Privacy Policy

Play Practitioners. Last updated 14 August 2026.

1. Who I am

Play Practitioners Ltd is responsible for the personal data described in this policy. I am a company registered in England and Wales, number 15482602.

In this policy, I, me and my mean Play Practitioners Ltd. You can reach me at tricia@playpractitioners.com, and I will provide my registered address on request.

I am not required to appoint a Data Protection Officer. I deal with data protection questions myself, and you can raise any of them with me directly.

2. What this policy covers

This policy explains what I do with personal data in three situations:

• when you visit my website
• when you enquire about my services or become a client
• when I carry out an audit or consultancy work in your school and see information about your staff and children

The third situation carries the most responsibility. Section 6 sets out exactly how I work.

3. When I control data and when I handle it for you

This distinction matters, and your data protection lead will ask about it, so I have put it near the front.

For your contact details, enquiries, bookings, invoices and our correspondence, I am the controller. I decide what to collect and why, and this policy explains those decisions.

For personal data inside your school, such as staff records, planning, pupil observations, assessments and learning journals, you are the controller. You decide what that information is for. I see it only to carry out the review you have asked me to do, and I handle it on your instructions.

My professional opinion and the report I write are mine as controller. I write reports that refer to staff by role rather than by name, so my reports normally contain little or no personal data.

If you need a written data processing agreement, I will sign yours or provide my own. Please ask at the time of booking so we can settle it before I arrive.

4. When you visit my website

My website is hosted by Squarespace, which collects some data automatically so that the site works and stays secure.

Analytics

My website collects data to power site analytics, including information about your browser, network and device, the pages you visited before arriving, your IP address, and how you use the site, such as clicks, internal links, pages visited, scrolling, searches and timestamps.

I share this with Squarespace, my website analytics provider, to understand site traffic and activity. Squarespace analyses it in a depersonalised form.

Cookies

My website uses cookies and similar technologies, which are small files that download to your device when you visit. Squarespace publishes a list of the cookies it uses.

Necessary cookies are always used, and they allow Squarespace to serve the site to you securely. Analytics and performance cookies are used only when you accept them through the cookie banner, and they help me see site traffic and activity. You can change your mind at any time through your browser settings.

Web forms

When you submit a form on my website, I collect the information you enter so that I can respond to you. Squarespace handles form submissions on my behalf.

Fonts

My website serves and renders fonts using Google Fonts and Adobe Fonts. To display the site properly, those providers may receive information about your browser, network or device, the page you are viewing, and your IP address.

Blog comments and likes

Where commenting is enabled, I collect your name, which appears with your comment, and optionally your email address so I can tell you about replies, and your website address. Where liking is enabled, information about your browser, network, device and IP address is collected to stop the same person liking a post repeatedly in one visit.

5. Enquiries, bookings and clients

When you contact me, book a discovery call, or engage me for work, I collect your name, role, school, contact details, the content of our conversations, your proposal and booking details, and your invoicing and payment records.

I use this to answer your enquiry, hold the discovery call, prepare a proposal, deliver the work, invoice you, and keep proper business records.

6. School data during audits and consultancy

When I review provision at your school I may see personal data belonging to you, including:

• staff records, planning, observations and performance information
• children's learning journals, observations, assessments and progress records
• attendance and admissions information
• in some cases, information about a child's health, additional needs or safeguarding history

These are the rules I work to, and you can hold me to them:

• I look at what I need in order to reach a professional judgement, and no more.
• I do not copy, photograph, scan or download identifiable records.
• I do not take identifiable personal data off your site, on paper or on a device, unless we agree it in writing beforehand along with how it will be protected.
• My working notes refer to children and staff by initials, year group or role, never by full name.
• My reports refer to staff by role. Where I illustrate a point with a child's experience, I anonymise it.
• I destroy my working notes once I have issued the final report and any factual corrections are complete.
• I never use anything I see in your school to train an artificial intelligence system, and I never use it for any purpose other than your review.

I handle this data on your instructions in order to perform our contract. As controller, you remain responsible for identifying your own lawful basis for letting me see it, and I am happy to help you document that.

7. Information about children

I do not knowingly collect personal data from children through my website, and my services are aimed at schools rather than at children or families.

Where I see information about children during a visit, section 6 applies in full. The law gives children's data extra protection because children are less able to understand the risks, and I treat it accordingly. I minimise what I look at, I do not record it in identifiable form, and I do not take it away with me.

8. Health, additional needs and safeguarding information

Some of what I may see in a school falls into a special category under the law, such as information about a child's health, additional needs or ethnicity, or records relating to safeguarding.

I do not ask to see this information as a matter of routine. Where reviewing it is genuinely necessary, for example to judge how well your setting supports children with additional needs, I read it in place, I do not record identifying details, and I do not remove it.

