3.1. Overview

Personal data is any information from which you can be directly or indirectly identified, and processing refers to the collection, recording, storage, use, disclosure and generally any other uses, form of operations or dealings with personal data that we have.

Under Data Protection Laws there are specified categories of personal data that require further protection, these categories are known as special category data. This includes person data relating to your health, genetic or biometric data, criminal convictions, sex life or sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. We may, in some circumstances, need to collect and process special category data. More information on this type of collection and processing is set out below.

If you are required to provide any personal data to us which relates to other individuals, such as family members, you agree that you will inform them about the contents of this Privacy Notice and obtain any required consent in accordance with this Privacy Notice.

More information on the types of personal data that we will collect and process about you is detailed below. Please note that depending on your relationship with us (i.e., whether you are a parent or legal guardian, a contact at a school with whom we liaise, candidate applying to work at Edstart or a supplier / third party provider we use to run our business), the personal data that we collect about you will vary so please view the relevant section below which best describes your relationship with us.

3.2. Contacts at a school with whom we liaise.

This section will apply to you if you are an administrator (or in an equivalent job role) of a school utilising Edstart's services or a key contact with whom we liaise with when onboarding and working with schools to provide our services.

1. What personal data do we collect and process about you?
   1. Name;
   2. Contact details such as phone number and email address; and
   3. Job title;
   4. Any information captured during any correspondence with you such as telephone calls, and/or other written or email correspondence;
   5. Information about your marketing preferences; and
   6. Information obtained through our use of cookies and similar technologies such as IP address and device identification. [Please see our cookies policy for more information].
   We do not collect or process any special category data about you.

2. How will we collect your personal data?

   All personal data is collected directly from you or by another contact at the school on your behalf.

3. What will we use your personal data for?

   We only process personal data for the purposes described in this Privacy Notice. Data Protection Laws requires companies to have a "lawful basis" to collect and use personal data. Our 'lawful bases' will be:

   • it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests. In each case we will always consider your interests and undertake a balancing exercise to ensure that our business interest does not cause you harm or override your own interests; or
   • it is necessary to comply with our legal obligations.

   Purpose for processing	Legal grounds for using personal data
   To provide MI information and status updates to you about payments made by parents	We have a legitimate business interest (to provide reports and MI about our services and engagement with parents)
   To generally communicate with you and assist with any complaints you may have	We have a legitimate business interest (to handle and assist with any complaints you may have and correspond with you as our key client contact).
   To market our services to you and to undertake analytics to improve our services	We have a legitimate business interest (to market our services which we think you might be interested in and to improve our services)
   For general internal business management purposes such as: audit; security and accounting purposes; record-keeping and obtaining legal or professional advice from external advisers	We have a legitimate business interest (to comply with audit requirements). We have a legal obligation to protect your personal data.
   For purposes related to a merger, acquisition, sale or restructure	We have a legitimate business interest (to buy and sell companies as appropriate). To comply with our legal obligations including disclosure of information (where legally required) to data protection regulators or law enforcement such as the police We have a legal obligation.

4. Who will we share your personal data with?

   We may share your personal data with:

   1. other Edstart group companies;
   2. our third-party service providers who we engage with to provide fundamental business support required to run our operations efficiently such as IT suppliers, document management providers, software platform providers and information security providers; or
   3. in the event of restructuring or re-organisation, merger, sale or acquisition, any person to whom we may assign or transfer our rights and/or obligations under our agreement with you or any third party;
   4. in the event of a restructuring or re-organisation, merger, sale of the business or acquisition, any companies that are in the process of joining the Edstart Group or acquiring Edstart and their legal and technical advisers to facilitate the transaction; and
   5. regulators and law enforcement agencies including the police and the UK ICO.

3.3. Parents or legal guardians

This section will apply to you if you are the parent or legal guardian of a child attending a school in partnership with Edstart and will be paying your tuition fees using a payment plan.

