Privacy Policy

PRIVACY NOTICE

This privacy notice describes how Thames Christian School (‘the School’ or ‘we’) collects and uses your personal data.
Personal data is information about you from which you can be identified (either directly or indirectly).

We are a “controller”. This means that we are responsible for deciding how and why we hold and use personal data about you, and for explaining this clearly to you.

This notice applies to:

users of our website thameschristianschool.org.uk (our site); and
any person who provides services to us – either as an individual or as the employee or representative of a supplier to the School.

It is important that you read this notice, together with any other privacy information or notices we may provide on specific occasions when we are collecting or processing personal data about you. This is to help ensure that you are aware of how and why we are using such information.

This privacy notice should be read in conjunction with our cookies policy which can be found below.
For information about how the School uses personal data in connection with the provision of education, and in connection with the School’s commercial activities – please see the following: thameschristianschool.org.uk/policies.

Information we collect and process

We collect personal data directly from you when you enquire about our products and services, when we establish you as a customer where we enter into a contract to receive goods or services from you or your employer or when you use our site. We may also get information from your employer or colleagues, for example, when your employer asks you to carry out work for us.

We collect further personal data from you during the period of our relationship.
In summary, we use your personal data for the following purposes:

to carry out obligations arising from any contracts between us and you, with our customers, with suppliers, or with third parties;
to communicate with you, including to provide you with information, products or services; and
where it is necessary for our business or activities or our customers’ business.

We set out below further information on these purposes and our lawful basis for processing such information.

Suppliers, third party business contacts and prospects:

We process names, job titles and business contact information including addresses, telephone numbers and email addresses for you and your employees and representatives and other information for our legitimate interest in maintaining and managing our relationship with you. If we have a contract with you as an individual, such processing is necessary for the performance of the contract between us, or if you ask us to do something prior to entering into a contract.
Where you are an employee or representative of a customer or contractor, we process this information for the legitimate interest of performing our contract with your employer.
If there is a problem, for example, if we have a complaint about a service you have provided then we have a legitimate interest in using personal data in connection with that complaint, for example, so that we can tell you what happened so that you can put things right.
We may perform due diligence on those we work with. This can include in the form of credit checks, including checking photographic identification and proof of address of directors and, in some cases, your shareholders, and verification of registration details. We do this to comply with our legal obligations, and as necessary for our legitimate interests of checking that the entities we contract with are financially viable and would not cause us reputational damage.

Users of our site:

When you browse our site we may collect information about your preferences.
We also collect technical information, including the Internet Protocol (IP) address used to connect your computer to the internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
We also collect information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); pages you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call us.
These uses are for our legitimate interest in giving you content which is bespoke to you and making sure that our website runs smoothly.

Other uses

Regardless of the relationship we have with you, we may need to use your personal data for legal reasons such as fraud prevention and to check that you are complying with our terms and conditions and to enforce our legal rights. We have a legitimate interest in doing this unless we are under a legal obligation.
Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.
We may contact you about our products and services by email, telephone, post or by text message but we will only do this where we are allowed to under data protection law. If you tell us that you do not want to be contacted for any of these purposes then we will of course respect that. We will rely on our legitimate interest in marketing our products and services to you unless we need your consent before contacting you for these reasons. If you give us your consent then you have a right to withdraw that consent at any time. You can withdraw your consent by contacting us at dpcm@thameschristianschool.org.uk. Any use of your personal data before you withdraw consent remains valid.
We may monitor your use of our IT systems (including our wi-fi) when you visit us. This is to comply with our safeguarding obligations as a School which means that our lawful basis is public task.

How we use artificial intelligence

We use AI-powered tools on our website and in our communications to help us respond to enquiries quickly, support our admissions and marketing activity, and improve the service we provide. These tools are supplied to us by InnerMedia Limited (ICO registration ICO:00010252104), our digital marketing partner, who acts as our data processor.

What you should know when you interact with our AI tools

When you use a chat tool, enquiry form or other interactive feature on our site that is powered by AI, you will see a clear indication that you are interacting with an AI assistant rather than a member of our team. Your conversation will be stored securely so that we can review the quality of responses and improve the service. You can ask to speak to a human at any point.

The AI model we use

The AI is powered by Anthropic’s Claude large language model, accessed through Amazon Web Services (AWS) Bedrock. All processing takes place inside the AWS environment within UK or EU regions. Your data is not transmitted to Anthropic’s own systems, and Anthropic has no access to it.

