POLICY OWNER
Data Protection Lead
APPLIES TO
Everyone who handles personal data for the centre
THE ONE RULE TO REMEMBER
Only the minimum data, only to people who need it, deleted when no longer needed.
1. Rules
1. JMS Publishers and Providers Ltd is the data controller and pays the annual data protection fee to the
ICO.
2. Parents receive a clear privacy notice at enrolment explaining what we hold, why, and for how long.
3. We collect only what we need: contact details, emergency contacts, school year, test results, and any
needs or medical information the parent shares.
4. Registers, test scores and records in Google Sheets are shared only with staff who need them; access is
removed the day someone leaves.
5. Photos, videos, testimonials and results used in marketing need separate, written, opt-in consent, which
can be withdrawn at any time.
6. Marketing emails and messages go only to parents who have opted in.
7. Safeguarding records are kept separately by the DSL.
8. Records are deleted in line with the retention schedule.
9. Personal data is never entered into a public AI tool (Policy 14).
10. Children should not submit personal information to us through our website; parents and guardians
provide it on their behalf.
11. Where our Terms and Conditions and this policy differ on personal data, this policy applies.
2. Requests from individuals
A parent, student or staff member may ask for a copy of their data (a subject access request), for corrections, or for deletion. Requests go to the Data Protection Lead (info@pass11plusgrammar.com) and are answered within one month (extendable by two months for complex requests). Before sharing a child's data we confirm the requester's identity and parental responsibility.
3. Data processing procedures
The table below sets out the main personal data we process, why, the lawful basis under UK GDPR, and how long we keep it. Records are securely deleted or anonymised at the end of each period.
DATA & TECHNOLOGY
Data Protection Policy and Data Processing Procedures Collecting only what we need, keeping it secure, and respecting every family's rights.
Pass 11 Plus Grammar · Policy 12 JMS Publishers and Providers Ltd · Edgbaston, Birmingham Version 1.1 · October 2026 · Page 1 of 3 Data Why we use it Lawful basis Kept for Parent and child contact details, emergency contacts, programme Enrolment, teaching, communication Contract (parent); legitimate interests (student) While enrolled + 1 year Registers, homework, test and mock results Tracking progress and attendance Contract; legitimate interests While enrolled + 1 year Invoices and payment records Fees and accounts Contract; legal obligation 6 years Health, allergy and additional-needs information Keeping children safe;
reasonable adjustments Legitimate interests and vital interests; Art 9(2)(c) and DPA 2018 Sch 1 para 18 (safeguarding) While enrolled Accident records Health and safety Legal obligation Until the child is 21 Safeguarding records Protecting children Substantial public interest (safeguarding) Until the child is CCTV images Safety and security (Policy 4) Legitimate interests Up to 30 days Photos, testimonials, published results Marketing Consent Until consent is withdrawn Staff and specialist DBS details Safer recruitment Legal obligation; employment Duration of engagement + 6 years Who we share with: only trusted service providers acting on our instructions under contract (for example video-conferencing, cloud storage and payment providers), and authorities where the law or safeguarding requires it. We never sell personal data.
Transfers outside the UK: where a provider stores data abroad, we make sure UK-approved safeguards are in place.
Security: password-protected devices and accounts, access limited by role, locked storage for paper records, and staff training.
New systems: any new system or use of personal data is assessed for risk before it starts.
Pass 11 Plus Grammar · Policy 12 JMS Publishers and Providers Ltd · Edgbaston, Birmingham Version 1.1 · October 2026 · Page 2 of 3
4. Data breaches
Data lost, sent to the wrong person, or accessed without permission Tell the Data Protection Lead immediately Contain it: recall the email, change passwords, retrieve papers YES Report to the ICO within 72 hours; tell affected families if high risk NO Record in the breach log with lessons learned Figure 14 — Data breach response.
5. Complaints
Data protection complaints follow the stages and timescales in our Complaints Policy (Policy 18):
acknowledged within 5 working days and answered within 15. Anyone unhappy with our response can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
?
Is there a risk to anyone's rights?
Pass 11 Plus Grammar · Policy 12 JMS Publishers and Providers Ltd · Edgbaston, Birmingham Version 1.1 · October 2026 · Page 3 of 3