You should know what happens to your information
Ardea Education Advisory Ltd (“Ardea”) provides independent audit, investigation, reflective practice and professional supervision to schools, trusts, education organisations and educational leaders.
This notice explains how Ardea uses and protects personal information.
1. Who is responsible for your information?
Ardea Education Advisory Ltd is responsible for personal information where it determines why and how that information is processed.
For commissioned work, Ardea’s role will depend on the circumstances. Ardea may act as:
- an independent data controller;
- a processor acting on the documented instructions of a client;
- a controller for some activities and processor for others; or
- exceptionally, a joint controller with another organisation.
These responsibilities are established when work is commissioned.
Ardea’s Data Protection Lead is:
Rob Cooper, Director
privacy@ardeaeducation.co.uk
2. What information might Ardea process?
Depending on the service and circumstances, Ardea may process information including:
- names and contact details;
- professional roles and employment information;
- pupil and student information;
- education, attendance and behaviour records;
- SEND, disability, medical and health information;
- safeguarding and child-protection records;
- complaints, grievances and disciplinary records;
- witness accounts and interview records;
- allegations and criminal-offence information;
- communications, correspondence and meeting records;
- careers information;
- financial and contractual information;
- website and communications data.
Some of this information may be particularly sensitive, including special-category personal data and information relating to criminal allegations or offences.
Ardea only seeks information that is necessary and proportionate for the work being undertaken.
Enquiries and appointment bookings
When you email Ardea or book a telephone call or Microsoft Teams meeting, Ardea uses your name, email address, telephone number where provided, and any information you include to respond to your enquiry and arrange the conversation.
Appointments are booked through Microsoft Bookings, which processes booking information within Ardea’s Microsoft 365 business environment. Booking confirmations, calendar invitations and reminders are sent using these services. Teams meetings also use Microsoft Teams.
Please keep enquiry emails and booking notes to a brief outline of what you would like to discuss. Avoid including identifiable information about children or sensitive details about individual cases. If that information is needed, Ardea will agree an appropriate way for you to share it.
Booking a conversation does not mean that it will be recorded or transcribed. If recording or transcription is proposed, this will be explained separately before it begins.
3. Where does information come from?
Ardea may receive personal information:
- directly from you;
- from the school, trust or organisation commissioning the work;
- from documents and records supplied for a commission;
- from people participating in audits, investigations, supervision or other professional work;
- from statutory agencies, professional bodies or other organisations where appropriate;
- from publicly available sources where their use is necessary and appropriate.
Ardea may therefore hold information about you even where you have not provided it directly.
Where information is obtained indirectly, Ardea will consider whether and how this Privacy Notice or more specific privacy information should be provided to you.
4. Why does Ardea use personal information?
Ardea may process personal information to:
- respond to enquiries;
- arrange and manage appointment;
- prepare proposals and agreements;
- deliver commissioned audit, investigation, reflective practice and professional supervision;
- gather, organise and evaluate evidence;
- communicate with clients and people involved in commissioned work;
- produce professional records, findings and reports;
- fulfil safeguarding and professional responsibilities;
- respond to complaints and information-rights requests;
- manage contracts, invoicing and business administration;
- meet legal and regulatory obligations.
Ardea will identify an appropriate lawful basis for processing.
Depending on the circumstances, this may include performance of a contract, compliance with a legal obligation, protection of vital interests, legitimate interests, a legally established public task where applicable, or consent.
Where special-category or criminal-offence information is processed, Ardea will also identify any additional legal condition required.
Consent will not be relied upon merely because information is sensitive and may not be an appropriate lawful basis in safeguarding, employment or investigation work.
5. Information about children
Ardea works with organisations providing education and services to children and young people. Commissioned work may therefore involve children’s personal information, including sensitive safeguarding information.
Ardea will only process information about children where it is necessary and proportionate to the work being undertaken and will take account of children’s particular rights and interests.
Ardea does not use children’s personal information for marketing.
6. Who might information be shared with?
Ardea does not sell personal information.
