Privacy Notice

Privacy Notice

Effective: September 2026 | Next review: September 2027.

At Teach Outdoors Ltd, we are committed to protecting personal data and respecting privacy. We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (DUAA), which amends the UK data protection framework.

This Privacy Notice explains what personal data we collect, where it comes from, why we use it, who we may share it with, how long we keep it, how we protect it and the rights people have in relation to their information.

This is our general organisational Privacy Notice. Additional or more specific privacy information may be provided where this is appropriate for a particular service, process or audience.

1. Who we are

Teach Outdoors Ltd is responsible for deciding how and why personal data is collected and used where we act as a data controller. In commissioned or partnership work, our legal role may vary depending on the arrangements with the school, local authority or other organisation.

For questions about this Privacy Notice or how Teach Outdoors handles personal data, contact:

Email: admin@teachoutdoors.co.uk

2. Who this Privacy Notice applies to

This notice applies, where relevant, to children and young people (CYP), parents/carers and family members, referrers and commissioners, school and local-authority contacts, training and consultancy clients, website users, staff, workers, volunteers, job applicants and other people who interact with Teach Outdoors.

3. Personal data we collect

The information we collect depends on the person, the service being provided and our relationship with them. We only collect information that is relevant and necessary for the purpose for which it is used.

For CYP and families, this may include:

• name, date of birth, address and contact details;
• parent/carer, emergency and next-of-kin contact details;
• referral, commissioning and professional contact information;
• education records, including EHCP information where relevant;
• SEND, disability, access and reasonable-adjustment information;
• health, medical, allergy and medication information;
• attendance, engagement, provision, learning and progress records;
• safeguarding, behaviour, incident, accident and first-aid information where appropriate;
• photographs, video or other media where there is a lawful reason to use it;
• communications, views, feedback and information provided by the CYP, family or professionals involved.

For staff, workers, volunteers and applicants, this may include contact and identity information, recruitment and employment records, references, right-to-work and DBS information where applicable, payroll/contractual information, training and qualification records, Single Central Record information where applicable, and health or adjustment information where necessary.

For commissioners, schools, training/consultancy clients and website users, this may include names, job titles, professional contact details, booking and transaction information, correspondence, feedback, website/technical information and information needed to manage contracts, training, events or enquiries.

Where relevant, we may also process special-category personal data and criminal-offence data. These types of information receive additional legal protection.

Purchases, bookings and payments

Where individuals purchase resources, courses, training or other services from Teach Outdoors, we may process information such as their name, contact details, billing address, purchase or booking history, invoice details, payment status and transaction reference information.

Payments may be processed by an approved third-party payment provider. Where this is the case, Teach Outdoors does not normally receive or store full payment-card details. Payment providers process payment information in accordance with their applicable contractual, security and data-protection arrangements.

We retain only the payment and transaction information reasonably required for accounting, tax, customer-service, contractual and legal purposes.

4. How we collect personal data

We may collect personal data directly when a person contacts us, makes an enquiry, completes a referral or other form, books training or an event, enters into a contract, attends or receives a service, provides feedback, communicates with us, or applies to work or volunteer with Teach Outdoors.

We may also receive personal data from other sources where this is lawful and necessary, including:

• parents/carers and family members;
• schools, local authorities, commissioners and caseworkers;
• health, social-care, SEND, safeguarding and other professionals;
• previous education or support providers;
• qualification, recruitment, DBS or safeguarding organisations;
• service providers and professional advisers;
• publicly available sources where appropriate.

Where we receive personal data from another organisation rather than directly from the individual, we will provide or make available the privacy information required by law unless an exemption applies.

5. Why we use personal data and our lawful bases

We only use personal data where we have a lawful basis. Depending on the purpose and circumstances, this may include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest where applicable, or our legitimate interests where these are not overridden by the individual’s rights and interests.

We may use personal data to:

• respond to enquiries, assess referrals and determine whether we can safely provide a service;
• plan, deliver, review and evidence AP/EOTAS, home/community, school-based and other CYP provision;
• support safeguarding, welfare, health, safety, reasonable adjustments and emergency response;
• record attendance, engagement, progress, behaviour, incidents and first aid where relevant;
• communicate with CYP, families, commissioners, schools and other professionals;
• manage training, consultancy, events, bookings, payments and contracts;
• recruit, employ, support and manage staff, workers and volunteers;
• maintain and secure our systems, records and services;
• meet legal, safeguarding, regulatory, insurance, accounting and contractual requirements;
• improve our services, quality assurance, training and organisational practice;
• send marketing communications where the law allows.

Where we process special-category data, we also identify an appropriate condition under Article 9 UK GDPR and the Data Protection Act 2018. Depending on the circumstances, this may include substantial public interest purposes such as safeguarding children and individuals at risk, employment/social-protection obligations, vital interests, or explicit consent where this is the appropriate condition. Criminal-offence data is processed only where the additional legal requirements are met.

Consent is not always required for lawful safeguarding information sharing and must not be allowed to delay necessary safeguarding action.

6. Who we may share personal data with

We only share personal data where there is a lawful and legitimate reason and only to the extent necessary for the purpose. Depending on the circumstances, recipients may include:

• parents/carers and the CYP, where appropriate;
• schools, local authorities, commissioners and named caseworkers;
• health, social-care, SEND, safeguarding and other professionals;
• emergency services, police, LADO/Designated Officer or safeguarding authorities where required;
• trainers, venues or delivery partners where information is necessary to provide a service;
• payment, payroll, accounting, insurance, legal and professional advisers;
• approved IT, cloud, communications, website and other service providers;
• regulators, government bodies or other authorities where required or permitted by law.

