How we collect, use and protect personal information
Policy owner: Director, Oak Path Education Ltd
Effective date: 5 November 2026
Next review date: 5 November 2027
1. Who We Are
Oak Path Education Ltd is an independent educational consultancy providing specialist guidance and support to parents and families navigating children’s educational needs, learning differences and Special Educational Needs and Disabilities (SEND).
Company name: OAK PATH EDUCATION LTD
Company number: 17208884
Registered office: 71–75 Shelton Street, London, WC2H 9JQ
Email: oakpathteam@gmail.com
Oak Path Education Ltd is the data controller responsible for personal information processed in connection with its services.
We are committed to protecting personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable privacy legislation.
2. Who This Notice Applies To
This Privacy Notice applies to:
- Parents, carers and families who enquire about or use our services.
- Children and young people whose information is shared with us.
- Visitors to our website.
- Schools, educational professionals and other organisations with whom we communicate.
- Individuals who subscribe to our newsletter.
- Suppliers and professional contacts.
3. Information We Collect
Depending on the nature of an enquiry or service, we may collect:
Personal and contact information
- Names, email addresses and telephone numbers provided through our enquiry form.
- Parent or carer relationships and relevant family circumstances.
- Children’s ages, school year groups and educational settings, where relevant.
Educational information
- Educational psychology reports and specialist assessment reports.
- Individual Support Plans, Education, Health and Care Plans (EHCPs) and relevant school records.
- Information about learning difficulties, SEND, academic progress and educational provision.
- Correspondence with schools and educational professionals.
Sensitive personal information
Where necessary for an agreed service, we may receive information relating to health conditions, disability, neurodevelopmental diagnoses, mental health, emotional wellbeing or safeguarding concerns.
Some of this information constitutes special-category personal data and is subject to additional legal protections.
Financial and business information
- Consultation bookings and agreements.
- Invoices and bank transfer payment records.
- Relevant business correspondence.
Website and newsletter information
Our website enquiry form collects:
- Name and email address.
- Telephone number.
- Child’s age.
- Type of support requested.
- Enquiry message.
- Newsletter subscription preference.
Our footer newsletter form collects the information submitted by subscribers.
We also process information necessary for website operation, security and administration.
We aim to collect only information reasonably necessary for the relevant purpose.
4. How We Obtain Information
We may obtain personal information:
- Directly from parents, carers and clients through our website, email or consultations.
- Through educational and specialist reports provided to us.
- From schools and educational professionals where sharing is lawful and appropriate.
- Through authorised professional referrals.
- Through our website enquiry and newsletter forms.
Where information is obtained indirectly, we will provide appropriate privacy information to the individuals concerned, subject to applicable legal exceptions.
5. Why We Use Information and Our Lawful Bases
We process personal information only where an appropriate lawful basis applies.
Purpose
Lawful basis
Responding to enquiries and arranging consultations
Steps requested before entering a contract, or legitimate interests where appropriate
Providing agreed educational consultancy
Contract for the contracting client’s information; legitimate interests or another applicable basis for other individuals
Reviewing educational reports and preparing guidance
Contract or legitimate interests, together with an Article 9 condition where required
Communicating with schools and external professionals
Legitimate interests, consent or another applicable lawful basis
Maintaining consultation and business records
Contract, legitimate interests or legal obligation
Financial administration and tax compliance
Contract and legal obligation
Responding to safeguarding concerns
Legal obligation, legitimate interests or vital interests, as applicable
Website security and administration
Legitimate interests, subject to applicable electronic privacy requirements
Newsletter subscriptions and future marketing
Consent, where required
Our legitimate interests include administering our business, responding to enquiries, delivering and improving services, maintaining appropriate records and communicating with relevant professionals.
Where legitimate interests are relied upon, we consider whether these are outweighed by the rights and freedoms of the individuals concerned.
6. Special-Category Information and Consent
Oak Path Education Ltd may review information concerning a child’s health, disability, mental health or developmental needs as part of an agreed educational consultancy service.
Before processing special-category information, we will identify an appropriate lawful basis under Article 6 of UK GDPR and a separate condition under Article 9.
Where explicit consent is the applicable Article 9 condition, we will obtain and record that consent before processing the relevant information.
Consent will be specific to the information and purposes involved and separate from consent for marketing communications.
We will consider the child’s own data protection rights, capacity and the authority of the person providing consent.
Where processing relies on consent, individuals may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully.
We will not assume that engaging our services automatically authorises every use or disclosure of sensitive information.
7. Children’s Personal Information
Oak Path Education Ltd primarily communicates with parents, carers and responsible adults.
Our website is not intended for children to submit personal information independently.
Where we process children’s information, we will:
- Respect their privacy and individual data protection rights.
- Collect only information necessary for the agreed purpose.
- Consider parental responsibility and appropriate authority.
- Restrict access to confidential information.
- Share information only where authorised or otherwise lawful.
- Provide age-appropriate privacy information where appropriate.
We recognise that children’s personal information requires particular care.
8. Confidentiality and Information Sharing
We treat information provided to Oak Path Education Ltd as confidential.
Where necessary and lawful, information may be shared with:
- Educational psychologists and specialist assessors.
- Speech and language therapists and occupational therapists.
- Schools and educational settings involved in a child’s support.
- Professional advisers, accountants, insurers and legal representatives.
- Technology providers supporting our website, email and document storage.
- Safeguarding authorities, regulators and statutory bodies where necessary.
We will ordinarily obtain and record appropriate authorisation before sharing confidential educational or specialist reports with external professionals.
We will explain the purpose of the disclosure and limit information sharing to what is necessary.
