Privacy Policy
STEMRAN Limited
Version 2.1 · Effective 11 September 2026
Supersedes Privacy Policy v2.0, effective 11 June 2026
Review date: 11 September 2027, or earlier following any legal, contractual, processor, system, or service-delivery change
Approved by: Director / Data Protection Lead
Data Protection Lead: Stella Cunningham, Director · info@stemran.co.uk
1. Who we are
STEMRAN Limited (“STEMRAN”, “we”, “us”, “our”) is an education and employability provider delivering tutoring, training, and employability services to schools, local authorities, adult learners, and employability clients across the United Kingdom.
Company number: SC810105 (registered in Scotland)
Registered office: 16 New Inchinnan Road, Paisley, PA3 2PP
Website: stemran.co.uk
Telephone: 07465 276146
Email: info@stemran.co.uk
For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, STEMRAN Limited is the data controller for the personal data described in this policy, except where we act as a processor or joint controller under a specific contract or data sharing agreement with a school, local authority, funder, or awarding body. Where our role differs under a particular contract, this is defined in that contract or the associated information sharing agreement.
Our Data Protection Lead is Stella Cunningham, Director. All data protection enquiries, requests, and complaints should be directed to info@stemran.co.uk or in writing to the registered office address above.
2. Who this policy covers
This policy explains how we collect, use, share, retain, and protect personal data relating to:
- Pupils referred to us by schools or local authorities, and their parents and carers
- Adult learners registering for our courses and tutoring programmes
- Employability clients receiving employability support services
- Enquirers who contact us by email, telephone, or post
- Website visitors to stemran.co.uk
- Referral partners, school and local authority contacts with whom we correspond in the course of service delivery
Our website does not collect enquiries through online forms. All enquiries reach us by email, telephone, or post. A separate Cookie Policy explains our use of cookies and similar technologies on the website.
3. The personal data we collect
We collect only the data necessary for the purpose for which it is processed. Depending on your relationship with us, this may include:
All categories
- Name, date of birth, address, and contact details
- Records of correspondence with us
Pupils referred by schools or local authorities
- School, year group, and referral source
- Attendance information and attendance concerns
- Attainment and progress data
- Behavioural information relevant to safe and effective delivery
- Safeguarding information, where a safeguarding concern exists
- Parent and carer names and contact details
- Emergency contact details
Adult learners
- Course or programme details
- Eligibility and funding information
- Attendance, assessment, and outcome records
- Support needs and learner support notes
- Emergency contact details
- Signed declarations
Employability clients
- Employment status and education or training history
- Benefit or funding eligibility information
- Barriers to employment
- Action plans, progress reviews, and outcomes
- Employer engagement and referral notes
Special category data, where required
- Health, accessibility, and disability information needed for safe delivery and reasonable adjustments
- Special educational needs and additional support needs information
- Free school meal status, where supplied for funding or eligibility purposes
- Safeguarding and vulnerability information
Enquiry and website data
- Information you provide when you contact us by email, telephone, or post
- Marketing preferences, where you ask us in writing to add you to a mailing list
- Technical data recorded by our hosting provider when you use the website, including IP address, browser type and version, operating system, and pages visited, used to operate and secure the website
We do not collect more data than we need, and we do not retain data “just in case.”
4. How we collect your data
We receive personal data through:
- Referrals from schools, local authorities, and referral partners
- Registration forms completed on paper or returned to us by email
- Direct correspondence with us by email, telephone, and post
- Funding and eligibility evidence supplied by you or by a referring or commissioning body
- Assessment, attendance, and delivery records created during our services
- Parents and carers, where the learner is a child
5. Why we process your data and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Registering you and delivering tutoring, education, or employability services | Article 6(1)(b) — contract |
| Delivering services commissioned by a local authority or school | Article 6(1)(e) — public task, and/or 6(1)(b) — contract |
| Meeting safeguarding obligations for children and adults at risk | Article 6(1)(c) — legal obligation |
| Maintaining funding, eligibility, and audit evidence required by funders, local authorities, and awarding bodies | Article 6(1)(c) — legal obligation, and/or 6(1)(b) — contract |
| Reporting outcomes to commissioning councils, schools, funders, and awarding bodies | Article 6(1)(c) / 6(1)(e) / 6(1)(b) as applicable |
| Responding to enquiries and managing our business administration | Article 6(1)(f) — legitimate interests |
| Sending marketing communications; using photographs, video, or testimonials | Article 6(1)(a) — consent |
Where we process special category data, such as health, support needs, or safeguarding information, we rely on the following conditions in addition to a lawful basis:
- Article 9(2)(g) — substantial public interest, with the relevant conditions in Schedule 1 of the Data Protection Act 2018, including safeguarding of children and individuals at risk, equality of opportunity or treatment, and support for individuals with particular needs
- Article 9(2)(h) — provision of health or social care style support, where relevant to duty-of-care data
- Article 9(2)(a) — explicit consent, only where no stronger condition applies
Consent is used only where processing is genuinely optional, for example marketing communications and photography or media use. Consent can be withdrawn at any time by contacting us. Withdrawal does not affect processing already carried out, and does not affect processing we carry out on another lawful basis. Acknowledgement of this Privacy Policy on a registration form is not consent; it confirms that privacy information has been provided to you.
