Website Privacy Policy

Last updated: 30.08.2026

1. Introduction

This privacy notice explains how The SEND Consultancy Group Ltd collects, uses, stores and protects personal data. It applies to personal data collected through our website at www.thesendconsultancygroup.co.uk, through our communications with you, and through the services we provide.

The SEND Consultancy Group Ltd is the data controller and is responsible for your personal data. In this privacy notice, “we”, “us” and “our” refer to The SEND Consultancy Group Ltd.

Our contact details are:

Full name of legal entity: The SEND Consultancy Group Ltd
Email address: info@thesendconsultancygroup.co.uk
Postal address: Kent House, 81 Station Road, Ashford, Kent TN23 1PP

If any of the personal data we hold about you changes, please let us know by emailing us at info@thesendconsultancygroup.co.uk so that we can keep our records accurate and up to date.

Our website is not intended for children to use without appropriate adult involvement. Where we process personal data relating to children, this is usually because it has been provided to us by a parent, carer, guardian, school, local authority, professional adviser or another person involved in the relevant matter.

2. What personal data we collect

Personal data means any information that can identify an individual, either directly or indirectly. It does not include data that has been fully anonymised so that no individual can reasonably be identified from it.

Because of the nature of our work, we may process personal data relating to parents, carers, children, young people, family members, school staff, local authority staff, professionals, representatives and other people involved in SEND-related matters.

We may collect and process contact and identity information, such as names, addresses, email addresses, telephone numbers, job titles, roles, organisations and details of your relationship to a child or young person.

We may also process communication data, including information you provide when you contact us by email, telephone, online form, video call, text, social media message, post or through any other method. This may include details of your enquiry, your circumstances, documents you send to us and records of our communications with you.

Where you purchase services from us, we may process customer and transaction data, including details of the services requested or purchased, billing information, payment records and related correspondence. We do not usually store full payment card details ourselves where payments are processed by a third-party payment provider.

We may process service and case-related information where this is necessary in connection with an enquiry, consultation, support service, advocacy, complaint, appeal, Education, Health and Care Plan matter, school issue, local authority issue, tribunal matter or other SEND-related work. This may include information about education, health, disability, family circumstances, school provision, local authority involvement, professional reports, assessments, communications, meeting notes, evidence, case history and other relevant material.

We may collect technical and user data about how you use our website, such as your IP address, browser type, device information, time zone, location data, pages viewed, length of visit, navigation paths and information collected through cookies or similar technologies.

We may also process marketing data, such as your preferences in receiving marketing from us, your communication preferences and information about how you interact with our marketing communications.

3. Special category data, children’s data and sensitive information

We process special category data where this is necessary for the services we provide or where it is otherwise relevant to a matter or enquiry. Special category data includes information about health, disability, medical needs, mental health, ethnicity, religious or philosophical beliefs, sexual orientation, sex life, trade union membership, genetic data and biometric data where used for identification purposes.

In the context of our work, the special category data we process is most likely to include health information, disability information, mental health information, medical evidence, information about educational needs, professional assessments, Education, Health and Care Plans, school reports, tribunal evidence and other SEND-related documents.

We may also process information about children and young people, including information about their education, development, needs, provision, health, disability, behaviour, family circumstances, safeguarding concerns, complaints, appeals and support arrangements.

In some cases, information provided to us may include safeguarding information or information relating to allegations, incidents or potential criminal offences. We will only process this type of information where it is relevant and lawful for us to do so, for example where it is necessary in connection with the services we are providing, the establishment, exercise or defence of legal claims, safeguarding obligations, or where otherwise permitted by law.

We recognise that SEND-related information can be highly sensitive. We therefore aim to limit the personal data we collect and use to what is necessary for the relevant purpose, and we take steps to protect that information appropriately.

4. How we collect personal data

We collect personal data directly from you when you contact us, complete forms, make an enquiry, book or purchase services, send us documents, attend meetings, consultations or calls, or communicate with us in any other way.

We may also collect personal data from third parties where this is relevant to the matter or service. This may include parents, carers, guardians, schools, local authorities, education professionals, health professionals, social care professionals, legal representatives, advocates, expert witnesses, tribunal services or other people involved in the relevant matter.

We may automatically collect certain technical data when you use our website through cookies and similar technologies. Please see our cookie policy for more information.

5. Why we use personal data and our lawful bases

We only process personal data where we have a lawful basis to do so under UK data protection law.

