Please see our terms and conditions.

Team Up privacy notice – Schools, pupils, parents and guardians

1. About Team Up
   Team Up (we, us, our) is a registered charity (1151739) with a vision to raise the aspirations of children from low-income backgrounds. Our mission is to improve the educational outcomes of children from low-income backgrounds by delivering tuition using inspirational tutors.  2. Purpose of this privacy notice 

The current version of this notice is effective from 1st September 2026. This policy follows the regulations set out in the GDPR and the Data Protection Act 2018.  

This policy intends to make the following points clear to schools, pupils, parents and guardians about the information (data) we ask partner schools and organisations to share with us about pupils taking part in our programmes and the information we collect independently: 

• why we ask our partner schools to share information with us and why we collect some additional information independently (Section 3) 

• what information we ask partner schools to share with us and what information we collect independently (Section 4) 

• where we store the information and who can access it (Section 5) 

• how long we keep the information (Section 6) 

• what information we share with other parties (Section 7) 

• our legal basis for processing the information (Section 8) 

• security of personal information (Section 9) 

• transfers outside of the UK and the EEA (Section 10) 

• how to control your information and rights (Section 11) 

• how to contact us (Section 12) 

We have also produced a Team Up Parent/Guardian Letter for schools who may wish to distribute this to the parents/guardians of participating pupils, introducing what the Team Up sessions involve, and directing them to this privacy notice. This letter nevertheless provides parents an opportunity to inform their child’s school if they do not wish for them to take part in the Team Up sessions, or to inform us if they do not wish for their child’s sensitive information (e.g. ethnicity, EAL status) to be used for evaluation purposes. 

Where we introduce new technologies or partners that materially change how pupil data is processed (for example, AI-supported tools), we will update this notice and inform partner schools accordingly. 

3. Data Purpose – why we ask our partner schools to share information with us and why we collect some additional information independentlyTeam Up asks our partner schools to provide information about the pupils they put forward for participation in our tutoring programme, and we collect some additional information independently, for the following reasons: 

• to effectively coordinate the delivery of our programme both in-school and online; 

• to meet safeguarding responsibilities; 

• to enable the evaluation of our impact and improve future programme delivery; 

• to demonstrate how our programme reaches the pupils who need it as defined by our charity’s mission. 

Partner schools are usually the original source of pupil information and may act as data controllers when deciding which pupils are referred to Team Up and what information is shared. Once Team Up receives pupil information, Team Up may act either as a processor or as an independent controller, depending on how the information is used.  

Where Team Up processes information only to deliver the tutoring programme on behalf of a school, Team Up acts as the school’s processor. Where Team Up determines its own purposes for using the information, such as safeguarding, programme evaluation, service improvement, charitable impact reporting, governance, legal compliance, and funding evidence, Team Up acts as an independent controller. 

When sharing our data for charitable impact reporting, Team Up uses anonymised and aggregated information to evaluate programme effectiveness, suggest improvements to services and support funding applications. Information used for these purposes does not identify individual pupils. 

.4. Data Collection – what information we ask partner schools to share with us and what information we collect independently

Before a pupil officially joins our programme, we ask our partner schools to provide us with the following information about all pupils selected to take part, via a password-protected spreadsheet or email encryption software: full name, school, school year, gender, date of birth, subject ability, pupil premium status, SEN status (incl. SEMH needs), EAL status, parent/guardian media consent.  

For any pupils who do not have pupil premium status, we will ask for information regarding household income (general identifier), single parent household, care status, availability of public funding for family. This additional information will not be used on an individual basis and aggregated data may be used for particular areas or schools to secure funding for the programme.  

Where special category data is processed, Team Up relies on the relevant conditions under Article 9 UK GDPR, including substantial public interest and safeguarding of children and individuals at risk, where applicable. Optionally, the school may also choose to provide additional engagement-related guidance for our consideration.

