Part B, for staff and volunteers, is on a separate page for staff: Data and Privacy Policy: staff and volunteers. Part C, for the leads, is on a separate restricted page: Data and Privacy Policy: leads' procedures.

---

Part A. Audience: Everyone

A1. About this policy

This policy is how The National Society for Education, Mentoring and Media (NSEMM) looks after personal information. NSEMM is charity number 1209673 and is registered with the Information Commissioner's Office (ICO) as ZC161181. The law we follow is listed in D1.

• What we collect, why, and who sees it is in our Privacy Notice.
• How long we keep each record is set only in the Data Retention Schedule, the Annex to this policy. No other policy, procedure or assessment sets a period.
• Read this policy with our Privacy Notice, Website Terms and Cookies, the Safeguarding Policy, the People Policy and the Families and Service Terms.

A2. Who to contact

We have not appointed a statutory Data Protection Officer, because the law does not require one for an organisation like ours. dpo@ is the data protection lead's mailbox. If the Chief Executive Officer has a conflict of interest in a data protection matter, the trustees decide it.

A3. How we look after information

What we keep

• We collect only what we need, for a clear reason. We keep it accurate and safe, and delete it when the Annex says.
• We do not sell personal information.

Our reasons

• The lawful basis for each use is in the Privacy Notice.
• Where we rely on legitimate interests, we keep a written assessment.
• Where we use special category information (such as health), we rely on explicit consent or, for safeguarding, the safeguarding condition in data protection law, with our Appropriate Policy Document.

Decisions about people

• No decision with a significant effect on a person is made by a system alone.
• A person confirms every Community Education Fund amount and makes every offer of a place. Rules, scores and safety checks only suggest or flag.
• You can always ask a person to look again. The Privacy Notice explains each rule.

Who we share with

• We use only the organisations named in the Privacy Notice, each under a written contract that meets data protection law. A new one is added to the Privacy Notice before we use it.
• Information goes outside the UK only where the UK has approved the country, or under the UK's approved international transfer agreement or addendum.
• Sharing information to protect a child follows the Safeguarding Policy, section A8.

Keeping it secure

• Personal information and backups are encrypted.
• Staff see only what their role needs, and we check this regularly. Money and safeguarding information is limited to the people who need it.

A4. Lesson recordings

We record every online lesson. Why we record, who can watch a recording and when one is kept longer are in the Safeguarding Policy, section A10. How long recordings are kept is in Annex row F7.

A5. Help with the cost (Community Education Fund)

How long we keep what you send when you ask for help with the cost is in Annex rows C1 to C9. In short, we delete the documents you upload once the decision and any review are done, and keep your answers with the decision.

A6. Website visit statistics and cookies

• We count visits to our websites with a visit counter that runs on our own server.
• It sets no cookies, saves nothing on your device and does not identify you.
• You can switch it off on our Cookie Settings page.
• How long we keep the visit records is in Annex row O2.
• Which cookies our websites set is in our Website Terms and Cookies.

A7. AI

NSEMM uses one outside AI provider, Anthropic, for three things:

• suggesting categories for bank transactions in our accounts. A transaction description can include the name of the person who paid, and we send it as it is;
• tagging teaching resources. No personal information is used;
• Insight summaries and draft grant answers, which may use only anonymised information. The system refuses to send anything that has not been anonymised.

Anthropic may not use our data to train its models. NSEMM Protect never uses AI, and safeguarding information is never sent to any AI. We review this every year.

A8. Your rights and how long we take

• The rights you have are listed in the Privacy Notice.
• We reply within one calendar month of receiving your request, free of charge, unless a request is manifestly unfounded or excessive.
• If a request is complex, we can take up to two more months. We tell you within the first month.
• If we need to check who you are or what you are asking for, the month starts when you reply.
• We withhold information only where the law allows it (for example to protect a child or another person), and we explain any refusal.

A9. Marketing

We send newsletters and fundraising messages only with consent. Every message has an unsubscribe link. If you ask the data protection lead (A2) to stop, we act on it within 5 working days.

A10. Complaints

Send data protection complaints to the data protection lead (A2). We acknowledge your complaint, look into it, and reply within 4 weeks. You can also complain to the ICO (A2). Other complaints follow the Families and Service Terms, section 9.

---

Part D. Audience: Everyone (reference)

D1. Law and guidance

• UK General Data Protection Regulation and the Data Protection Act 2018, both as amended by the Data (Use and Access) Act 2025. In particular:
  • Article 6(1)(a), (c), (d) and (f) (consent, legal obligation, vital interests, legitimate interests);
  • Article 9(2)(a) and (g) (explicit consent; substantial public interest);
  • Article 22 (decisions made only by a system);
  • Article 28 (contracts with the organisations that handle information for us);
  • Data Protection Act 2018, Schedule 1, Part 2, paragraph 18 (safeguarding of children and of individuals at risk);
  • Data Protection Act 2018, Schedule 2, Part 1, paragraph 2 (crime and taxation).
• UK adequacy regulations, the UK International Data Transfer Agreement and the UK Addendum.
• Privacy and Electronic Communications Regulations, including Schedule A1 (visit statistics without consent, with notice and a way to say no).
• The ICO's guidance on subject access, personal data breaches and children's information.

---

Annex. Data Retention Schedule (Audience: Everyone)

This is the one place where NSEMM sets how long it keeps each kind of record. Financial years are as in the Money Policy, section A1. Holds and disposal are in C5.

Families, pupils and lessons

Any recording, transcript, message or ticket linked to a safeguarding concern is kept under S1 instead.

A family leaves when their last pairing ends and they have no open application. The time counts from the latest of the last pairing ending, the last application closing and the last lesson.

Help with the cost (Community Education Fund)

Calls, emails and texts

Safeguarding

For confirmed child sexual abuse records we also consider, case by case, the Independent Inquiry into Child Sexual Abuse recommendation of 75 years.

Tutors, staff, volunteers and applicants

Money, donations and governance

Other records