We may process personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This applies where we use your information to respond to an enquiry, provide a quote, arrange a consultation, deliver services, manage our relationship with you, process payments or deal with service-related communications.

We may process personal data where it is necessary for our legitimate interests, provided that your rights and interests do not override those interests. Our legitimate interests include running and managing our business, responding to enquiries, keeping appropriate records, improving our services, managing client relationships, protecting our business, dealing with complaints, maintaining the security of our systems, establishing, exercising or defending legal claims, and communicating with relevant parties in connection with the services we provide.

We may process personal data where this is necessary to comply with a legal obligation. This may include keeping certain business and accounting records, dealing with legal requests, complying with regulatory obligations, responding to lawful requests from authorities, or managing data protection rights and complaints.

In some circumstances, we may rely on consent. Where we rely on consent, you have the right to withdraw your consent at any time. Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.

Where we process special category data, we must also identify an additional condition for processing that data. Depending on the circumstances, we may rely on your explicit consent or on the condition that processing is necessary for the establishment, exercise or defence of legal claims. In some cases, another condition under data protection law may apply, such as where processing is necessary for safeguarding or other substantial public interest reasons. Where we rely on explicit consent for special category data, we will ask for that consent separately and will not bundle it into general terms and conditions.

6. Marketing communications

We may use your personal data to send you marketing communications where we are permitted to do so by law.

Our lawful basis under UK GDPR for sending marketing communications may be your consent or our legitimate interests in promoting and growing our business. We will also comply with the Privacy and Electronic Communications Regulations.

If you are an individual, sole trader or certain type of partnership, we will usually need your consent to send you email marketing unless the “soft opt-in” applies. The soft opt-in may apply where you have bought services from us or asked us for information about similar services, you were given the opportunity to opt out at the time your details were collected, and you are given the opportunity to opt out in each marketing communication.

If you are a limited company, LLP or other corporate subscriber, we may send marketing emails to corporate email addresses without prior consent, but you can still opt out at any time.

Before we share your personal data with any third party for that third party’s own marketing purposes, we will obtain your express consent.

You can ask us to stop sending you marketing messages at any time by emailing us at info@thesendconsultancygroup.co.uk or by using the unsubscribe link in our marketing emails, where one is provided.

If you opt out of marketing, we may still send you non-marketing communications where these are necessary in connection with services you have purchased, enquiries you have made, legal obligations or other legitimate business purposes.

7. Use of AI tools and AI-enabled services

We may use AI tools and AI-enabled services to support authorised administrative, drafting, research, transcription, note-taking, communication and operational tasks within our business. Where we use AI tools, we aim to limit the information processed through those tools to what is necessary for the relevant task.

AI tools and AI-enabled services are often provided by third-party technology providers. Where those providers process personal data on our behalf, they act as our data processors. Where we use data processors, we are required by data protection law to have appropriate data processing terms in place with them.

Before using an AI tool that processes personal data, we will take reasonable steps to assess the provider’s data protection, confidentiality and security arrangements. This may include reviewing the provider’s terms, privacy information, data processing addendum or data processing agreement, security measures, retention arrangements, sub-processor information and whether personal data may be used to train or improve AI models.

Given the nature of our work, the information we receive may include information about children, education, health, disability, family circumstances, safeguarding, schools, local authorities, Education, Health and Care Plans, appeals, complaints, tribunal matters and other sensitive or confidential information.

We do not intentionally upload identifiable client information, children’s information, Education, Health and Care Plans, medical information, disability information, safeguarding information, tribunal documents, school reports or other sensitive case-related personal data into open or public generative AI tools unless this has been specifically authorised and appropriate data protection checks have been completed.

Where possible, we use anonymised or minimised information when using AI tools. However, some approved AI-enabled tools, such as transcription, meeting note, CRM, email, administration or productivity tools, may process personal data where this is necessary for the relevant purpose and where appropriate safeguards are in place.

The types of information we may use with AI tools include professional and business contact information, business correspondence and administrative information, anonymised case information, limited operational information, transcripts, notes or summaries, and information used for internal drafting, planning, research, policy development, training, process improvement or general business administration.

Where an approved AI-enabled transcription or note-taking tool is used, it may process personal data contained in the relevant meeting, consultation or communication. We will only use such tools where we consider their use appropriate for the relevant purpose and where suitable safeguards are in place.

We do not use AI tools to make decisions about clients, children, cases, advice, advocacy strategy or outcomes. Any AI-generated content is reviewed by a human before it is relied upon or used.