During the programme, we will independently record: pupil attendance and engagement, pupil assessment results, pupil survey responses. In addition, we may collect quotes or interview comments on pupil experience which will be used in an anonymised format within impact reports, social media and internal reports.  

Any images that are collected throughout the course of the programme will be done so with written permission from guardians and school, as well as verbal permission from the young people involved.

For pupils who are accessing the tutoring sessions online via Microsoft Teams or an alternative school agreed platform, video recordings of tutoring sessions are made in order to quality assure our programme delivery and/or investigate potential safeguarding disclosures.

We may also request parent or guardian contact details from our partner schools in order to introduce ourselves to the parents/guardians of Team Up pupils, and to keep them updated on their child’s attendance where this is requested or deemed appropriate. 

Where AI-supported tutoring tools are used, Team Up may utilise approved AI providers including Microsoft Copilot (powered by OpenAI GPT models), Anthropic (Claude), Cohere (Command) and Google (Gemini) through Build Education’s platform. These providers are contractually prohibited from using pupil data to train their models and are subject to appropriate data processing and international transfer safeguards. 

AI-supported tools may be used to review pupil assessment data, learning activities and tutoring interactions in order to identify learning focus, support tutor preparation and generate educational feedback. Outputs generated by these tools are reviewed by Team Up tutors, staff and/or partner school staff, who remain responsible for all educational and safeguarding decisions relating to pupils.  

Team Up applies a data minimisation approach to all AI-supported processing. AI tools are only provided with the information required to generate educational responses and do not have access to: safeguarding records, SEN records, ethnicity data, health data or other special category personal data that could directly identify a pupil, except where this is necessary, lawful and subject to additional safeguards. 

 

5. Data Storage and Access – where we store the information and who can access itWe recognise that children’s personal data requires additional protection. We design our systems and services to minimise the collection and use of personal data and to ensure processing is proportionate to the educational purpose being delivered. 

We operate a central database, Salesforce, to help us securely store pupil and parent/guardian information. The database is password-protected with multi-factor authentication and access to the database is limited to Team Up staff, with ‘staff’ referring to employees and/or interns of Team Up who have undergone internal Data Protection and Privacy training, as well as a rigorous screening process. This does not include our volunteer tutors. We may also allow trusted third-party contractors to access systems for maintenance and development purposes. They are contractually bound to strict data protection obligations and will not use personal data for any other purpose. 

For recordings made of online tutoring sessions using Microsoft Teams, all video recordings are securely stored on a private Microsoft 365 SharePoint site. This site is accessible only to authorised Team Up personnel using password protection and multi-factor authentication.  

Should schools request an alternative platform be used, all video recordings will be securely stored on the designated school system and will only be accessible to authorised Team Up and/or Designated School Staff using password protection.  

For pupils who complete assessments or surveys online, their names, results and responses may be stored on the webform platform, a specifically designed website hosted by Build Education. The platform is password-protected with multi-factor authentication and access is limited to specific Team Up staff, including tutoring staff who will only be able to view specific and relevant assessment details for their designated pupils.

Information about pupils and their parents/guardian may also be briefly recorded in other formats, such as in emails, word processing and spreadsheet applications. Information in these formats may be temporarily stored on Team Up devices or in Microsoft 365 applications such as our M365 SharePoint cloud storage until it has been uploaded to Salesforce, at which point all other copies will be deleted. Access to these devices and cloud applications is password-protected and restricted to Team Up staff. Team Up M365 SharePoint is routinely reviewed to ensure that no sensitive or identifiable data is stored beyond its usage. 

Where AI-supported tools are used, pupil data may be processed by carefully selected third-party technology providers. These providers are subject to strict contractual controls, including confidentiality obligations, security requirements, and restrictions on how data can be used. 

6. Retention – how long we keep the information

We work to ensure that your personal data is only retained for the period that Team Up needs it for, or in accordance with laws, regulations and professional obligations that we are subject to set out in GDPR and the Data Protection Act 2018.  

