​

1. Who is looking after your information?

Education Estates Advisory provides independent consultancy to schools, trusts and education/Tech' organisations in relation to estates, compliance, asset management, strategic planning and estate intelligence.

​

The data controller is:

Education Estates Advisory
Email: info@edu-estates-advisory.uk
 

Sometimes Education Estates Advisory acts as a data controller.

Sometimes a school or trust remains the controller and Education Estates Advisory acts as a data processor working under its instructions.

The contract and nature of the work determine which applies.

A useful rule of thumb is this:

​

If you give us information to run our business, we will usually be the controller. If a school gives us information specifically so we can carry out commissioned work on its behalf, the school may remain the controller.

2. Our approach to privacy

Good estate management and good information management have something rather obvious in common:

knowing what you have, knowing why you have it, knowing who is responsible for it and avoiding unpleasant surprises later.

We therefore apply the same principles to information that we encourage schools to apply to their estates.

Our approach is based upon:

• transparency;

• data minimisation;

• controlled access;

• appropriate retention;

• secure systems;

• accountability;

• proportionate decision-making.

​

The relevant legislation includes the UK GDPR, Data Protection Act 2018, Data (Use and Access) Act 2025 and, where relevant, the Privacy and Electronic Communications Regulations 2003 - PECR.

3. What information might we hold?

Most of the information Education Estates Advisory handles is remarkably unexciting.

That is exactly how we like it.

It may include:

Contact information

• your name;

• job title;

• school, trust or organisation;

• professional email address;

• telephone number;

• correspondence with us.

Business information

• enquiries;

• quotations;

• contracts;

• invoices;

• project instructions;

• meeting records;

• professional correspondence.

Estate information

Our work may involve:

• asset registers;

• condition information;

• maintenance records;

• compliance documentation;

• risk-management information;

• photographs of buildings and assets;

• project information;

• inspection records;

• action plans;

• estate strategies.

​

Most estate information concerns buildings, systems, assets and organisational arrangements rather than individuals.

Where personal information appears within estate documentation, we use only what is reasonably required for the work.

4. A particular word about schools

Schools contain a great deal of information.

Fortunately, inspecting a boiler rarely requires somebody's GCSE results.

Our consultancy focuses on:

estates, assets, compliance, safety, maintenance, planning and leadership information.

​

We therefore design our work around data minimisation.

Where personal information relating to staff, contractors, pupils or other individuals appears within material supplied by a school, it is handled according to the purpose of the commission and the appropriate controller/processor arrangements.

Information concerning children receives particularly careful handling.

​

Where special-category personal data is genuinely required, an appropriate lawful basis and Article 9 condition will be identified.

5. Why do we use information?

We use information where it supports a legitimate and defined purpose, including:

• answering an enquiry;

• preparing a quotation;

• agreeing a contract;

• providing consultancy services;

• carrying out an estate review;

• preparing reports and recommendations;

• arranging meetings or site visits;

• administering client relationships;

• managing accounts and invoices;

• maintaining appropriate professional records;

• protecting our systems;

• meeting legal or regulatory obligations;

• improving our services;

• providing relevant professional information where the law permits.

We have yet to identify a compelling business reason for collecting information simply because we can.

6. What gives us the legal right to use it?

Depending upon the circumstances, our lawful basis may be:

Contract

Where processing is necessary to enter into or perform a contract.

Legitimate interests

Where there is a genuine and proportionate business reason for processing information and the interests, rights and freedoms of the individual have been considered.

​

Examples may include:

​

• responding to professional enquiries;

• administering client relationships;

• maintaining professional records;

• protecting our systems;

• improving our services;

• communicating relevant business information.

Legal obligation

Where information must be processed to meet legal, regulatory, tax, insurance or accounting requirements.

Consent

Where consent is the appropriate legal basis, we will ask for it clearly and provide an equally clear way to withdraw it.

7. Where is information stored?

Education Estates Advisory uses professional Google Workspace and Google Cloud services as part of its information-management environment.

​

These systems may support:

​

• email;

• document management;

• cloud storage;

• calendars;

• secure collaboration;

• controlled file sharing;

• business administration;

• backup and recovery.

​

Google provides contractual data-processing arrangements and technical and organisational security measures for its business cloud services.

​

We then remain responsible for the rather important human part: deciding what information goes there, why it is there, who can access it and when it should be removed.

​

Technology is useful.

Governance remains useful too.

8. GDPR training and information handling

The person responsible for information handling within Education Estates Advisory has undertaken GDPR and data-protection training.