If I need to make a safeguarding report, I share only what is necessary with the person or authority who needs to receive it. My terms and conditions explain when I would do this. The law permits this in the substantial public interest of protecting children, and nothing in this policy or in any agreement between us prevents me from making a report.

9. Marketing

If you have enquired about my services or worked with me, I may send you occasional emails about related services. Every email carries an unsubscribe link and I act on it straight away.

If you sign up for a mailing list, newsletter or download, I rely on your consent, and you can withdraw it whenever you like.

I do not sell or rent your details to anyone.

10. Who I share data with

I use a small number of providers who handle data on my behalf:

Provider	What they do for me
Squarespace	Hosts my website and handles form submissions and site analytics
Google Fonts and Adobe Fonts	Serve the fonts my website displays
Microsoft and Onedrive	Holds our correspondence and my working documents
Revolut	Process invoices and payments
Nationwide Accountancy	Prepares my accounts and tax returns

Each of them is bound to use the data only for the service they provide to me.

I also share data where the law requires it, or where I need to protect a child as explained in section 8. I do not sell your data to anyone.

11. Sending data outside the UK

I work with schools around the world, so I send and receive emails and documents to and from countries outside the UK.

Some of my providers store data outside the UK. Where they do, I rely on the safeguards the law allows, such as UK adequacy regulations or the International Data Transfer Agreement.

When I visit a school outside the UK, section 6 applies. I look at your data in place and I do not carry identifiable records across a border.

12. Lawful bases at a glance

The law requires me to have a lawful basis for everything I do with personal data. These are mine.

What I do	Data involved	My lawful basis
Answer your enquiry and hold a discovery call	Name, role, school, contact details, your message	Steps taken at your request before entering a contract
Deliver an audit, consultancy or professional learning	Contact and booking details, correspondence	Performing our contract
Handle personal data inside your school	Staff and pupil records	Your instructions as controller, so that I can perform our contract
See records that include health or additional needs information	Special category data	Your instructions, under the basis you rely on as controller
Report a safeguarding concern	Only what is necessary	Substantial public interest in protecting children, under the Data Protection Act 2018
Email past and prospective clients about my services	Name, email, school	My legitimate interests in developing my business
Keep invoices and financial records	Billing and payment records	My legal obligations
Run and secure my website	Device, browser and IP information	My legitimate interests in providing a working, secure site
Use analytics and performance cookies	As above	Your consent, given through the cookie banner

13. How long I keep data

What it is	How long I keep it
Enquiries that do not lead to a booking	12 months from our last contact
Client contact and booking records	6 years after our last piece of work
Audit reports, which refer to staff by role rather than by name	6 years, so that I can stand behind my professional opinion and answer any insurance claim
Identifiable personal data belonging to your school	Returned or deleted within 6 months of completing the work
Working notes taken during a visit	Destroyed once the final report is issued and any factual corrections are complete
Invoices and financial records	6 years after the end of the tax year they relate to, as tax law requires
Website analytics	As set by Squarespace
Marketing list	Until you unsubscribe, after which I keep a minimal record so that I do not email you again by mistake

14. Keeping data secure

I keep personal data securely. My devices are encrypted and password protected. My contact database, documents and finance system require passwords, with multi factor authentication wherever the provider offers it. Access is limited to me and to any contractor who needs it for a specific task, under a confidentiality agreement.

If a breach happens that is likely to put anyone at risk, I will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and I will tell the people affected where the law requires it. If the breach involves data belonging to your school, I will tell you without delay so that you can meet your own obligations.

15. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• ask what personal data I hold about you and receive a copy
• have inaccurate data corrected
• have data erased, in some circumstances
• ask me to restrict how I use your data
• object to my use of your data where I rely on legitimate interests
• receive data you gave me in a portable format
• withdraw your consent at any time, where I rely on consent
• complain to the Information Commissioner's Office

Exercising any of these rights is free, and it will not affect how I work with you.

16. How to make a request

Write to me at tricia@playpractitioners.com. I need your request in writing, so please do not make it during a voice or video call. Email, post or a written message are all fine.

I will respond within one month of receiving your request. If the request is complex, or if you have made several, I may extend that by up to two further months, and I will tell you within the first month if I need to.

I may need to verify your identity before I release personal data, so that I do not send your information to someone impersonating you. If I cannot verify who you are, I may not be able to act on the request.

17. Complaints

If you are unhappy with how I have handled your data, please tell me first. I will look into it and try to put it right.

You can also complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or by telephone on 0303 123 1113. You do not have to raise it with me first.

18. Changes to this policy

I may update this policy from time to time. The version on my website is always the current one, and the date at the top shows when I last changed it. Where a change materially affects you, I will tell you rather than leaving you to notice.