1  About this privacy policy

This privacy policy explains how I collect, use, store and share personal information when you visit the SwitchedON! website, make an enquiry, book a call, join my mailing list, or use my education consultancy, tuition, coaching or related services.

I work with parents and carers, children and young people, adult students, prospective clients, former clients, professional contacts and other people involved in a child’s education. Because my work often involves children and family circumstances, I take particular care with confidentiality and sensitive information.

This policy should be read together with my Cookie Policy and any privacy information or consent wording supplied on a particular form, agreement or booking page.

2  Who is responsible for your information

Clare Ford is a sole trader trading as Beautiful Souls and SwitchedON!. SwitchedON! is the education consultancy, tuition and coaching arm of the business. I am the data controller, which means I decide why and how personal information is used.

Business address: 21 North Street, Biddenden, Ashford, Kent TN27 8AG

Email: [email protected]

Website: https://switchedonglobal.com

For any privacy enquiry, request or complaint, please contact Clare Ford using the email address above.

3  Whose information I may collect

• parents, carers and other family members;

• children and young people receiving, or being considered for, services;

• adult students and clients;

• people making enquiries, booking calls or joining the mailing list;

• school staff, tutors, educational professionals, guardians and other authorised contacts; and

• website visitors and people who interact with SwitchedON! through social media or messaging services.

4  The information I may collect

4.1 Information about parents, carers and other adult contacts

• name, address, email address, telephone number and country of residence;

• family relationships and parental responsibility or authority to act for a child;

• enquiry, consultation, questionnaire, application and booking information;

• communication history, preferences, meeting notes and agreed actions;

• contract, invoice, payment and transaction information; and

• feedback, reviews, photographs or testimonials where these are provided.

4.2 Information about children and young people

• name, age, date of birth, contact details and country of residence;

• current and previous schools, year group, curriculum and educational history;

• academic attainment, assessment results, school reports, work samples, interests, strengths, aspirations and support needs;

• information about applications, admissions, interviews, examinations, school choices and educational plans;

• information provided during tuition, coaching or consultation sessions;

• family circumstances and information relevant to educational recommendations; and

• health, disability, neurodiversity, emotional wellbeing, ethnicity, religion or other sensitive information where it is relevant and appropriate to the service.

4.3 Website and technical information

• IP address, device, browser, approximate location and website usage information;

• cookie identifiers, page views, video viewing, form submissions and advertising interactions; and

• information provided through chat, social media, email, SMS or WhatsApp.

• I do not normally receive full card or bank details. Payments are processed by payment providers such as Stripe or PayPal, although I receive transaction and payment-status information needed to manage the service and my accounts.

5  How I receive personal information

I may receive information directly from you or your child, including through forms, questionnaires, contracts, emails, messages, calls, meetings, tuition and coaching sessions.

A parent or carer will often provide information about a child. I may also receive information, with appropriate authority or where otherwise lawful, from schools, educational professionals, guardians, family members, referrers or publicly available sources. Website, analytics and advertising technologies may collect limited technical information automatically, subject to applicable cookie choices.

6  How and why I use personal information

Enquiries and bookings

To respond to enquiries, assess whether my services may be suitable, arrange calls and provide requested information.

Service delivery

To understand the child and family, provide consultancy, research, tuition or coaching, prepare reports and recommendations, monitor progress and communicate about the service.

Client administration

To manage contracts, consent, appointments, attendance, communications, payments, invoices and records.

Safety and safeguarding

To support welfare, respond to concerns and share information where necessary and lawful to protect a person from harm.

Quality and development

To review services, handle feedback or complaints and improve resources, systems and client experience.

Marketing

To send requested resources and, where permitted, news, insights and information about relevant services; to measure campaigns and advertising.

Legal and business needs

To meet tax, accounting, insurance and legal obligations; establish or defend legal claims; prevent misuse and maintain system security.

7  Lawful bases for using personal information

UK data-protection law requires a lawful basis for each use of personal information. Depending on the circumstances, I rely on one or more of the following:

• Contract: the use is necessary to take steps at your request before entering into an agreement or to provide the agreed service.

• Legitimate interests: the use is reasonably necessary to operate and improve my business, respond to enquiries, maintain appropriate records, protect my rights and provide a professional service, provided those interests are not overridden by the individual’s rights and interests.

• Consent: you have made a clear choice, for example for optional marketing, recording a meeting or a particular use of sensitive information. Consent can be withdrawn at any time, although this does not make earlier use unlawful.

• Legal obligation: the use is necessary to comply with a legal requirement, including tax, accounting or safeguarding obligations where applicable.