1. What personal data do we collect and process about you?

   When liaising with you to facilitate your tuition fee payments and devise a payment plan for you, we will collect and process:

   1. Name;
   2. Date of birth;
   3. Contact details including your address, telephone numbers and email address;
   4. Financial information, including payment details such as bank account details (for the purpose of setting up direct debit payments) or credit/debit card details (as alternative methods of payment);
   5. Your account details for when you log onto the Edstart platform including your email address and password;
   6. Information about your payment plan type e.g. whether you will make payments weekly/fortnightly/monthly etc;
   7. Any information captured during any correspondence with you such as telephone calls, and/or other written or email correspondence;
   8. Information about your marketing preferences; and
   9. Information obtained through our use of cookies and similar technologies such as IP address and device identification. Please see our cookies policy for more information.

   We do not collect or process any special category data about you at this stage.

   When liaising with you to recover the tuition fees you owe us under your payment plan with Edstart, we will collect and process:

   1. Name;
   2. Date of birth;
   3. Contact details including your address and address history, telephone numbers and email address;
   4. Your account details for when you log onto the Edstart platform including your email address and password;
   5. Your school tuition fee invoice;
   6. Information about your existing payment plan type;

   7. Any information captured and which you disclose to us during any correspondence with you such as telephone calls, and/or other written or email correspondence when we send you payment reminders or correspond with you about missed payments and/or call you to discuss alternative payment plans including but not limited to:

      1. details about your family and dependents e.g. your marital status, carer responsibilities or number of children and any other information such as information about your lifestyle and living circumstances (e.g. your employment status and job circumstances) which is relevant to why you are unable to make tuition payments under your existing payment plan type;
      2. new payment details such as credit/debit card details; and
   8. Information about a new agreed payment plan type.

   We will typically also process the following types of special category data where you voluntarily disclose it to us:

   1. information about your current or former physical and/or mental health and medical history which may be relevant to why you are unable to make tuition payments under your existing payment plan type;
   2. disability related data e.g. if you have developed a condition or are impacted by somebody else's condition which may be affecting your ability to make tuition payments under your existing payment plan type;
   3. information about any criminal convictions you may have e.g. offences, alleged offences and any court sentence or unspent criminal conviction which may be affecting your ability to make tuition payments under your existing payment plan type.
2. How will we collect personal data?

   All personal data is collected directly from you, for example:

   1. when you set up an account on the Edstart Platform;when you sign-up to receive information from us;
   2. each time you interact and correspond with us (e.g. via email), respond to communications or when contacted by our team regarding account management such as late payments; and
   3. when you make enquiries or raise concerns with our customer service team.
3. What will we use your personal data for?

   We only process personal data for the purposes described in this Privacy Notice. Data Protection Laws requires companies to have a "lawful basis" to collect and use personal data. Our 'lawful bases' will be:

   • it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests. In each case we will always consider your interests and undertake a balancing exercise to ensure that our business interest does not cause you harm or override your own interests;
   • it is necessary to comply with our legal obligations; and/or
   • we have your explicit consent.

   We need to have an additional processing condition when we process your special category data (as indicated above), and we will rely on the following:

   • we have your explicit written consent.
   • it is necessary in connection with any existing/prospective legal claims, to obtain legal advice or for the establishment, exercise or defence of legal claims.

   Purpose for processing	Legal grounds for using personal data
   To onboard you onto the Edstart Platform, check your eligibility, devise a payment plan for you and collect agreed payments	We have a legitimate business interest (to provide a platform which through which we can devise an appropriate payment plan with you and facilitate the collection of tuition fee payments).
   To generally communicate with you and assist with any complaints you may have	We have a legitimate business interest (to handle and assist with any complaints you may have and to correspond with you).
   To generally communicate with you and assist with any complaints you may have	We have a legitimate business interest (to handle and assist with any complaints you may have and to correspond with you).
   To pay the tuition fees to the school	We have a legitimate business interest (to make the tuition fee payments to the school as per your agreement with the school and pursuant to our payment plan).
   To send you marketing emails and to undertake analytics to improve our services	We have your consent We have a legitimate business interest (to improve our services).
   To provide aggregate reporting information to the school on payments made and engagement with Edstart	We have a legitimate business interest (to fulfil our contractual obligations to the school and provide them with appropriate records on payments made).
   To recover the tuition fees you owe to Edstart under your existing payment plan which involves: sending payment reminders; corresponding with you about missed payments; discussing alternative payment plan types; discussing your circumstances which are affecting your ability to pay; and devising a new payment plan type.	We have a legitimate business interest (to communicate late payments and discuss and establish alternative payment solutions with you). Special category data. You have given us explicit consent.
   For quality and training purposes (through recorded/monitored communications including phone calls)	We have a legitimate interest (to develop and improve our communication services).
   Capturing data during conversations with you for the purposes of record keeping, complaints and communication purposes	We have a legitimate business interest (to ensure we appropriately capture all relevant information so that we have appropriate and accurate records of all discussions with you). Special category data You have given us explicit consent.
   For general internal business management purposes such as: audit; security and accounting purposes; record-keeping and obtaining legal or professional advice from external advisers	We have a legitimate business interest (to comply with audit requirements). We have a legal obligation to protect your personal data.
   For purposes related to a merger, acquisition, sale or restructure	We have a legitimate business interest (to buy and sell companies as appropriate).
   To comply with our legal obligations including disclosure of information (where legally required) to data protection regulators or law enforcement such as the police	We have a legal obligation. Special category data We need to use your information in order to establish, exercise or defend our legal rights.