Where another organisation processes personal data on our behalf, appropriate contractual and security arrangements are required. We do not sell personal data.

7. Digital systems and artificial intelligence

Teach Outdoors uses approved digital systems to support provision, recording, communication, administration and organisational management. Systems processing personal data are subject to proportionate data-protection and security checks, with enhanced assessment for systems handling CYP, safeguarding, health, SEND or other sensitive information.

Approved artificial intelligence (AI) functionality may be used to support tasks such as summarising records, identifying themes and producing draft reports. AI-generated material is a starting point only. An appropriately skilled member of staff must carry out meaningful human review, check the output against the underlying information, correct inaccuracies, add professional context and approve the final version before it is relied upon, shared or submitted.

Teach Outdoors does not intend to use AI to make solely automated significant decisions about CYP, families or staff. AI will not independently make safeguarding decisions, determine suitability for provision, decide a CYP’s needs or support, or issue final professional reports without meaningful human involvement.

Personal or confidential Teach Outdoors information must only be processed through AI tools or AI-enabled systems that have been approved for that purpose. Further information about relevant processing will be provided where required.

8. International transfers

Some approved service providers or their sub-processors may process personal data outside the UK. Where this results in a restricted international transfer, Teach Outdoors will ensure that a lawful transfer mechanism is in place, such as UK adequacy regulations, appropriate safeguards or another lawful exception. Information about relevant safeguards can be requested from Teach Outdoors.

9. How long we keep personal data

We keep personal data only for as long as there is a lawful and operational need. Retention periods vary according to the type of record and may take account of safeguarding, education, employment, contractual, insurance, accounting and legal limitation requirements.

Teach Outdoors applies its approved retention schedule and record-retention arrangements. When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.

10. Keeping personal data secure

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure or destruction. Access is restricted to authorised people who have a legitimate need to use the information.

No method of transmitting or storing information can be guaranteed to be completely secure. Where a personal data breach occurs, Teach Outdoors will take appropriate steps to contain and assess it and will notify the Information Commissioner’s Office (ICO) and/or affected individuals where the law requires.

11. Marketing, website links and cookies

We may use contact details to provide information about Teach Outdoors services, events, courses and other relevant opportunities where the law allows. Where consent is required, we will ask for it. Marketing preferences can be changed at any time, and opting out of marketing does not affect service-related communications.

Our website may contain links to third-party websites or services. Those organisations are responsible for their own privacy practices.

Our website may use cookies and similar technologies. Where required by law, consent will be requested before non-essential cookies are placed on a device. Cookie preferences can be managed through the website settings where available.

12. Your data protection rights

Depending on the circumstances and the lawful basis being used, individuals may have rights including:

• the right to be informed about how personal data is used;
• the right to access personal data;
• the right to have inaccurate or incomplete information corrected;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability in certain circumstances;
• the right to withdraw consent where consent is the lawful basis;
• rights and safeguards relating to significant automated decision-making.
• Right to object: where the law provides a right to object to processing, including direct marketing, an individual can ask Teach Outdoors to stop that processing.

These rights are subject to legal conditions and exemptions and do not apply in the same way to every type of processing.

13. Subject Access Requests

A person may ask for a copy of personal data Teach Outdoors holds about them. This is known as a Subject Access Request (SAR). A SAR may be made verbally or in writing and does not need to use particular wording.

Requests can be made to admin@teachoutdoors.co.uk. We may ask for information reasonably needed to verify identity or clarify the request. We will respond without undue delay and normally within one month, subject to any lawful extension or permitted pause in the time limit.

Requests involving a child will be considered in light of the child’s competence, age, understanding and circumstances. A parent/carer does not automatically have an unrestricted right to access all information held about a child.

14. Children and young people

Children have the same data-protection rights as adults. Where Teach Outdoors works directly with CYP, privacy information will be explained in a way that is appropriate to the CYP’s age, communication needs, development and understanding. This notice may be supplemented by shorter, visual, verbal or other accessible explanations where appropriate.

Where appropriate, information will be addressed directly to the CYP as well as to parents/carers. We will not assume that information intended for adults is automatically understandable to a child.

15. Data protection complaints

If you are concerned about how Teach Outdoors has handled personal data, please contact us at admin@teachoutdoors.co.uk or use the Teach Outdoors Complaints Policy.

Teach Outdoors will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep the complainant appropriately informed and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator. Information about making a complaint is available at ico.org.uk.

16. Changes to this Privacy Notice

We may update this Privacy Notice to reflect changes in our services, systems, use of personal data, business practices or legal requirements. The current version will be made available through Teach Outdoors and significant new uses of personal data will be brought to people’s attention where required.

17. Contact us

For questions about this Privacy Notice, to exercise a data-protection right or to raise a data-protection complaint, contact:

Teach Outdoors Ltd
Email: admin@teachoutdoors.co.uk

18. Related documents and guidance

• Teach Outdoors GDPR and Data Protection Policy
• Teach Outdoors Confidentiality and Information Sharing Policy
• Teach Outdoors Safeguarding and Child Protection Policy
• Teach Outdoors Incident, Accident and Near-Miss Reporting and Record-Keeping Policy
• Teach Outdoors Complaints Policy
• UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025
• Information Commissioner’s Office guidance on privacy information, children’s data, AI and individual rights