Applicable to: All EHCP Tracker Users
This notice is intended to provide information about how Witherslack Group will use (or "process") personal data about individuals who use the EHCP Tracker application.
This Privacy Notice applies alongside the Witherslack Group Contact/Web Privacy Notice and any other information provided when collecting data through the EHCP Tracker application, including account registration, child profile management, milestone tracking, support requests and notification settings. The EHCP Tracker has been developed to help parents and carers manage and monitor their child's Education, Health and Care Plan (EHCP) journey.
This document is split into the following headings:
• Who are We
• Why do We collect and use your information
• Categories of personal information that We collect, hold and share
• Collecting your information
• Storing your information
• Who do We share your information with
• Why We share your information
• Your Rights
• Queries and complaints
• Who are We
In this policy, whenever you see the words "We", "Us" or "Our", it refers to Witherslack Group Ltd, Lupton Tower, Lupton, Cumbria, LA6 2PR.
For the purposes of UK Data Protection Law, Witherslack Group is the data controller in respect of the personal information collected and processed through the EHCP Tracker application.
Witherslack Group is registered with the Information Commissioner's Office under registration number Z3410582.
Why do We collect and use your information
We lawfully process your information in accordance with UK data protection legislation, including UK GDPR.
We process your information:
• To create and manage your EHCP Tracker account.
• To enable you to create and manage child profiles.
• To provide EHCP milestone and progress tracking.
• To display reminders, tasks and important milestones.
• To provide support and respond to enquiries.
• To improve and maintain the application.
• To ensure the security and functionality of the service.
• To comply with legal and regulatory obligations.
We process personal data under one or more of the following lawful bases:
• Consent.
• Legitimate interests.
Categories of Personal Information that We Collect, Hold and Share Include
User Account Information
When you register for an account We may collect:
• First name.
• Last name.
• Email address.
• Account identifier linked to your user account.
• Child and EHCP Information
We may collect:
• Child name (optional).
• Local Authority.
• School year.
• EHCP application stage.
• EHCP application date.
• EHCP milestone progress information.
• Security and Authentication Information
The EHCP Tracker supports optional biometric login functionality, such as Face ID on supported devices. Where used, biometric authentication is managed by your device and Witherslack Group does not receive or store biometric identifiers.
Reminder and Task Information The application may process:
• User-created reminders.
• EHCP tasks.
• Milestone completion information.
• Task completion dates and status.
• Support Requests
Where you submit a support request We may process:
• Your contact details.
• Support category selections.
• Information provided within your enquiry.
• Information voluntarily entered into free-text fields.
Support requests may include information relating to a child's educational, support or additional needs where this is necessary to respond to your enquiry.
Notification Preferences The application may process:
• Notification preferences.
• Reminder preferences.
• Device notification settings where these have been enabled by the user.
• Collecting Your Information
We collect information when you:
• Create an account.
• Sign into the application.
• Add or edit child details.
• Update EHCP stages.
• Record milestone progress.
• Create reminders and tasks.
• Submit support enquiries.
• Manage notification preferences.
• Child Names and Data Minimisation
The EHCP Tracker has been designed to minimise the collection of directly identifiable information relating to children.
The child name field is optional and users are encouraged to use initials, nicknames, first names or references such as "Child 1" rather than entering a child's full name.
The application includes privacy prompts and guidance to encourage users to limit the amount of personal information entered.
Task Information
Users are encouraged to use the task and reminder functionality only for general reminders and milestones and not for recording highly sensitive personal information.
Storing Your Information
The supplier has confirmed that personally identifiable information collected through the application is encrypted during transmission and encrypted within the application's hosted environment.
The supplier has also confirmed that user passwords are not visible in plain text.
Access to information is restricted to authorised personnel who require access to administer, support or maintain the service.
Information will only be retained for as long as necessary for the purpose collected, in accordance with Witherslack Group retention requirements and applicable legal obligations.
User accounts and related EHCP tracking information will normally be retained whilst the account remains active. Where an account remains inactive for a period of two years, the account may be deactivated following a minimum of 30 days' notice to the registered user. Information will then be reviewed and securely deleted or anonymised in accordance with Witherslack Group retention requirements and any applicable legal obligations
Notifications
The EHCP Tracker may provide two forms of notifications.
Local Notifications
Local notifications are used to remind users about milestones and tasks relating to the EHCP process. These are generated and stored on the user's device.
Push Notifications
Push notifications may be used to provide updates, news and service-related communications.
Notification permissions are managed through the device operating system. Users can enable or disable notifications at any time through their device settings.
The application provides information regarding notification permissions during setup and includes functionality directing users to their device notification settings.
Who Do We Share Your Information With
There are strict controls on who can access your information.
We may share information with:
• Application hosting providers.
• Technical support providers.
• Approved software suppliers.
• Internal Witherslack Group teams supporting the service.
• Regulatory bodies or law enforcement agencies where required by law.
• HubSpot
Where users submit support enquiries through the application, information may be processed through HubSpot to assist Witherslack Group in managing enquiries, internet interactions and support communications. Privacy information explaining this processing is provided before support requests are submitted.
We do not sell your personal information.
Why We Share Your Information
We work with carefully selected third-party service providers that assist us in operating and supporting the EHCP Tracker service.
Application hosting providers - To provide, maintain and secure the service
Technical support providers – To provide technical maintenance and support
HubSpot To manage support enquiries and internet interactions with consent
Information is only shared where there is a lawful basis and appropriate safeguards are in place.
Your Rights
Under data protection legislation you have the right to:
Access your personal information.
Request correction of inaccurate information.
Request erasure in certain circumstances.
Restrict processing in certain circumstances.
Object to processing.
Withdraw consent where processing is based on consent.
Complain about how your information is being processed.
Deleting Your Account
If you no longer wish to use the EHCP Tracker and wish to delete your account, you may contact Witherslack Group using the contact details within this notice.
Account information will be reviewed and managed in accordance with applicable retention requirements.
To exercise any of your rights please contact:
Data Protection Officer, Witherslack Group Ltd, Lupton Tower, Carnforth, LA6 2PR
Email: dataprotection@witherslackgroup.co.uk
Queries and Complaints
If you have concerns regarding the way your information has been processed within the EHCP Tracker application, including support requests, notifications, account management or child profile information, you should contact the Data Protection Officer in the first instance.
If you believe that We have not complied with this notice or have acted otherwise than in accordance with data protection legislation, please contact the Data Protection Officer by emailing dataprotection@witherslackgroup.co.uk or by completing the following complaint form: Complaint Form: Submit a Data Protection Complaint
You also have the right to complain to the Information Commissioner's Office (ICO), although the ICO recommends that concerns are first raised with Witherslack Group.
For more information visit: Information Commissioner's Office