• Vital interests: in exceptional circumstances, the use is necessary to protect someone’s life or physical safety.

• I do not rely on consent where another lawful basis is more appropriate. Withdrawing marketing consent does not prevent me from sending essential messages about a booking or an active service.

8  Sensitive and special category information

My work may involve information about health, disability, neurodiversity, emotional wellbeing, ethnicity, religion or other matters that receive additional legal protection. I only request or use this information where it is relevant to the child’s needs, educational planning, accessibility, wellbeing or safe delivery of the service.

In addition to a lawful basis described above, I will identify an appropriate condition for using special category information. This will commonly be explicit consent. In exceptional safeguarding or emergency circumstances, another condition permitted by law may apply. I will not use sensitive information to target a child or family with advertising.

9  Children and young people

Parents or carers normally make the initial enquiry and enter into the service agreement. Children and young people may nevertheless communicate directly with me during tuition, coaching, consultation or other agreed sessions. Their personal information and privacy rights belong to them, although a parent or carer may exercise rights on their behalf where appropriate.

I aim to explain relevant privacy information in language suited to the child’s age and understanding. I collect only information reasonably needed for the service and take account of the child’s best interests when deciding how it should be used or shared.

Parents and carers providing information about a child confirm that they have appropriate authority to do so. Where necessary, I may verify parental responsibility or request additional consent.

10  Confidentiality and safeguarding

Information shared during my work is treated confidentially. Confidentiality is not absolute. I may use or share relevant information where required by law or where I reasonably believe this is necessary and proportionate to protect a child or another person from serious harm, respond to a safeguarding concern, obtain professional advice, or establish or defend a legal claim.

Where it is safe and appropriate, I will explain the proposed disclosure before it is made. I will share only the information reasonably necessary with an appropriate person or organisation, such as a parent or carer, school safeguarding lead, local authority, emergency service or professional adviser.

11  Communication with schools and other professionals

I will normally obtain written authority before contacting a school, admissions team, guardian, tutor, educational professional or other third party on a family’s behalf, or before sending them identifiable family information. The family is responsible for ensuring that information supplied to me is accurate and that they have authority to share information concerning other people.

I may research schools and educational options using public sources without identifying the family to the school. I will not disclose a child’s identity merely to conduct general research.

12  Calls, recordings and transcripts

Some online meetings may be recorded or transcribed using Zoom, Read.ai or a similar service. I will inform participants and seek permission before recording or transcription begins. Recording is optional unless I explain in advance why it is necessary; participants may ask for it to be stopped.

Recordings and transcripts may be used to prepare accurate notes, reports, recommendations and agreed actions. Audio and video recordings and AI-generated transcripts are normally retained for no longer than 12 months from the meeting or session and may be deleted sooner once they have been reviewed and any necessary professional record has been prepared. They may be retained for longer where reasonably necessary for a safeguarding concern, legal requirement, complaint or dispute.

13  Use of artificial intelligence

I may use carefully selected artificial-intelligence tools, including ChatGPT, to assist with tasks such as organising information, summarising material, generating working drafts, identifying points for further research and preparing the structure of reports or resources.

I remain responsible for the service. I review AI-assisted output and make the professional judgements and recommendations. I do not use AI to make solely automated decisions that produce legal or similarly significant effects for a child or family.

I minimise the personal information supplied to AI systems and remove or replace direct identifiers where reasonably practicable. My ChatGPT account is configured so that new conversations are not used to improve OpenAI’s models.

Particularly sensitive information will only be used where there is a clear purpose and an appropriate lawful basis and special category condition.

AI services can produce inaccurate or incomplete output. I therefore check material before relying on it and do not treat AI output as a substitute for my own professional assessment or for advice from a regulated specialist where that is required.

14  Marketing communications

I may send educational resources, news and information about relevant services by email, SMS or other electronic message where you have requested this, given consent, or where the law permits contact with an existing customer about similar services. Marketing choices are separate from communications needed to answer an enquiry, manage an appointment or provide an agreed service.

You can opt out at any time by using the unsubscribe link in an email, replying STOP where that facility is provided, or emailing [email protected]. I may retain a minimal suppression record so that your preference continues to be respected.

I do not knowingly send direct marketing to children without an appropriate lawful basis and suitable safeguards.

15  Website, cookies, analytics and advertising

The website and connected pages are operated through GoHighLevel. Cookies and similar technologies may support essential functions, remember choices, measure website use, display embedded content and help assess advertising performance.

Non-essential analytics and advertising technologies, including Google Analytics and Meta Pixel where enabled, should operate in accordance with the choices presented through the website’s cookie controls. Meta may receive information about visits or actions on the website and may use that information under its own privacy terms.

