Data Protection Policy

Consolidated Version 2026

1. Purpose

LB Education Services Ltd t/a Class People (“Class People”) is committed to protecting the privacy, confidentiality, integrity and security of personal data.

This Policy explains how Class People complies with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other applicable privacy and data protection laws in connection with its recruitment, employment and business activities.

This Policy applies to all directors, employees, consultants, temporary workers and contractors who process personal data on behalf of Class People.

2. Data Protection Principles

Class People processes personal data in accordance with the following principles:

2.1 Lawfulness, Fairness and Transparency

Personal data will be processed lawfully, fairly and transparently.

Individuals will be informed about how their personal data is collected, used, stored and shared through privacy notices and other communications.

2.2 Purpose Limitation

Personal data will only be collected for specified, explicit and legitimate purposes and will not be further processed in a manner incompatible with those purposes.

2.3 Data Minimisation

Class People will only collect personal data that is adequate, relevant and limited to what is necessary for the purposes for which it is processed.

2.4 Accuracy

Reasonable steps will be taken to ensure that personal data remains accurate and, where necessary, kept up to date.

Inaccurate or incomplete data will be corrected or deleted without undue delay.

2.5 Storage Limitation

Personal data will not be retained for longer than is necessary.

Retention periods are governed by Class People’s Data Retention Policy and Data Retention Schedule.

2.6 Integrity and Confidentiality

Personal data will be processed securely using appropriate technical and organisational measures to protect against unauthorised or unlawful processing, accidental loss, destruction or damage.

2.7 Accountability

Class People is responsible for and must be able to demonstrate compliance with data protection legislation.

Appropriate records, policies, procedures, training and audits will be maintained to support compliance.

3. Roles and Responsibilities

Data Controller

LB Education Services Ltd t/a Class People acts as Data Controller in respect of personal data processed in connection with its recruitment and employment activities.

Senior Responsible Owner

Managing Director

Data Protection Lead

Naomi Howells

Email: compliance@classpeople.co.uk

Staff Responsibilities

All staff must:

• comply with this Policy;

• protect personal data;

• complete data protection training;

• report suspected data breaches immediately; and

• cooperate with compliance investigations and audits.

4. Personal Data Processed

Class People may process personal data relating to:

• candidates and workers;

• clients and client contacts;

• employees;

• contractors;

• suppliers;

• website users;

• prospective customers and marketing contacts.

Data may include:

• names and contact details;

• CVs and employment histories;

• qualifications and references;

• right to work documentation;

• payroll information;

• safeguarding information;

• DBS and criminal offence data (where lawful);

• correspondence and communication records.

5. Lawful Bases for Processing

Class People processes personal data under one or more lawful bases, including:

• performance of a contract;

• compliance with legal obligations;

• legitimate business interests;

• consent (where required);

• protection of vital interests;

• substantial public interest grounds where applicable.

6. Special Category and Criminal Offence Data

Class People may process special category data and criminal offence data where permitted by law and where appropriate safeguards are in place.

This may include information required for:

• safeguarding;

• education recruitment;

• DBS checks;

• regulated activity;

• employment obligations;

• legal and regulatory compliance.

Class People maintains an Appropriate Policy Document (“APD”) in accordance with Schedule 1 of the Data Protection Act 2018.

7. Data Subject Rights

Individuals have the right to:

• access their personal data;

• rectify inaccurate data;

• erase personal data where appropriate;

• restrict processing;

• object to processing;

• data portability;

• withdraw consent where processing relies on consent.

Requests should be directed to:

compliance@classpeople.co.uk

Requests will be handled within applicable statutory timescales.

8. Security Measures

Class People implements appropriate technical and organisational security measures including:

• access controls based on individual user accounts, with access limited to authorised staff who require the information for their duties;

• multi-factor authentication where available;

• encryption in transit;

• password management controls;

• secure storage of candidate records and documentation in Salesforce, including the Notes and Attachments section of each candidate card;

• secure disposal procedures;

• periodic access reviews;

• business continuity arrangements;

• incident response procedures.

All Class People consultants, compliance staff and managers are authorised to access candidate records in Salesforce where reasonably required for recruitment, safeguarding, placement, compliance or management duties. Staff must access and use personal data only for legitimate business purposes and must not store candidate information on personal devices, personal email accounts or other unauthorised systems.

9. Records of Processing Activities

Class People maintains Records of Processing Activities (“RoPA”) as required by applicable legislation.

These records include:

• processing purposes;

• categories of data subjects;

• categories of personal data;

• recipients;

• retention periods;

• security measures.

10. Data Protection Impact Assessments

Data Protection Impact Assessments (“DPIAs”) will be undertaken where processing activities are likely to result in a high risk to the rights and freedoms of individuals.

11. Data Retention

Personal data shall be retained in accordance with the Class People Data Retention Policy and Data Retention Schedule.

At the end of the applicable retention period, data shall be securely deleted, anonymised or destroyed unless there is a lawful basis for continued retention.

12. Data Processors and Third Parties

Where third parties process personal data on behalf of Class People:

• appropriate due diligence will be undertaken;

• written data processing agreements will be implemented;

• processors will be required to maintain appropriate security standards.

13. Data Breaches

Any actual or suspected personal data breach must be reported immediately to the Data Protection Lead.

Class People will investigate all breaches and, where required:

• notify the Information Commissioner’s Office within the required timeframe; and

• notify affected individuals.

14. Marketing and Electronic Communications

Marketing activities will be carried out in accordance with UK GDPR and the Privacy and Electronic Communications Regulations (“PECR”).

Marketing communications will include appropriate opt-out mechanisms.

Marketing preferences will be respected and recorded.

15. Training and Awareness

All existing staff will complete data protection and information security training once this revised Policy is approved. New starters will complete this training as part of induction.

Training will be refreshed annually through Flick Learning or another approved training platform. Additional role-specific training may be provided for staff handling safeguarding, DBS or other sensitive information.

Training records will be retained prospectively by Class People.

16. Monitoring and Review

Compliance with this Policy will be monitored periodically through reviews, audits and management oversight.

This Policy shall be reviewed annually or sooner where required by changes in legislation, regulatory guidance or business operations.