01244 261 379 enquiries@e2e-education.co.uk Portal login
E2E Education Data Protection Services

Privacy Notice

Last updated 19 August 2026 · Version 1.0

1. Aim

We aim to ensure that all Personal and Special Category Data that is provided to us is stored and processed in accordance with the 2018 UK Data Protection Act with GDPR (DPA).

This applies to all data, regardless of whether it is in paper or electronic format.

2. Legislation and guidance

This Data Privacy Notice meets the requirements of the DPA, and is based on guidance published by the Information Commissioner's Office.

UK data protection law consists primarily of:

  • The General Data Protection Regulations (UK GDPR);
  • The Data Protection Act 2018 (DP Act 2018);
  • The Data (Use and Access) Act 2025 (DUA Act 2025); and
  • The Privacy and Electronic Communications (EC Directive) Regulations (PECR) 2003

3. Roles and responsibilities

The Directors have overall responsibility for ensuring that we comply with its obligations. Day-to-day responsibilities rest with our Data Protection Officer and they ensure that all staff are aware of their data protection obligations, and oversee any queries related to the storing or processing of personal data.

4. Definitions

Personal data — Data from which a person can be identified, including data that, when combined with other readily available information, leads to a person being identified.

Special Category Data — Data such as:

  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs, or beliefs of a similar nature
  • Where a person is a member of a trade union
  • Sex life
  • Sexual orientation
  • Genetic data
  • Biometric data
  • Whether a person has committed, or is alleged to have committed, an offence
  • Physical and mental health

This does not include personal data about criminal allegations, proceedings or convictions, as separate rules apply.

Processing — Obtaining, recording or holding data.

Data subject — The person whose personal data is held or processed.

Data Controller — A person or organisation that determines the purposes for which, and the manner in which, personal data is processed.

Data Processor — A person, other than an employee of the Data Controller, who processes the data on behalf of the Data Controller.

5. Data protection principles

  • Processed lawfully, fairly and in a transparent manner
  • Collected for specified, explicit and legitimate purposes ('purpose limitation')
  • Adequate, relevant and limited to what is necessary
  • Accurate and, where necessary, kept up to date
  • Kept in a form which permits identification of data subjects for no longer than is necessary
  • Processed in a manner that ensures appropriate security of the personal data

6. Your rights

  • Your right of access — you have the right to ask us for copies of your personal information
  • Your right to rectification — you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete
  • Your right to erasure — you have the right to ask us to erase your personal information in certain circumstances
  • Your right to restriction of processing — you have the right to ask us to restrict the processing of your personal information in certain circumstances
  • Your right to object to processing — you have the right to object to the processing of your personal information in certain circumstances
  • Your right to data portability — you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at dpo@e2e-education.co.uk if you wish to make a request.

7. Privacy and fair processing

We hold Personal Data about our clients and our third-party strategic partners so that we can deliver our products and services. We may, from time to time, access our clients systems as part of our services. Our access for providing technical support does not involve the processing of data, but we may have visibility of end user information e.g. first and last name, driving license.

If you have sent us your details to facilitate booking a demo, for example, we will only use your data for the purpose it was given and delete your information no later than 12 months from the date of contact. The information provided will, typically, be name, email and phone number.

The lawful basis for the processing is contractual (clients) and legitimate interest (enquiries).

8. Use of consultants and third-party processors

We may engage consultants or third-party service providers ("Processors") to carry out specific data processing activities on its behalf. Such parties shall:

  • Process personal data only on documented instructions from us
  • Be bound by written contractual terms ensuring confidentiality and compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
  • Implement appropriate technical and organisational measures to safeguard the data against unauthorised or unlawful processing and against accidental loss, destruction, or damage
  • Permit us to conduct or request audits, inspections, or evidence of compliance where appropriate; and
  • Immediately inform us if any instruction appears to infringe applicable data protection legislation

We will ensure that only processors providing sufficient guarantees to meet the requirements of UK data protection law are appointed to process data on its behalf.

9. Data storage and security

Paper based records, digital records and portable electronic devices, such as laptops and hard drives that contain personal information all comply to the DPA and are regularly assessed by our DPO. Destruction and archiving of Personal Data procedures are also aligned to the DPA.

10. How to make a complaint

From 19 June 2026 organisations must have a process to handle and respond to complaints if someone considers that we have infringed data protection legislation.

If you feel that we have mishandled your or your Personal and/or Special Category data at any time, in the first instance, please contact our DPO by emailing dpo@e2e-education.co.uk.

You can contact the Information Commissioner's Office by visiting their website (ico.org.uk/make-a-complaint) or by calling their helpline on telephone: 0303 123 1113. Please note that the ICO expects an individual to address any complaints with us before contacting them.