Privacy Notice

1. Who we are

Bloom Academy · Barkingside (“we”, “us”, “our”) is the data controller for the personal information described in this notice. We provide small-group 11+ tuition from Fullwell Cross Library, Barkingside High Street, Ilford IG6 2LL. You can contact us about anything in this notice by emailing hello@bloomacademy.work or calling 07927 213771.

2. What data we collect

Because we work with children, we are careful to collect only what we genuinely need to teach safely and track progress.

From the parent or guardian:

• Name, email address, postal address and telephone number.
• Billing details, card payments and Direct Debit details (processed by our regulated payment providers, see section 7).
• Records of your enquiries, bookings and correspondence with us.
• Emergency contact details and any consent preferences you give us.

About the child:

• Name, date of birth, year group and current school.
• Target schools and catchment information you choose to share with us.
• Diagnostic results, mock and re-test scores, per-strand benchmark bands, attendance and homework records that power the parent progress dashboard.
• Where you choose to disclose it, any special educational need, medical condition, allergy or reasonable-adjustment requirement. This is “special category” data and we hold it only to keep your child safe and supported.

3. Children and parental consent

Our service is bought and managed by parents and guardians, not by children. We do not knowingly create accounts for, or market directly to, children. Where a child is under 13, any processing that relies on consent (for example, optional photography for marketing) is authorised by the parent or guardian who holds parental responsibility, never by the child. Children of any age can ask us, through their parent, to see or delete the information we hold about them.

4. Why we use your data, and our lawful bases

• To deliver tuition and run your account:scheduling classes, marking attendance and homework, and giving you the progress dashboard. Lawful basis: performance of our contract with you.
• To take payment: taking your first pro-rata payment by card, collecting monthly fees by Direct Debit thereafter, and issuing receipts. Lawful basis: performance of our contract; legal obligation for tax records.
• To safeguard children: recording and acting on welfare concerns. Lawful basis: legal obligation and our legitimate interest in child protection; for special category data, the safeguarding condition in the Data Protection Act 2018.
• To keep you informed and improve: service updates, term reminders and (where you opt in) news about results and programmes. Lawful basis: our legitimate interests, and your consent for optional marketing.
• To meet legal and regulatory duties: accounting, insurance and responding to lawful requests. Lawful basis: legal obligation.

Where we rely on consent, you can withdraw it at any time without affecting tuition; where we rely on legitimate interests, you can object and we will review the processing.

5. Where your data is stored (data residency)

We store and process personal data on servers located in the United Kingdom and the European Economic Area (EEA). We do not routinely transfer your data outside the UK/EEA. If a carefully chosen supplier ever needs to process data elsewhere, we will only allow it under safeguards approved for UK transfers (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).

6. How long we keep it

• Enquiries that do not lead to enrolment: up to 12 months, then deleted.
• Active pupil and parent records: for as long as your child is enrolled.
• After your child leaves: progress and tuition records for up to 3 years, so we can answer queries and provide references on request.
• Financial and tax records: 6 full financial years, as UK law requires.
• Safeguarding records: retained in line with statutory guidance and held securely with restricted access.

7. Who we share it with

We never sell your data. We share it only with processors who help us run the service, each bound by a written contract to use the data only on our instructions and to keep it secure:

• Hosting and database: Vercel (the website and application) and Neon (the database).
• Payments: Stripe for card payments and GoCardless for Direct Debit. Card details are entered on their pages and never reach us.
• Email: Resend, for the messages we send you about your account.
• Security: Upstash, which we use to rate-limit sign-in attempts and forms.
• Analytics and advertising: Plausible, and (only with your consent) Meta and Google, as described in section 8.

Optional AI-assisted marking. If, and only if, you switch it on in your dashboard, extracts of your child’s written work are sent to our AI provider (Anthropic, in the United States, under standard contractual clauses) so it can draft feedback. A tutor reads and edits every draft before you see it; nothing is published to you unread, the work is not used to train anyone’s models, and you can withdraw the consent at any time in your dashboard, after which we stop sending anything. Lawful basis: your consent.

We may disclose information where the law requires it, or where it is necessary to protect a child (see our Safeguarding Statement).

8. Cookies, analytics and advertising

We set one essential cookie to keep you signed in; without it the site cannot work, so it needs no consent. Everything else is optional and loads only if you choose “Accept all” on the cookie banner:

• Website analytics: anonymous, aggregated statistics about which pages are read, so we can improve them.
• Advertising measurement: tags from Meta (Facebook/Instagram) and Google that tell us which advert led someone to enquire, so we do not waste money on advertising that does not work. These can involve transfers to the United States under the UK Extension to the EU–US Data Privacy Framework.

These tags run on our public pages and on the confirmation page shown after an application; they never run inside a child’s progress records, and we never send a name, email address or any information about a child to an advertising platform. You can change your mind at any time using the Cookie preferences link in the footer of every page, which brings the banner back. Lawful basis: your consent (PECR and UK GDPR).

9. Your rights

Under UK GDPR you have the right to:

• be told how your data is used (this notice);
• request a copy of the data we hold (a “subject access request”);
• have inaccurate data corrected;
• ask us to delete data where there is no good reason for us to keep it;
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time.

To exercise any right, email hello@bloomacademy.work. We will respond within one month and will not charge a fee for a reasonable request.

10. ICO registration and complaints

Before we begin teaching and processing families’ data, we will register with the Information Commissioner’s Office (ICO), the UK’s data protection regulator. If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the ICO at ico.org.uk or on 0303 123 1113.