Confidentiality is not absolute. Information may be disclosed without consent where required or permitted by law, including in appropriate safeguarding circumstances.
We do not sell personal information.
9. Safeguarding
The safety and welfare of children and young people are important considerations in our work.
Where information raises concerns that a child may be at risk of harm, Oak Path Education Ltd may need to record the concern, seek appropriate professional advice or share relevant information with safeguarding authorities.
Such decisions will be made in accordance with applicable law and the principles of necessity and proportionality.
Our separate Safeguarding and Child Protection Policy sets out our operational safeguarding procedures.
10. Website Hosting, Data Storage and Security
Our website is built using WordPress and hosted by IONOS.
When a visitor submits an enquiry, the information provided is:
- Stored in the website’s database hosted by IONOS.
- Accessible to authorised website administrators.
- Sent by email to oakpathteam@gmail.com.
- Used to generate an automatic confirmation email to the person making the enquiry.
Newsletter signup details are also stored in the website database and emailed to our business Gmail account.
Oak Path Education Ltd currently uses a dedicated Google account and Google Drive for business document storage.
At the effective date of this notice, identifiable client assessment reports are not stored in that Google Drive account.
We take appropriate steps to protect personal information, including restricting access, limiting unnecessary collection and sharing, and reviewing security arrangements.
Before using cloud storage for confidential client reports, we will assess and implement appropriate contractual, technical and organisational safeguards.
We ask visitors not to include medical diagnoses, detailed health information or confidential assessment reports in initial website enquiries.
No electronic communication or storage method can be guaranteed to be entirely secure.
11. International Data Transfers
Some technology providers used by Oak Path Education Ltd may process or access personal information outside the United Kingdom.
Our website currently uses Google Fonts, which means a visitor’s browser may connect to Google’s servers and disclose technical information, including their IP address, when loading fonts.
Our business email and document storage use Google services, which may involve international processing or access.
Where restricted international transfers take place, we will identify and apply the safeguards required by UK data protection law.
These may include UK adequacy regulations, approved contractual safeguards or other legally recognised transfer mechanisms.
We will review relevant service-provider arrangements before processing sensitive client information through those services.
Further information may be requested using our contact email.
12. How Long We Keep Information
We retain personal information only for as long as necessary for the purpose for which it was collected, taking account of legal obligations, safeguarding considerations and potential legal claims.
Our retention schedule is:
Type of information
Retention period
Enquiries that do not become clients
12 months after the last contact
Routine adult client consultation records
6 years after the service ends
Children’s educational and consultation records
Normally 6 years after the child reaches 18, subject to case-specific review
Financial and accounting records
Generally 6 years from the end of the relevant company financial year, or longer where legally required
Safeguarding records
Determined individually according to the nature of the concern and applicable legal, safeguarding and insurance requirements
Newsletter subscription information
While subscribed, with limited records retained where necessary to honour unsubscribe requests
Website enquiry records will be reviewed and deleted when the applicable retention period expires, unless a lawful reason requires longer retention.
Information will be securely deleted or anonymised when there is no longer a lawful reason to retain it.
13. Website Cookies and Third-Party Services
Our website does not currently use advertising, analytics or visitor-tracking cookies.
WordPress may use cookies for logged-in website administrators. These are not used to track ordinary website visitors.
We do not currently use Google Analytics, Facebook Pixel, reCAPTCHA or third-party embedded maps, videos or social media feeds.
The website currently uses Google Fonts to display its typography. This involves the visitor’s browser connecting to Google’s servers to retrieve font files, which may disclose the visitor’s IP address and associated technical information.
The website’s enquiry form uses a hidden field to reduce spam without third-party tracking.
If we introduce additional cookies, analytics or other tracking technologies, we will update our privacy information and implement any consent controls required by law before activating them.
14. Newsletter and Marketing Communications
Visitors can express an interest in receiving Oak Path newsletters and educational updates through our website’s enquiry form or footer signup.
Subscription details are currently stored in our website database and sent to our business Gmail account.
At the effective date of this notice, we do not use a separate mailing-list platform and have not commenced newsletter marketing.
Where consent is required, individuals will be given a clear, separate choice to subscribe.
When marketing communications commence, subscribers will be provided with an appropriate unsubscribe mechanism.
We will not use children’s confidential educational, health or safeguarding information for marketing purposes.
15. Your Data Protection Rights
Depending on the circumstances, individuals have rights under UK GDPR, including:
- The right to be informed about how personal information is used.
- The right to request access to personal information.
- The right to request correction of inaccurate information.
- The right to request erasure where applicable.
- The right to request restriction of processing.
- The right to object to certain processing.
- The right to data portability where applicable.
- The right to withdraw consent where processing relies on consent.
- Rights relating to certain solely automated decisions.
These rights are subject to applicable legal conditions and exemptions.
Requests involving children’s information will be considered in accordance with the child’s rights, capacity and relevant parental responsibility arrangements.
To exercise your rights, please contact us using the email address below.
16. Complaints and Contact
If you have questions or concerns about how Oak Path Education Ltd handles personal information, please contact:
Director
Oak Path Education Ltd
Email: oakpathteam@gmail.com
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
Website: https://ico.org.uk
We welcome the opportunity to address concerns directly, but you are not required to contact us before approaching the ICO.
17. Changes to This Privacy Notice
We will review this Privacy Notice at least annually and whenever significant changes occur to our services, technology providers, information-handling practices or legal obligations.
The current version will be available on our website.
OAK PATH EDUCATION LTD | Company No. 17208884 | Effective date: 5 November 2026 | Next review date: 5 November 2027