Pupil and parent/guardian records on our central database, Salesforce, and our assessment platform, hosted by Build Education, which contain information provided by our partner schools, alongside additional information we have captured independently, are anonymised two years after the data was first uploaded onto our systems. This involves removal of all information from a record which could be used to identify an individual pupil and/or their parent/guardian. This process can only be reversed by specific members of the Team Up team and only under reasonable circumstances, such as to facilitate a safeguarding enquiry. Where written transcripts of assessment, surveys, or tutoring sessions pertaining to pupil data are generated, these are retained for the limited two-year period and securely deleted or anonymised as detailed above. We also require third-party providers supporting these services to limit retention and not store pupil or parent data for longer than is necessary to deliver the service.

Video recordings of online tutoring sessions completed on Microsoft Teams are kept for approximately 1 month from the time of sessions, after which they are deleted. In cases of safeguarding incidents, we will download the video and store it within a restricted access folder (that only the Designated and Deputy Designated Safeguarding Leads can access) on the M365 SharePoint in order to support investigations. After which, we may keep the recording for up to 10 years, depending on the severity of the incident. 

Video recordings of online tutoring sessions completed on another school designated platform will be kept in line with individual school retention policies.  

Our best practice for any pupil and parent/guardian information temporarily stored in other formats, such as word processing or spreadsheet applications, is to delete this information as soon as the purpose for processing the information in the alternative format is complete. 

Anonymised pupil records on our central database and any related parent/guardian information are deleted 10 years after the data was first uploaded. This deletion cannot be reversed. 

Pupil records on our central database may be stored for longer if they relate to a reported safeguarding concern.  

Images of our tuition programmes will be stored unless consent is withdrawn for marketing purposes but will be stored with no identifying information and only with written permission from guardians and schools who have been made aware of Team Up’s privacy policy.  

If you would like to find out how long any other information is being retained, please contact us via the details provided in section 12 of this policy. 

7. Data sharing – what information we share with other partiesThe following information about pupils may be shared with specific tutors before and during the programme to help them tailor their tutoring sessions: full name, school, school year, gender, subject ability, assessment results, attendance and engagement notes, and any other information the pupil’s school has voluntarily provided to us which is deemed relevant for the tutor to be made aware of.

   After a pupil has completed the programme, the following information may be shared with tutors, but only in relation to those pupils they directly supported: assessment results from final assessment, survey feedback. This is to support the purpose of tutors providing and receiving effective feedback to support pupils in their academic development. 

We may also share pupil data with carefully selected technology providers who support the delivery of our services (for example, secure hosting providers and AI-supported tools). These organisations act as data processors on our behalf and are contractually required to: 

• only process data on our instructions 

• implement appropriate security measures 

• not use pupil data for their own purposes (such as training AI models) 

We ensure appropriate data sharing agreements are in place with all such providers.

On certain programmes, pupil data may be shared with third parties who are involved in the evaluation or delivery of the programme in the form of reports, such as other charity and widening participation partners. In these cases, identifying pupil data such as surnames will be removed. Each partner has a specific data sharing agreement drawn up in our contract (including with school partners). Where third party data sharing is necessary, further information will be shared with stakeholders regarding the data protection and privacy policies of each partner and the sharing agreement in place with specific reference to what data is collected, how it is stored/shared, and for how long it will be retained. In addition, data sharing consent will be sought from the school partners and/or parents/guardians before any pupil/parent data is shared.

Anonymous and aggregated data relating to pupils may be published on the Team Up website and used in published materials, such as Team Up’s reports for funders. 

8. Legal basis – our legal basis for processing the informationTo lawfully process the information outlined in this notice, we may rely on:

   Legitimate interests:The legitimate interest in collecting and sharing specific pupil/parent data is to: 

• Enable the effective administration, monitoring and reporting of Team Up programmes to the data controller, where such programmes directly support academic progression and social mobility in the South of England.
• Enable Team Up, as data processor, to monitor, evaluate and report on the wider impact of its programmes across the demographic and educational backgrounds of its beneficiaries, using anonymised or aggregated data wherever such reporting is undertaken.
• Enable Team Up, as data processor, to evidence programme need, delivery and outcomes for the purposes of securing and maintaining appropriate funding to support the programme and its continued effectiveness.

