Privacy Policy

Data Protection & Privacy Policy (incorporating Teachable Privacy Notice and School Data Sharing Agreement) Version: v1.0 Date: 1st September 2025

Review Date: 1st September 2026

Approved by: Emma Ledger, Spark Design Academy Principal

1. Purpose This policy sets out how Spark Design Academy (SDA) complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant international requirements. It explains how we collect, use, store, and share personal data lawfully and securely, protecting the rights of learners, staff, and stakeholders.

This policy also incorporates our learner-facing Privacy Notice , including details of how learner data is processed on the Teachable learning platform.

2. Scope This policy applies to:

● All SDA staff, tutors, assessors, contractors.

● All learners enrolled on SDA programmes.

● All personal data processed by SDA, whether digital, paper, or audio/visual.

3. Definitions

● Personal Data: Information relating to an identifiable individual (e.g., name, contact details, learner records).

● Special Category Data: Sensitive data such as health, ethnicity, or safeguarding information.

● Processing: Any action performed on personal data (collection, storage, sharing, deletion).

● Data Subject: The individual whose data is processed.

● DPO: Data Protection Officer – responsible for compliance within SDA.

4. Responsibilities

● DPO: Craig Buglass – ensures compliance, responds to Subject Access Requests (SARs), maintains breach log.

● All Staff: Handle data securely, report breaches immediately.

● Learners: Provide accurate personal details.

5. Data Protection Principles SDA adheres to six GDPR principles:

1. Lawfulness, fairness, transparency.

2. Purpose limitation.

3. Data minimisation.

4. Accuracy.

5. Storage limitation.

6. Integrity and confidentiality.

6. What Data We Collect and Why We collect the minimum data needed to deliver your course:

Data Collected Purpose Lawful Basis Name & Date of Birth NCFE registration & certification Contract / Public Task School/Organisation Centre association Contract Email Address Login, communication, password reset

Legitimate Interests Parent/Guardian Contact (U18) Consent & safeguarding Legal Obligation Course Progress & Assessment Results Learning support, quality assurance Contract Consent Preferences Record acceptance, media consent Consent Learning Support Flag (Y/N only) Equal access Public Task

7. How We Use Your Data

● Create learner accounts on Teachable.

● Track progress and assessments.

● Register/certify results with NCFE.

● Communicate course updates.

● Provide evidence for moderation and audit. We do not use learner data for marketing without explicit opt-in consent.

8. Legal Basis We process data under:

● Contract – delivering courses, issuing certificates.

● Legal Obligation – meeting NCFE requirements.

● Consent – parental consent (U18), optional media permissions.

9. Who We Share Data With

● Teachable, Inc. (USA): Course platform provider (SDA processor, under SCCs).

● NCFE: For learner registration, moderation, certification.

● Schools/Organisations: To confirm enrolment, progress, and results.

● Google Workspace: Secure storage of coursework submissions (retained per NCFE guidance). We never sell personal data.

10. International Transfers Learner data may be processed on Teachable servers in the USA. Safeguards include Standard Contractual Clauses (SCCs) .

11. Data Storage & Security

● Digital data: encrypted, password-protected systems.

● Paper records: locked, restricted access.

● Sensitive data (e.g., safeguarding): stored separately with enhanced access.

● Retention: ○ Assessment/learner records: minimum 3 years (GDPR Policy baseline). Learner records for NCFE: 6 years or per awarding body rules.

○ Secure deletion after retention period.

○ For full details of how learner work is stored in Google Workspace, see Appendix C: Google Workspace Security Statement.

12. Learner & Staff Rights All data subjects have the right to:

● Be informed about data use.

● Access their personal data (SARs).

● Correct inaccurate data.

● Request deletion (where lawful).

● Restrict or object to processing.

● Data portability.

● Lodge complaints with the ICO (UK regulator). SDA responds to SARs within 30 calendar days .

13. Children’s Data For learners under 18, SDA requires parent/guardian consent before enrolment. Consent records are stored securely.

14. Data Breaches

● All breaches reported immediately to the DPO.

● Breach log maintained.

● Serious breaches reported to the ICO within 72 hours .

● Partner schools notified within 48 hours where affected.

15. Monitoring & Review

● Policy reviewed annually or when legislation changes.

● Compliance audits conducted regularly.

● Staff receive mandatory GDPR training at induction and refresher training annually.

16. Learner Work & Intellectual Property

1. Ownership All creative work, designs, and supporting materials submitted by learners as part of this course remain the sole intellectual property of the learner. See also Appendix D: Evidence Handling & Assessment Security Statement for details of how assessment evidence is securely managed and stored.

2. Permitted Use Spark Design Academy will only use learner work for the purposes of:

○ Assessment and grading

○ Internal and external quality assurance

○ Compliance with awarding body requirements (e.g., NCFE sampling)

3. Restrictions Learner work will not be published, shared externally, used for marketing purposes, or provided to any third party without the learner’s explicit prior consent.

4. Consent for Optional Use If Spark Design Academy wishes to showcase learner work (e.g., in marketing, promotional materials, or case studies), separate written consent will be obtained from the learner (or parent/guardian where applicable).

17. Related Policies

● Safeguarding Policy

● Equality, Diversity & Inclusion Policy

● Malpractice & Plagiarism Policy

● Appeals & Complaints Policy