Privacy Notice

• Controller: Daffodil Preparatory School Ltd (company no. 12449182), proprietor of Daffodil Preparatory School, 161-163 Commercial Road, London E1 2DA.
• Contact for data matters: info@daffodilprepschool.org.uk · 020 4539 9737. [DPO/privacy lead designation: DPO to confirm whether a formal DPO is required/appointed.]
• Scope: this website, its forms, and the admissions/enquiry records they create. Pupil/parent data held once a child is enrolled is covered by the school's fuller privacy documentation [DPO to confirm structure].

2. What we collect, and why, per form

• Enquiry form: parent name; phone or email; child's year group; intended start; message. Purpose: answering your enquiry and managing it in our admissions pipeline. Note: data minimised at enquiry stage (year group only, no child date of birth).
• Book a Visit form: as enquiry, plus preferred visit slot and number of adults attending. Purpose: arranging and confirming your visit.
• Application form: applicant (child) details including SEN/EHCP and health information; parents/carers; emergency contact; current school; year group; fee preference; start term; uploaded documents (passport, birth certificate, proof of address); four declarations including GDPR consent. Purpose: processing an application for a school place. Note: includes special category data (health/SEN); lawful condition to be settled by DPO.
• Careers application: name; contact details; CV; right-to-work confirmation; safeguarding declaration. Purpose: recruitment and safer-recruitment compliance. See careers.
• Newsletter signup: email address, explicit opt-in (double opt-in). Purpose: sending the newsletter.
• Automatically captured with form submissions: source/UTM parameters, first landing page, referrer. Purpose: understanding how families find the school.

3. Lawful bases (mapping for DPO to confirm)

• Consent: newsletter; optional marketing; cookies (see the cookies page).
• Steps prior to a contract / contract: enquiries, visit bookings, applications, fee administration.
• Legal obligation: safeguarding, safer recruitment, statutory education requirements.
• Legitimate interests: website analytics (with consent mode), pipeline administration, security logs. [Balancing tests: DPO.]
• Special category data (health/SEN in applications; safeguarding records): condition(s) under UK GDPR Art. 9 [DPO to confirm; e.g. substantial public interest/safeguarding of children, explicit consent where applicable].

4. Who processes data on our behalf

Generic processor categories (named suppliers + locations to be listed by DPO at publish):

• Website hosting and database provider.
• Secure file storage for uploaded documents (private, encrypted storage).
• Transactional email provider (form acknowledgements, visit confirmations).
• Analytics provider (consent-based; see the cookies page).
• No sale of personal data; no sharing with third parties for their own marketing.
• Statutory disclosures where required (e.g. Department for Education, local authority, safeguarding partners) [DPO to confirm list].

5. How long we keep data (defaults; DPO to confirm all)

• Enquiry/pipeline records where the family does not proceed: anonymised after 12 months (default; DPO to confirm).
• Unsuccessful careers applicants: deleted after 6 months (default; DPO to confirm), with an audit record of the recruitment decision retained per safer-recruitment guidance.
• Application records and enrolled-pupil data: per the school's retention schedule [DPO to define].
• Newsletter data: until you unsubscribe.
• System audit logs: 12 months.

6. Your rights

Access; rectification; erasure; restriction; objection; portability; withdrawal of consent at any time (where consent is the basis). How to exercise them: contact details in §1; response within statutory timescales.

7. Complaints: the ICO

You have the right to complain to the Information Commissioner's Office: ico.org.uk · ICO helpline 0303 123 1113. We ask, but do not require, that you raise the issue with us first.

8. Children's data

• The website's forms are designed for completion by parents and carers, not children.
• We collect the minimum about a child at each stage: year group only at enquiry; fuller details (including date of birth and documents) only at application, where they are required to process a place.
• Special category data about children (health, SEN) is collected only in the application and handled under §3's conditions.

9. Security (summary)

Encrypted storage for uploaded documents in private storage; server-side validation; access restricted by role and audit-logged; regular encrypted backups. [Final wording: DPO/technical lead.]

10. Cookies

See the separate cookies page for what we set and how consent works.

11. Changes to this notice

Version and last-reviewed date displayed on page; material changes flagged on the page itself. Related school policies live in the policy library.

Questions about your data? Email info@daffodilprepschool.org.uk or call 020 4539 9737. We reply within 24 hours. You can also use the contact page.