Privacy notice

Who we are

Umfolozi Ltd provides educational psychology advice, consultation and assessment to local authorities in England and Wales. We are registered in England and Wales, company number 14713223.

We are registered with the Information Commissioner's Office (ICO). Our registration reference is ZB749261.

If you have a question about this notice or about how we handle your information, contact us:

• Email: bernita.dewet@umfolozi.co.uk
• Phone: +44 7424 378827

Our role when we work for a local authority

Most of our work is commissioned by local authorities, either directly or through an agency, as part of their statutory duties towards children and young people with special educational needs or additional learning needs.

In this work the local authority is usually the data controller. This means it decides why and how personal information is used, and we handle that information on its behalf and in line with its instructions. The local authority's own privacy notice explains in full how it uses the information, and requests about a child's or young person's records are usually best sent to the local authority first. We will help the local authority respond.

We are the data controller for the information we collect for our own purposes, such as enquiries, business contacts and our company records.

The information we handle

Children and young people we work with

• Name, date of birth, address, and school or setting
• Details of parents, carers and family circumstances relevant to the work
• Education records, and reports from schools and other professionals
• Information about learning, communication, social and emotional, physical and sensory needs, including health information
• Assessment results, observations and our notes
• The views, wishes and feelings of the child or young person

Parents, carers and professionals

• Name, role, contact details and the views you share with us

People who contact us

• Your name, organisation, contact details and the content of your message

Where the information comes from

We receive information from the commissioning local authority, the agency that arranged the work, schools and settings, parents and carers, other professionals such as health and social care staff, and directly from the child or young person during our work with them.

Why we use it, and our lawful basis

We use personal information to carry out educational psychology consultation and assessment, to write psychological advice, to contribute to reviews, re-assessments and tribunal-related work, to quality-check our reports, to respond to enquiries, and to run our business.

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on are:

• Public task (Article 6(1)(e)): for work carried out on behalf of a local authority under its statutory duties, including the Children and Families Act 2014 in England and the Additional Learning Needs and Education Tribunal (Wales) Act 2018 in Wales.
• Contract (Article 6(1)(b)): to deliver the services we are commissioned to provide.
• Legal obligation (Article 6(1)(c)): for example safeguarding duties, and tax and accounting records.
• Legitimate interests (Article 6(1)(f)): to answer enquiries and manage our business relationships.

Some of the information is special category data, such as information about health. We handle it where it is necessary for reasons of substantial public interest (Article 9(2)(g)), on the basis of statutory purposes and the safeguarding of children under Schedule 1 of the Data Protection Act 2018, and for the provision of health or social care (Article 9(2)(h)).

We do not use personal information for marketing, and we do not make decisions about people by automated means.

Who we share it with

We share personal information only where it is needed for the work or required by law:

• The commissioning local authority, which receives our written advice
• The agency through which the work was arranged, where it needs the information to administer the work
• Schools, settings, parents and carers, and other professionals involved, as agreed with the local authority
• Colleagues who quality-review our reports or provide professional supervision, under a duty of confidentiality
• Suppliers who provide our IT, email and document storage, under contract and on our instructions
• The First-tier Tribunal (Special Educational Needs and Disability) or the Education Tribunal for Wales, where we are asked to provide advice or evidence
• Safeguarding agencies, regulators or the police, where the law requires or permits it

We never sell personal information.

How we keep it safe

Much of our work is carried out remotely, so we take particular care with security. Access to case information is limited to the people who need it, our devices and accounts are protected with passwords and encryption, and we send documents containing personal information by secure means.

We store our files and email in a Microsoft 365 business account, including OneDrive. Microsoft acts as our data processor under its standard data protection terms. Our data is held in Microsoft data centres in the UK. Where Microsoft or another supplier needs to transfer information outside the UK, this is done under the safeguards that UK data protection law requires.

How long we keep it

We keep personal information only for as long as it is needed for the purpose it was collected for, and in line with the retention requirements of the commissioning local authority.

• Case records (our written advice, assessment records and notes): until the young person's 25th birthday, or six years after our last involvement if that is later. Where a local authority contract sets a different period, or asks us to return or delete records sooner, we follow the contract.
• Drafts and duplicate copies of documents sent to us: deleted once the final advice has been delivered and accepted.
• Enquiries that do not lead to work: 12 months.
• Financial, tax and company records: six years from the end of the financial year they relate to.

At the end of the retention period, records are securely deleted.

Your rights

Under UK data protection law you have the right to:

• Ask for a copy of the personal information held about you
• Ask for information that is inaccurate or incomplete to be corrected
• Ask for information to be erased, or for its use to be restricted, in certain circumstances
• Object to the use of your information where it is based on public task or legitimate interests
• Ask for information you gave us to be transferred to another organisation, where this applies

These rights are not absolute and some apply only in particular circumstances. A parent or carer can usually make a request on behalf of a child. Young people who are able to understand their rights can make a request themselves.

To make a request, contact us using the details above. There is no charge, and we will respond within one month. Where the local authority is the data controller, we will pass your request to it or tell you who to contact.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first so that we can try to put it right. Email bernita.dewet@umfolozi.co.uk. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office:

This website

This website does not use cookies, analytics or tracking, and it has no forms that collect information. If you email or phone us, we use your details only to deal with your enquiry.

Our hosting provider keeps standard server logs, which include visitors' IP addresses, for security and to keep the site running. The site's typeface is loaded from Google Fonts, which means your browser sends your IP address to Google when a page loads.

Please do not include a child's personal details in a first email to us. We will agree a secure way to share information.

Changes to this notice

We review this notice regularly and will post any changes on this page, with the date it was last updated.