Privacy

How we look after your information.

This notice explains what personal information KCL Skills & Assessment Centre collects, why we use it, the lawful bases we rely on, and the rights you have under UK data protection law.

Effective date

14 July 2026

Who we are

KCL Skills & Assessment Centre ("KCL", "we", "us") is a specialist neurodiverse assessment and therapeutic progression centre based at The Denham Site, Denham, Buckinghamshire, United Kingdom. For the personal information described in this notice, KCL is the "data controller".

We are committed to protecting your privacy and handling personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Questions about this notice, or about how we use your information, can be sent to our Data Protection lead at info@kclearning.org or by phone on 01895 722 304.

The information we collect

We collect only the information we need to respond to enquiries, plan and deliver provision, and meet our legal and safeguarding obligations. Depending on your relationship with us, this may include:

Contact details for parents, carers, and professionals — name, email address, phone number, and postal address where relevant.
Learner details — name, age, key stage, school or setting, and a description of need where you choose to share it.
Special category data — information about a young person's health, disability, diagnosis, SEN status, EHCP content, and therapeutic or safeguarding needs. This is sensitive information and we treat it with additional care.
Placement and provision records — assessments, progress notes, correspondence, and records created while we work together.
Booking and enquiry data — the content of forms you submit and messages you send us.
Technical data — for staff using our secure tracker area, a session cookie and basic sign-in information. Ordinary visitors to this website are not tracked.

How we collect it

Most information comes directly from you — when you contact us, complete an enquiry or booking form, or work alongside us. We may also receive information from schools, local authorities, health and social care professionals, and other agencies involved in a young person's care, where they have a lawful basis to share it with us.

Why we use it and our lawful bases

Under the UK GDPR we must have a lawful basis for each way we use personal information. We rely on the following:

To respond to enquiries and provide the information you ask for — our legitimate interests in answering the people who contact us.
To plan, deliver, and review provision, assessments, and placements — performance of our agreement with you, and our legitimate interests in running the centre.
To meet safeguarding, statutory, and quality-assurance duties — compliance with our legal obligations.
To handle payments and Summer Academy bookings — performance of a contract and compliance with our legal obligations.
Where we ask for it, for optional communications — your consent, which you can withdraw at any time.

Special category and children's data

Much of the information we hold relates to children and young people and includes special category data about health, disability, and SEN. We only process this data where we have both a lawful basis and an additional condition under Article 9 of the UK GDPR — most often because processing is necessary for reasons of substantial public interest (including safeguarding children and individuals at risk), for the provision of care and education, or with explicit consent.

We apply extra care to children's data: we keep it to the minimum needed, restrict who can see it, and make our privacy information as clear as we can for families.

Who we share it with

We do not sell your information, and we never share it with third parties for marketing. We only share information where it is necessary and lawful — for example with:

Schools, local authorities, and commissioners involved in a young person's placement or funding.
Health, social care, and other professionals supporting the young person, with an appropriate basis to share.
Safeguarding partners and statutory agencies, where we are required to act to protect a child or individual at risk.
Trusted service providers who process data on our behalf under contract (for example our secure payment provider and IT systems). They act only on our instructions.
Regulators, auditors, or advisers, and where we are required to do so by law.

Payments

Summer Academy and other payments are handled by our payment provider, Stripe, on their secure checkout. Card details are entered directly with Stripe and are never entered on, or stored by, this website. Stripe processes card data as an independent controller in line with its own privacy policy and the PCI-DSS security standard.

International transfers

We aim to keep personal information within the UK. Where a service provider processes data outside the UK, we make sure appropriate safeguards are in place — such as a UK adequacy decision or the International Data Transfer Agreement — so your information keeps the same level of protection.

How long we keep it

We keep personal information only for as long as we need it for the purposes above, or for as long as the law requires. Enquiry information that does not lead to a placement is normally deleted within a reasonable period. Records connected to provision, assessment, and safeguarding are retained in line with statutory guidance and our retention schedule, after which they are securely destroyed. We can provide details of specific retention periods on request.

How we keep it safe

We use appropriate technical and organisational measures to protect personal information against loss, misuse, and unauthorised access — including access controls, secure sign-in for staff systems, encryption in transit, and staff training within our safeguarding and quality-assurance framework.

Your rights

Under UK data protection law you have the right to:

Be informed about how we use your information — this notice.
Access the personal information we hold about you.
Ask us to correct information that is inaccurate or incomplete.
Ask us to erase information in certain circumstances.
Restrict or object to how we use your information in certain circumstances.
Data portability — receive certain information in a reusable format.
Withdraw consent at any time, where we rely on consent.
Rights relating to automated decision-making — note that we do not make decisions about you by automated means alone.

Making a request

To exercise any of these rights, contact us at info@kclearning.org. Requests are normally free, and we will respond within one month. We may need to confirm your identity, and where you are asking on behalf of a young person we may need to be satisfied that you have the authority to do so.

Cookies

This website uses only strictly necessary cookies — there are no analytics, advertising, or third-party tracking cookies. Full details are set out in our Cookie Policy at /cookies.

Complaints

We would always prefer to resolve any concern directly, so please contact us first at info@kclearning.org. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.

Changes to this notice

We may update this notice from time to time. When we do, we will change the effective date shown above. Please check back for the latest version.