   Who will we share your personal data with?

   We may share your personal data with:

   1. other Edstart group companies; and
   2. the school which your child attends when we provide reporting information to schools which include aggregate reports relating to payments made and engagement with Edstart. However, please note that we will not share any information with schools that we have collected when we liaise with you to recover the tuition fees you owe us under your payment plan with Edstart including any information you voluntarily disclose to us during such correspondence;
   3. our third-party service providers who we engage with to provide fundamental business support required to run our operations efficiently such as IT suppliers, document management providers, software platform providers and information security providers; or
   4. in the event of restructuring or re-organisation, merger, sale or acquisition, any person to whom we may assign or transfer our rights and/or obligations under our agreement with you or any third party;
   5. in the event of a restructuring or re-organisation, merger, sale of the business or acquisition, any companies that are in the process of joining the Edstart Group or acquiring Edstart and their legal and technical advisers to facilitate the transaction; and
   6. regulators and law enforcement agencies including the police and the UK ICO.

3.4. Candidates applying to working at Edstart.

This section will apply to individuals applying to work at Edstart. If, in your application, you provide us with details of anyone else (e.g. references, emergency contacts or family members etc) you should also show this Privacy Notice to them.

1. What personal data do we collect and process about you?
   1. Name, date of birth and gender;
   2. Contact details, including address and address history, telephone numbers and email address;
   3. Your employment data (e.g. skills and experience, details of employment, employment history);
   4. Identity documents (e.g. passport or driving licence);
   5. Information relevant to the recruitment process such as your job title, information about your job role, your CV or cover letter and any other information which you have shared with us as part of the recruitment process and any notes taken from an interview with you; and
   6. Details about your family and dependents (e.g. your marital status and number of children).
   We also typically process the following types of special category data about you:
   1. information about any criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction).
2. How will we collect your personal data?
   1. directly from you when you apply to work at Edstart or during any form of communications such as face to face, written and phone correspondence or interviews during the recruitment process
   2. from correspondence with you on LinkedIn;
   3. from recruitment talent management and employment agencies; and
   4. background check providers such as Disclosure and Barring Service.

   What will we use your personal data for?

   We only process personal data for the purposes described in this Privacy Notice. Data Protection Laws requires companies to have a "lawful basis" to collect and use personal data. Our 'lawful bases' will be:

   • it is necessary in order to take steps to enter into a contract with you;
   • it is necessary to comply with our legal obligations; and/or
   • it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests. In each case we will always consider your interests and undertake a balancing exercise to ensure that our business interest does not cause you harm or override your own interests.

   We need to have an additional processing condition in the event that we process your special category data. In those limited circumstances, we will rely on the following:

   • we have your explicit written consent;
   • it is necessary in connection with any existing/prospective legal claims, to obtain legal advice or for the establishment, exercise or defence of legal claims; or
   • we need to use your special category data to prevent or detect unlawful acts and this use is in the substantial public interest.