We do not make solely automated decisions that have legal or similarly significant effects on you, your child or your case.

Where an AI provider processes personal data on our behalf and does not provide its own suitable data processing addendum or data processing agreement, we will put appropriate data processing terms in place with that provider where required.

Some AI providers may be based outside the UK, or may store, access or otherwise process personal data outside the UK. Where this involves an international transfer of personal data, we will consider whether the destination country benefits from UK adequacy regulations or whether another lawful transfer mechanism is required.

Where personal data is transferred to a country that does not benefit from UK adequacy regulations, and where no other exemption or lawful mechanism applies, we will put in place appropriate safeguards where required. This may include the UK International Data Transfer Agreement or, where appropriate, the UK Addendum to the EU Standard Contractual Clauses.

Where we use a US-based AI provider and this involves a transfer of personal data to the United States, we will check whether that provider is certified under the UK extension to the Data Privacy Framework, where this is relevant to the transfer. If the provider is not certified under the UK extension to the Data Privacy Framework, we will consider what additional safeguards are required before transferring personal data to that provider.

We will keep our use of AI providers under review and may update the AI tools we use from time to time, provided that we continue to consider our data protection, confidentiality and contractual obligations.

8. How we protect personal data

We have put in place appropriate technical and organisational measures to protect personal data from being accidentally lost, used, accessed, altered or disclosed without authorisation.

We limit access to personal data to those employees, workers, contractors, advisers, service providers and other authorised persons who have a business need to know that information. They will only process personal data on our instructions where they act as processors, and they are required to keep personal data confidential.

Our measures may include secure systems, access controls, password protection, appropriate account settings, confidentiality obligations, staff guidance, data minimisation, anonymisation where appropriate, secure storage, secure transfer methods, review of processor terms, and appropriate retention and deletion practices.

Where AI tools are used, our safeguards may include using approved AI tools only, limiting access to authorised personnel, reviewing provider terms and data processing terms, checking whether personal data may be used for AI training or model improvement, minimising or anonymising personal data where possible, avoiding the use of identifiable SEND case materials in open or public generative AI tools unless specifically authorised and checked, applying human review to AI-generated outputs, considering whether a data protection impact assessment is required, and ensuring that our workforce understands the limits on using AI tools with client information and sensitive SEND-related materials.

We have procedures in place to deal with suspected personal data breaches. Where we are legally required to do so, we will notify the Information Commissioner’s Office and/or affected individuals.

9. Disclosures of personal data

We may share personal data with third parties where this is necessary for the purposes described in this privacy notice.

This may include IT and system administration providers, cloud storage providers, CRM providers, email providers, website hosts, payment processors, transcription or note-taking providers, AI tool providers, professional advisers, insurers, accountants, auditors, legal advisers, consultants, contractors and other service providers who support our business.

We may also share personal data with schools, local authorities, education professionals, health professionals, social care professionals, experts, representatives, tribunal services, courts, regulators, government bodies or other third parties where this is necessary in connection with the services we provide, where you have asked us to do so, where it is necessary to protect our business or your interests, or where we are legally required or permitted to do so.

If we sell, transfer, restructure or merge parts of our business or assets, personal data may be shared with relevant third parties as part of that process. Any new owner or successor may use your personal data in the same way as set out in this privacy notice.

Where third parties process personal data on our behalf, we require them to respect the security of the data and to process it only for specified purposes and in accordance with our instructions. In some cases, third parties may act as independent controllers of personal data, in which case they will be responsible for complying with their own data protection obligations.

10. International transfers

Some of our third-party service providers may be based outside the UK, or may store, access or otherwise process personal data outside the UK. This means that personal data may sometimes be transferred outside the UK.

Where we transfer personal data outside the UK, we will do so in accordance with UK data protection law. We may transfer personal data to countries or territories that benefit from UK adequacy regulations. These currently include the EEA countries, the EFTA States, EU or EEA institutions, Gibraltar, the Republic of Korea, Andorra, Argentina, Canada for commercial organisations only, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan for private sector organisations subject to Japan’s Act on the Protection of Personal Information, Jersey, New Zealand, Switzerland and Uruguay.

Where a country does not benefit from UK adequacy regulations, we will use an appropriate safeguard where required. This may include the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. The old EU Standard Contractual Clauses can no longer be used for UK transfers entered into from 21 March 2024.