​

That training informs practical arrangements including:

​

• data minimisation;

• information classification;

• controlled access;

• secure sharing;

• retention;

• deletion;

• incident management;

• controller and processor responsibilities;

• appropriate handling of information within education environments.

​

Data-protection knowledge is kept under review as legislation and ICO guidance develop.

9. Who might receive information?

Information may be shared with organisations where there is an appropriate professional, contractual or legal reason.

​

These may include:

​

• the school or trust commissioning our work;

• Google as our business cloud-services provider;

• website and IT providers;

• accountants;

• insurers;

• legal or professional advisers;

• specialist consultants working on an agreed project;

• regulators or public authorities where disclosure is legally required.

​

Access is provided according to purpose rather than curiosity.

10. International data transfers

Some technology providers operate internationally.

Where personal information is transferred outside the UK in circumstances covered by UK data-protection law, an appropriate transfer mechanism will be used.

​

This may include:

​

• UK adequacy regulations;

• recognised contractual safeguards;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved Standard Contractual Clauses;

• another legally recognised mechanism.

11. How long do we keep information?

Useful information should remain available while it serves a legitimate purpose.

Information that has reached the end of that purpose should reach the end of its stay.

Our normal framework is:

​

General enquiries
Usually retained for up to 24 months after the last meaningful contact.

​

Client, accounting and contractual records
Usually retained for approximately six years, subject to the relevant legal, accounting, contractual and insurance requirements.

​

Professional project records
Usually retained for up to six years following completion, subject to professional, contractual, insurance or legal requirements.

​

Information processed on behalf of a school or trust
Managed according to the relevant contract, processing arrangements and instructions from the controller.

​

Retention requirements are reviewed periodically.

12. Cookies

Cookies suffer from one considerable marketing problem.

They sound far more interesting than they are...

​

Our website may use cookies and similar technologies to:

​

• make the site function;

• maintain security;

• understand website use;

• remember appropriate preferences;

• improve website performance.

​

Where consent is legally required, the relevant technology will operate according to the choices you make.

​

Where a statutory exemption applies, technologies may operate without consent subject to the conditions attached to that exemption.

​

Where applicable, further controls will be available through the website's cookie settings.

13. Marketing

Education Estates Advisory may communicate with professional contacts about relevant estate-management services, guidance or information where an appropriate lawful basis exists.

​

Every individual has the right to object to the use of their personal information for direct marketing.

​

Tell us once and we will record the preference.

Repeatedly emailing somebody who has asked to be left alone is poor marketing as well as poor data protection.

14. Your information. Your rights.

Depending upon the circumstances, UK data-protection law may give you rights including:

​

• access to your personal information;

• correction of inaccurate information;

• erasure in applicable circumstances;

• restriction of processing;

• data portability where applicable;

• objection to certain processing;

• withdrawal of consent where consent is relied upon;

• rights concerning certain automated decisions.

​

You can make a request by emailing:

info@edu-estates-advisory.uk

​

We may ask for enough information to confirm your identity and locate the relevant records.

​

There is deliberately no requirement to know the phrase "data subject access request" before asking what information we hold about you.

15. If you have a concern

Privacy complaints should be easy to make.

You can raise a data-protection concern or complaint with:

Education Estates Advisory
Email: info@edu-estates-advisory.uk

​

We will:

​

• provide an accessible way to raise the complaint;

• acknowledge receipt within 30 days;

• investigate it appropriately;

• keep you informed where appropriate;

• communicate the outcome without undue delay.

​

You also have the right to raise a concern with the Information Commissioner's Office - ICO.

​

We would rather hear about a concern and deal with it properly than discover it has been quietly irritating somebody for six months.

​

16. Data incidents

Information security involves preparation as well as prevention.

Where a personal-data incident occurs, we will assess:

​

• what happened;

• what information was involved;

• who may be affected;

• the potential level of risk;

• what action is required.

​

Where the applicable legal threshold for regulatory notification is reached, the Information Commissioner's Office will be notified within the required timeframe.

Where we are processing information on behalf of another controller, the relevant organisation will be informed in accordance with the applicable arrangements.

17. Changes to this policy

Data protection law develops.

Technology develops.

Education Estates Advisory develops.

This policy will therefore be reviewed periodically and updated when our services, systems, processing activities or legal obligations materially change.

The current version will always show its revision date.

​

The 'nutshell' version, once again

​

We collect information for a reason.

We use professional systems to look after it.

We limit access.

We keep it for an appropriate period.

We respect your rights.

And if you want to ask us about your information, you can.

​

Education Estates Advisory - info@edu-estates-advisory.uk

​

Sensible estates. Sensible data.