   Purpose for processing	Legal grounds for using personal data
   For the purposes of the recruitment process including: considering your suitability for the role; conducting and arranging interviews; carrying out background and criminal checks; determining the terms on which you would work for us and negotiating your employment contract; record-keeping purposes; and general correspondence with you.	It is necessary in order to take steps to enter into a contract with you. It is necessary for legitimate business interests (to undertake recruitment). Special category data. You have given us explicit consent. It is in the substantial public interest to prevent/detect unlawful acts
   For internal business management purposes such as: audit; security and accounting purposes; obtaining legal or professional advice from external advisers	We have a legitimate business interest (to effectively manage our business and undertake recruitment). We have a relevant legal obligation to protect your personal data Special category data. We have your explicit consent. We need to use your information in order to establish, exercise or defend our legal rights.

3. Who will we share your personal data with?
   1. other Edstart group companies;
   2. recruiters and your referees;
   3. our third-party service providers who we engage with to provide fundamental business support required to run our operations efficiently such as IT suppliers, document management providers, software platform providers and information security providers;
   4. regulators and law enforcement agencies including the police and the UK ICO;
   5. in the event of a restructuring or re-organisation, merger, sale or acquisition, any person to whom we may assign or transfer our rights and/or obligations under our agreement with you or any third party; and
   6. in the event of a restructuring or re-organisation, merger, sale of the business or acquisition, any companies that are in the process of joining the Edstart Group or acquiring Edstart and their legal and technical advisers to facilitate the transaction.

3.5. Suppliers or Third Parties

This section will apply to you if you are a supplier or third party with whom we engage with as a part of our business operations.

1. What personal data do we collect and process about you?
   • Name, date of birth and gender;
   • Contact details, including address and address history, telephone numbers and email address;
   • Financial information, including bank details for payment;
   • Information we collect about your employment status, job title and work industry;
   • Information we collect about you as a result of our onboarding, procurement or due diligence checks; and
   • Information captured during any correspondence with you such as telephone calls or written or email correspondence.

   We typically process the following types of special category data: information about any criminal convictions you may have including offences and alleged offences and any court sentence or unspent criminal conviction.

2. How will we collect personal data?
   • Directly from you.
   From third parties including:
   • referees or introducers; and
   • publicly available sources.

3. What will we use your personal data for?

   We only process personal data for the purposes described in this Privacy Notice. Data Protection Laws requires companies to have a "lawful basis" to collect and use personal data. We rely on the following 'lawful bases' when processing your personal data:

   • it is necessary to perform our contract with you;
   • it is necessary to comply with our legal obligations; and/or
   • it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests. In each case we will always consider your interests and undertake a balancing exercise to ensure that our business interest does not cause you harm or override your own interests.

   Purpose for processing	Legal Basis
   To engage and onboard suppliers, business partners and third parties and fulfil our contractual obligations	It is necessary to perform our contract with you. We have a legitimate business interest (to engage third parties for business purpose). We have a relevant legal obligation to protect your personal data.
   For internal business management purposes such as: audit; security and accounting purposes; obtaining legal or professional advice from external advisers	We have a legitimate business interest (to comply with audit requirements). We have a relevant legal obligation or regulatory obligation to protect your personal data.
   To comply with our legal obligations	We have a legal obligation. We have a legitimate business interest (to comply with our legal obligations)
   For purposes related to a merger, acquisition, sale or restructure	We have a legitimate business interest (to buy and sell companies as appropriate).
   To communicate with you and assist with any complaints you may have	It is necessary to perform our contract with you. We have a legitimate business interest (to handle and assist with any complaints you may have). We have a legal obligation.

   Who will we share your personal data with?

   We may share your personal data with:

   • other Edstart group companies; and
   • our third-party service providers who we engage with to provide fundamental business support required to run our operations efficiently such as IT suppliers, document management providers, software platform providers and information security providers; or
   • regulators and law enforcement agencies including the police and the UK ICO;
   • in the event of restructuring or re-organisation, merger, sale or acquisition, any person to whom we may assign or transfer our rights and/or obligations under our agreement with you or any third party; and
   • in the event of a restructuring or re-organisation, merger, sale of the business or acquisition, any companies that are in the process of joining the Edstart Group or acquiring Edstart and their legal and technical advisers to facilitate the transaction