Embedded services, such as YouTube videos or social-media features, may collect information when loaded or used. Please see the Cookie Policy for fuller details and available choices.

16  Service providers and other recipients

I use trusted service providers to run the business and deliver services. Depending on how you interact with SwitchedON!, these may include:

• GoHighLevel for website pages, forms, customer relationship management, calendars, email, SMS and communications;

• Jotform for agreements and electronic signatures;

• Google Workspace, including Gmail, Drive and Docs and Classroom for communications, documents and storage;

• Zoom and Read.ai for online meetings, recordings, transcription and meeting notes where enabled;

• OpenAI and ChatGPT for limited AI-assisted processing described above;

• Stripe for payment processing;

• Xero for bookkeeping and accounting;

• WhatsApp for agreed communications;

• Meta platforms for social media, advertising and campaign measurement;

• website hosting, security, analytics and technical-support providers; and

• professional advisers, insurers, accountants, regulators, courts, law-enforcement or safeguarding bodies where disclosure is necessary and lawful.

Manychat may be added to support automated social-media messaging. If it is introduced, the relevant privacy and consent information will be updated and presented before or when information is collected through that service.

Service providers are permitted to process personal information only for authorised purposes and subject to their contractual and legal responsibilities. Some providers also act as independent controllers for aspects of their service, such as payment processing or use of a social-media account.

I do not sell personal information.

17  International transfers

Some service providers process or store information outside the United Kingdom, including in the United States and other countries. Where UK data-protection law treats this as a restricted transfer, I take reasonable steps to ensure that an appropriate transfer mechanism is used. This may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, the UK International Data Transfer Agreement, or the UK Addendum to approved contractual clauses, together with any required assessment.

You may contact me for further information about the safeguards relevant to your information.

18  How long information is kept

I keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, including delivery of services, safeguarding, professional accountability, tax, insurance and legal requirements. Typical periods are:

• general enquiries that do not become clients: normally up to 24 months after the last meaningful contact;

• client agreements, core consultation notes, reports, recommendations and service records: normally up to seven years after the service or client relationship ends;

• financial and tax records: normally at least six years, or longer where required by HM Revenue and Customs;

• recordings and AI-generated transcripts: no longer than 12 months from the meeting or session unless an exception described in section 12 applies;

• marketing information: until you opt out or the information is no longer useful, with a minimal suppression record retained where necessary; and

• cookie and analytics information: for the periods described in the Cookie Policy or relevant cookie controls.

Safeguarding, complaint or dispute records may need to be retained for a different period based on the nature of the concern, applicable guidance, insurance requirements and the rights of the child. At the end of a retention period, information is securely deleted or anonymised unless there is a lawful reason to keep it longer.

19  How information is protected

I use reasonable technical and organisational measures appropriate to the nature of the information. These include access controls and passwords, multi-factor authentication where available, secure devices and reputable systems, data minimisation, careful sharing, confidentiality practices, software updates and review of retention and deletion.

No internet or storage system can be guaranteed completely secure. If a personal-data breach occurs, I will assess it promptly, take appropriate steps to limit harm and notify affected people and the Information Commissioner’s Office where legally required.

20  Your data protection rights

Depending on the circumstances, you or your child may have the right to:

• be informed about how personal information is used;

• request access to personal information;

• ask for inaccurate or incomplete information to be corrected;

• ask for information to be deleted in certain circumstances;

• ask for use of information to be restricted;

• object to particular uses, including direct marketing;

• receive certain information in a portable format;

• withdraw consent where processing is based on consent; and

• raise a concern about automated decision-making, although SwitchedON! does not make solely automated decisions producing legal or similarly significant effects.

These rights are not absolute and an exemption may apply. I may need to verify identity and authority before responding. I will normally respond within one month, although the law allows more time for a complex request. There is normally no charge. A child may exercise their own rights where they have sufficient understanding. A parent or carer may make a request on a child’s behalf where appropriate, but parental responsibility does not automatically give unrestricted access to all information a child has shared.

21  Questions and complaints

Please contact Clare Ford at [email protected] if you have a question, wish to exercise a right or are unhappy with how personal information has been handled. I will acknowledge a data-protection complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office. Details are available at https://ico.org.uk/make-a-complaint/ or by telephoning 0303 123 1113. I would welcome the opportunity to address your concern first, but you do not have to contact me before approaching the ICO.

22  Changes to this policy

I may update this policy when services, systems or legal requirements change. The current version will be published on the website with its latest revision date.

If a change significantly affects how existing client information is used, I will provide an additional notice or seek fresh consent where required.