Where we transfer personal data to a US organisation, we may rely on the UK extension to the EU-US Data Privacy Framework where the US organisation is appropriately certified. You can check whether a US organisation is certified on the Data Privacy Framework list here: https://www.dataprivacyframework.gov/list. ICO guidance on transfers of personal information to the US is available here: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/international-data-transfer-agreement-and-guidance/transferring-personal-information-to-the-us/.

If a US organisation is not certified under the UK-US Data Bridge, we will consider what other transfer mechanism and safeguards are required, including whether a transfer risk assessment is needed.

11. Data retention

We will only keep personal data for as long as is reasonably necessary for the purposes for which it was collected, including for the purposes of providing services, responding to enquiries, keeping business records, satisfying legal, regulatory, accounting or reporting requirements, and establishing, exercising or defending legal claims.

When deciding how long to keep personal data, we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether those purposes can be achieved by other means, and applicable legal requirements.

For tax and accounting purposes, we usually keep basic customer, transaction and financial records for six years after the end of the relevant financial year or after you stop being a customer, where applicable.

Because our work may involve children, SEND matters, EHCPs, complaints, appeals, tribunal matters, safeguarding issues and other sensitive case-related information, we may need to retain some records for longer where this is reasonably necessary. This may include where records are needed to deal with a continuing matter, respond to a complaint, evidence advice or support provided, comply with legal obligations, or establish, exercise or defend legal claims.

We may retain enquiry records for a shorter period where no services are purchased, unless we need to keep them for a legitimate business or legal reason.

In some circumstances, we may anonymise personal data so that it can no longer identify any individual. Where data has been properly anonymised, we may use it indefinitely for research, statistical, training, service improvement or business purposes.

12. Your legal rights

Under data protection laws, you may have rights in relation to your personal data. These may include the right to request access to your personal data, correction of inaccurate personal data, erasure of personal data, restriction of processing, transfer of personal data, objection to processing, and data portability. Where we rely on consent as our lawful basis, you also have the right to withdraw consent at any time.

You can read more about your rights on the ICO website here:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights

If you wish to exercise any of your rights, please email us at info@thesendconsultancygroup.co.uk.

You will not usually have to pay a fee to access your personal data or to exercise your other rights. However, we may charge a reasonable fee, or refuse to comply with a request, if your request is clearly unfounded, repetitive or excessive.

We may need to request specific information from you to help us confirm your identity and to ensure that personal data is not disclosed to someone who has no right to receive it. We may also ask you for further information to help us respond to your request.

We try to respond to all legitimate requests within one month. Occasionally, it may take longer than one month if your request is complex or you have made a number of requests. In that case, we will notify you.

Please note that some rights are not absolute. For example, we may not be required to erase personal data where we need to keep it to comply with a legal obligation or to establish, exercise or defend legal claims.

13. Data protection complaints

If you have a complaint about how we handle your personal data, including how we use AI tools in connection with personal data, you can contact us using the details below.

You can submit a data protection complaint by email at info@thesendconsultancygroup.co.uk.

You can also submit a complaint by post to:

The SEND Consultancy Group Ltd
Kent House
81 Station Road
Ashford
Kent
TN23 1PP

We will investigate your complaint without undue delay and will keep you informed about the progress of our investigation where appropriate. Once we have completed our investigation, we will let you know the outcome and explain our decision clearly.

If you are unhappy with how we have handled your complaint, you have the right to complain to the Information Commissioner’s Office. The ICO can be contacted at:

Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

The ICO will usually expect you to raise your complaint with us first so that we have an opportunity to investigate and respond.

14. Third-party links

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share personal data about you.

We do not control third-party websites and are not responsible for their privacy notices, policies or practices. When you leave our website, we encourage you to read the privacy notice of every website you visit.

15. Cookies

Our website may use cookies and similar technologies. Cookies are small files placed on your device that help websites function, improve user experience, remember preferences, analyse website usage and, where applicable, support advertising or marketing.

Some cookies are necessary for the website to work properly. Other cookies, such as analytics, advertising or tracking cookies, may require your consent.

You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of our website may become inaccessible or may not function properly.

For more information about the cookies we use, please see our cookie policy: https://thesendconsultancygroup.co.uk/cookie-policy/

16. Changes to this privacy notice

We may update this privacy notice from time to time to reflect changes in our services, use of AI tools, legal requirements, regulatory guidance, technology, providers or business practices.

Please check this page periodically for updates. Where we make material changes to the way we use personal data, we will take reasonable steps to bring those changes to your attention where required.