Where necessary and lawful, information may be shared with:
- the organisation commissioning the work;
- children’s social care, Local Authority Designated Officers and safeguarding partners;
- police and other law-enforcement bodies;
- courts, tribunals, regulators or professional bodies;
- insurers and legal advisers;
- approved technology and professional-service providers;
- people participating in an investigation where procedural fairness requires relevant information to be put to them.
Information will only be shared where there is a legitimate reason to do so and the information shared is relevant and proportionate.
Data protection and confidentiality will not be used as reasons to withhold information where disclosure is necessary and lawful to safeguard a child or prevent serious harm.
7. Recording, transcription and digital tools
Ardea may use approved digital services to support recording, transcription, document research, analysis, evidence organisation and drafting.
Where an interview, meeting or professional discussion is recorded, Ardea will normally explain before recording begins:
- that recording will take place;
- why it is necessary;
- how the recording and any transcript will be used;
- how the information will be protected;
- who may receive it;
- how long it is likely to be retained; and
- any relevant choices or consequences if the person objects to recording.
Automated transcripts are treated as working records and may contain errors. Material quotations used as evidence will be checked against the original recording.
8. Artificial intelligence
Ardea may use approved artificial-intelligence systems to support research, document analysis, transcription, evidence organisation and drafting.
AI supports, but does not replace, professional judgement.
Ardea will only use an AI system where its purpose, contractual terms, security and data-handling arrangements are appropriate for the information involved.
Identifiable or readily re-identifiable safeguarding, SEND, health, employment, disciplinary, investigation or other confidential client information will not be entered into a general-purpose public AI service.
Where sensitive or confidential information is processed using an AI-assisted service, Ardea will use an approved service operating under appropriate business or enterprise arrangements.
AI will not make safeguarding decisions, determine investigation findings, assess whether a witness is truthful, determine legal compliance or make other significant professional decisions affecting individuals.
Ardea remains responsible for its professional conclusions.
9. International transfers
Some technology and professional-service providers may process or permit access to information outside the UK.
Personal information will only be transferred outside the UK where an appropriate legal mechanism is in place, such as UK adequacy regulations, appropriate safeguards or another lawful transfer mechanism.
Ardea considers not only where information is stored, but also remote access, support arrangements and subprocessors when assessing international transfers.
10. How long is information kept?
Ardea retains personal information only for as long as it is necessary for the purpose for which it is held.
Retention periods depend on the type of information, the purpose for which it was collected, contractual arrangements and applicable legal, safeguarding, insurance and professional requirements.
At the end of commissioned work, source information may be returned to the commissioning organisation or securely deleted as agreed. Information that Ardea needs to retain for legal, insurance or professional-accountability purposes will be identified and retained for the appropriate period.
Information that is no longer required will be securely deleted or destroyed.
11. How is information protected?
Ardea uses technical and organisational measures appropriate to the sensitivity of the information it holds.
These include secure business accounts and storage, multi-factor authentication, device encryption, access controls, secure transfer arrangements and appropriate backup and disposal procedures.
Access to client information is restricted to those who legitimately require it.
12. Your rights
Depending on the circumstances and applicable legal conditions or exemptions, you may have rights to:
- be informed about how your information is used;
- access personal information held about you;
- have inaccurate information corrected;
- request erasure of information;
- request restriction of processing;
- object to certain processing;
- receive portable data in certain circumstances;
- withdraw consent where consent is relied upon;
- receive information about and challenge certain significant decisions made solely by automated processing;
- complain about the use of your information.
Not every right applies in every situation.
Requests may be made verbally or in writing. To exercise your rights or ask about the use of your information, contact:
13. Concerns and complaints
If you are concerned about how Ardea has used your personal information, please contact:
Ardea will investigate data-protection complaints and explain the outcome and any action taken.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection and information rights.
14. Changes to this notice
This notice will be reviewed as Ardea’s services, systems and legal obligations develop.
The current version will be available through the Ardea Education Advisory website.
Last updated: 1st October 2026
Ardea Education Advisory Ltd
Company Number: 17118652
www.ardeaeducation.co.uk
privacy@ardeaeducation.co.uk
ICO registration reference: ZC260733