Brilliant Bricks UK Limited customer privacy notice

We collect or use the following information for student education and welfare:

• Names and contact details for students/children

• Names and contact details for parents, guardians, carers

• Date of birth

• Dietary requirements (including vegetarian, vegan, gluten free and religious requirements)

• Payment details and financial information including transactions

• Special Educational Needs and Disabilities (SEND) or additional support information (includes reasonable adjustments and special educational needs and disabilities)

We also collect or use the following special category information for student education and welfare. This information is subject to additional protection due to its sensitive nature:

• Health information

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details

• Purchase or service history

• Witness statements and contact details

• Correspondence

• Special Educational Needs and Disabilities (SEND) or additional support information (includes reasonable adjustments and special educational needs and disabilities)

We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

• Health information

We collect or use the following information for information updates or marketing purposes:

• Names and contact details

• Marketing preferences

• Website and app user journey information

• Records of consent, where appropriate

We collect or use the following information for recruitment purposes:

• Contact details (eg name, address, telephone number or personal email address)

• National Insurance number

• Copies of passports or other photo ID

• Employment history (eg job application, employment references or secondary employment)

• Right to work information

• Details of any criminal convictions (eg DBS, Access NI or Disclosure Scotland checks)

Our lawful bases for collecting or using personal information for student education and welfare are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

• • We collect and use personal information to provide our educational activities and childcare services, ensure children’s safety and wellbeing, manage bookings and memberships, and meet our legal responsibilities (such as safeguarding). Our lawful bases include: • Contract – to deliver services you’ve requested • Legitimate interests – to run and improve our services • Legal obligation – where safeguarding or regulatory duties apply • Consent – for things like photos or optional communications If we need to collect health or SEND-related information, we do so with your explicit consent or where necessary to protect a child’s health or wellbeing.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
• We collect and use personal information to respond to questions, resolve complaints, and manage safeguarding or legal concerns. Our lawful bases include: • Legitimate interests – to manage and improve our services • Legal obligation – where safeguarding or legal duties apply • Contract – if the issue relates to a service you’ve booked • Vital interests – if someone is at risk and we need to act quickly If a concern includes sensitive information (such as health or SEND needs), we process that with your explicit consent or where necessary to protect someone’s wellbeing.
• Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for information updates or marketing purposes are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

• • We may use your contact details to send you updates about our services, such as new clubs, membership offers, or events. We do this: • With your consent – when you sign up to hear from us (for example, via our website or waitlist) • Under legitimate interests – if you’re an existing customer and we’re telling you about similar services You can unsubscribe at any time using the link in our emails or by contacting us. We do not use health or SEND information for marketing purposes. If we use customer data for targeted advertising (like Facebook custom audiences) in future, we will update our privacy notice and ensure it meets data protection rules.

Data Type

 Purpose

Retention Period

 Justification

Child registration forms (including contact & medical info)

 Safe delivery of services and safeguarding

Until end of child’s participation + 1 year

Allows time for dispute resolution and continuity for repeat customers

Health/SEND info (e.g. allergies, additional needs)

Ensure safety and appropriate support during sessions

Until end of activity/booking + 1 year

Minimise holding sensitive data beyond need

Safeguarding records or incident reports

Legal duty to retain child protection records

Until the child turns 25

Based on NSPCC and government safeguarding guidance

Booking & payment records (parents)

Service delivery, account management, legal recordkeeping

6 years

Required for tax/audit purposes (per HMRC)

Email marketing consent records

Track lawful basis for contacting individuals

Until unsubscribed or 2 years after last engagement

Demonstrates consent & helps maintain a clean list

Customer queries or complaints

Service monitoring, legal defence, or safeguarding

3 years

ICO-recommended minimum unless linked to safeguarding

Photos/media (with consent)

Marketing or parent engagement

2 years, unless used in ongoing marketing

Review annually; delete if no longer used or consent withdrawn

Membership or club attendance records

Track participation and manage capacity

3 years

Operational reference; can be anonymised after 1 year