6. Who we share your data with
We share personal data only where necessary, and only the minimum required:
- Schools and local authorities that refer pupils or commission our services, for delivery, attendance, progress, and outcome reporting under contract or information sharing agreement
- Funders and awarding bodies, including SQA where applicable, for registration, certification, verification, and audit
- Statutory agencies, where required by law or where a safeguarding concern necessitates disclosure
- Professional advisers, where we need legal, accounting, or insurance advice
We also use service providers who process data on our behalf under written contracts compliant with Article 28 UK GDPR, currently:
- Krystal Hosting Ltd — domain, email, and website hosting (United Kingdom)
- Google — cloud storage and secondary email services
We do not sell personal data, and we do not allow our processors to use your data for their own purposes. Where any processor stores or processes data outside the UK, we ensure appropriate safeguards are in place, such as a UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or an adequacy decision, including the UK Extension to the EU–US Data Privacy Framework where applicable.
7. How we keep your data secure
We apply technical and organisational measures proportionate to the risk, including:
- Storage on approved systems only, with role-based, need-to-know access
- Restricted access to safeguarding records, limited to senior and authorised staff
- Strong passwords and multi-factor authentication where available
- Encryption in transit and at rest
- Secure transfer methods for data exchanged with schools, councils, and funders
- No use of unmanaged personal devices for personal data unless explicitly authorised and secured
- Staff confidentiality obligations and data handling declarations
- Encrypted rolling backups retained for a maximum of 90 days
- Prompt removal of access when staff leave or change role
- Annual access reviews and annual policy review
- A documented data breach procedure, including assessment against the ICO’s 72-hour notification threshold and contractual notification to commissioning bodies where required
If you suspect any misuse, loss, or unauthorised access to your data, contact us immediately at info@stemran.co.uk.
8. How long we keep your data
We keep personal data no longer than necessary, but long enough to meet safeguarding, funding, audit, legal, and contractual obligations. Key retention periods include:
| Data | Retention period |
|---|---|
| Pupil referral, attendance, attainment, and behavioural records | End of academic year or service + 7 years |
| Safeguarding records — children | Until the individual reaches age 25 |
| Safeguarding records — adults | 7 years from incident or case closure |
| SEN/ASN and health information | End of service + 7 years |
| Free school meal status | End of funding year + 3 years |
| Adult learner registration, funding evidence, attendance, and outcomes | End of funding year or service + 6 years |
| Assessment and qualification evidence | Awarding body audit window; 6 years where publicly funded |
| Contracts, data sharing agreements, and council reports | End of contract or agreement + 6 years |
| General operational emails | Last action + 3 years |
| Enquiries received by email, telephone, or post that do not proceed | Last contact + 12 months |
| Mailing list data | Until unsubscribe, or 24 months of inactivity |
Where a local authority contract, funder, or awarding body mandates a longer retention period, that period applies. Safeguarding retention overrides ordinary service retention. A full Data Retention Schedule is available on request.
When retention expires, data is securely deleted, anonymised, returned, or destroyed by cross-cut shredding or certified confidential destruction for paper records, and disposal is logged. Deleted data may persist temporarily in encrypted backups but ages out automatically within the 90-day backup cycle.
9. Your rights
Under the UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — have inaccurate or incomplete data corrected
- Erasure — request deletion of your data, where applicable
- Restriction — limit how we use your data in certain circumstances
- Objection — object to processing based on legitimate interests or public task
- Portability — receive your data in a portable format, where applicable
- Withdraw consent — at any time, where consent is the basis for processing
To exercise any right, contact Stella Cunningham, Data Protection Lead, at info@stemran.co.uk or by post to the registered office. We will verify your identity and respond within one calendar month. For complex requests this may be extended by up to two further months, and we will tell you if so. Some rights are qualified — for example, we may be unable to erase data we are legally required to retain for safeguarding, funding, or audit purposes — and we will explain any refusal.
10. Children’s data
Where we process data about children, we do so under referral and commissioning arrangements with schools and local authorities, with appropriate parent and carer involvement. Registration of a child requires a parent or carer declaration. Privacy information is provided in age-appropriate terms where practicable. Safeguarding obligations take priority over all other processing considerations.
11. Complaints
If you are unhappy with how we have handled your data, please contact us first at info@stemran.co.uk so we can try to resolve the matter. You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Changes to this policy
We review this policy at least annually and after any significant legal, contractual, processor, system, safeguarding, or service-delivery change. The current version is always available on our website. Material changes will be highlighted on the website and, where appropriate, notified directly to affected individuals or commissioning bodies.
STEMRAN Limited · SC810105 · 16 New Inchinnan Road, Paisley, PA3 2PP · info@stemran.co.uk · 07465 276146