568 384539 ✉️ ivyreignsalon@gmail.com