What we commit to

Your data will never be used to train any AI model, ours or anyone else’s.
Your data will never be shared with other organisations using InnerMedia’s AI tools.
Your data will never be used for advertising or profiling.
Your data will never be transferred outside the UK or EEA without your explicit consent.

Conversation data is retained for a maximum of 360 days, after which it is automatically deleted, unless you ask us to delete it sooner.

Security

All data processed by our AI tools is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher), held in logically isolated storage, and accessible only to authorised personnel using multi-factor authentication.

Sub-processors

The following third parties may process data in connection with our AI tools. All are contractually bound to maintain appropriate data protection standards:

Sub-processor	Role
Amazon Web Services (UK/EU)	Cloud infrastructure, storage and AI inference platform
Anthropic (via AWS Bedrock)	Large language model — data does not leave the AWS environment
WordPress / Automattic	Website content management
SendGrid (Twilio)	Email delivery
Google Analytics & Tag Manager	Website analytics
Meta Platforms	Advertising pixel (where enabled)
Google Ads	Conversion tracking (where enabled)

We will give at least 30 days’ notice of any change to this list.

Human oversight

Our AI tools support our team — they do not replace it. No decision relating to admissions, safeguarding, pastoral care, staff matters or financial commitments is taken by AI alone. A named member of our staff is responsible for reviewing AI activity and handling any concerns.

Children and young people

Because we work with children and young people, we apply additional protections to any AI interactions that may involve under-18s:

Conversation data involving children is automatically deleted after a maximum of 360 days.
Children’s data is never used for AI model training, advertising or profiling.
Our AI tools are configured to avoid asking children for sensitive personal information.
All AI use involving pupils is supervised by a named member of staff in line with our safeguarding policy and the ICO’s Age Appropriate Design Code.

If you are a parent or guardian and have any questions about how AI is used in relation to your child, please contact dpcm@thameschristianschool.org.uk.

Sharing your personal data

We may share your personal data with third parties as follows:

We will share your personal data with third parties where required by law, where necessary for our public tasks, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so. This includes sharing personal data with government and with regulators.
If ever in the future, we are considering restructuring the charity which operates the School, we may share your personal data with the other parties involved and with the relevant professional advisors. This is for our legitimate interest in ensuring that the charity continues to fulfil its objects.
If we have a legal obligation to do so or for the purposes of fraud protection and credit risk reduction.
We may share your personal data with third party service providers who act on our behalf such as IT services providers. This notice also covers third party service providers we may engage with.

We may share your personal data with any of the representatives or advisors of any of the third parties mentioned in this privacy notice. Anyone that we share information with may give us information about you as well.

Overseas transfers

Your personal data will not be transferred outside of the UK.

How long will we use your personal data for?

Usually, we only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

If you have a contract with us then we will typically keep information for six or twelve years after the contract is finished. This does not apply to our contract with parents to educate their child.

In some cases we may keep your personal data for a longer time than usual but we would only do so if we had a good reason and only if we are allowed to do so under data protection law. For example, because we are a School we may need to keep information for longer (and in some cases indefinitely) to help us comply with our legal and safeguarding obligations. If you would like further information, please contact us at dpcm@thameschristianschool.org.uk.

Your rights in relation to our processing of your personal data

You have the right to:

object to the processing of your personal data in some cases. You have a right to object if we are using it for direct marketing purposes (e.g. to send you an email about a product). You also have a right to object if the lawful basis on which we are relying is either legitimate interests or performance of a task carried out in the public interest;
request a copy of the personal data we hold about you;
request correction of the personal data that we hold about you if it is incorrect or incomplete;
ask us to delete the information that we hold about you;
ask us to restrict how we use your personal data in certain circumstances;
you can request the transfer of your personal data to you or to a third party in a format that can be read by computer in certain circumstances.

Regarding the use of AI you have the right to:

Confirm what data we hold about your interactions
Delete your conversation history
Opt out of having your interactions stored (this may limit some features)
Provide a copy of your data

If you are unhappy about the way in which we have handled your personal data you may follow the Data Protection Complaints Procedure to make a complaint directly to the school. The Data Protection Complaints Procedure can be found at Thames Christian School – Data Protection. If you are not satisfied by the response of the school, the procedure shows you how to lodge a complaint with the Information Commissioner’s Office (ico.org.uk).

Thames Christian School is a company limited by guarantee. Registered in England and Wales: Company Number 3986193. Registered Office: 8-10 South Street, Epsom, KT18 7PF

LINKS TO OTHER WEBSITES

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.