Where we use new technologies (including AI-supported tools), we ensure that such processing remains compatible with the purposes outlined in this notice and is supported by our lawful basis. We conduct assessments to ensure that our use of personal data is necessary and proportionate. 

Legal obligation: where we may need to use or share information we hold about pupils or their parents/guardians in order to comply with a legal obligation, such as to facilitate the investigation of a safeguarding concern with a local authority.

Consent: in order to facilitate any additional processing of information beyond that which is outlined in this privacy notice e.g. photographs, we will seek consent from the relevant individuals in order to do so. 

9. Security of personal informationWe take the responsibility for protecting your privacy very seriously and we will ensure your data is secured in accordance with our obligations under the Data Protection laws. We have in place technical and organisational measures to ensure personal information is secured and to prevent your personal data from being accessed in an unauthorised way, altered or disclosed. We have in place a robust access control policy which limits access to your personal data to those employees, contractors and other third parties who only have a business need to know. The processing of your personal data will only take place subject to our instruction.

   We have procedures to handle any potential data security breaches. Data subjects, third parties and any applicable regulators will be notified where we are legally required to do so. If you become aware of a potential data breach involving your personal data, please contact us immediately using the details provided at the end of this notice. 

Additional safeguards are applied where higher-risk technologies, such as AI supported tools, are used. These include minimising the amount of data shared, restricting access to sensitive information, and ensuring providers meet strict data protection and security standards.

10. Transfers outside of the UK and, where relevant, the EEA

In this section, we provide information about the circumstances in which your personal data may be transferred and stored in countries outside the European Economic Area (EEA). 

We may transfer personal data outside of the UK in limited circumstances where this is necessary to deliver our services.  

Where AI-supported tools or other technology providers are used, pupil data may be transferred to organisations located outside the UK (including in the United States and Canada) in order to generate responses or provide technical services.  

In all such cases, we ensure that appropriate safeguards are in place, which may include:  

• the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) 
• Standard Contractual Clauses 
• the UK International Data Transfer Agreement (IDTA) 

We also take steps to ensure that only the minimum necessary data is shared and that it is protected to a high standard.

For more information about transfers and safeguarding measures, please contact us using the information in section 12.

11. How to control your information and your rights

Team Up is committed to accommodating your rights under the General Data Protection Regulation, which include: 

• Your right to be fully informed on how the information we ask you to share with us and the information we collect independently is processed by Team Up. If you have any questions about the guidance provided in this policy notice, or would like further detail on specific sections, then please address your query to the contact details provided below. 

• Your right to access the information we have asked you to share with us and the information we collected independently. If you require a copy of this information, please make this request using the contact details provided in this notice and the information will be provided to you in an electronic format as soon as possible, within one month at the latest. We will need to confirm your identity to provide this information. 

• Your right to rectify the information we have asked you to share with us and the information we collected independently if it is inaccurate or incomplete. If you believe that any of the information is inaccurate or incomplete, please contact us as soon as possible using the contact details provided below. We will promptly correct any information found to be incorrect. 

• Your right to erase the information we have asked you to share with us and the information we collected independently. You may request that this information be placed under restricted access, anonymised or deleted where there is no compelling reason for it to be kept. However, we may need to retain some information as stated in Section 6. Retention – how long we keep the information. 

• Your right to restrict or object to the further processing of the information we have asked you to share with us and the information we collected independently. Please use the contact details provided to inform us of any wish to restrict or object to the further processing of this information. Note that we may need to retain some key information in order to respect your restriction or objection in future. 

We do not use personal data to make solely automated decisions that have legal or similarly significant effects on individuals. However, some aspects of our tutoring services may involve automated processing (for example, AI-supported responses or assessment marking during sessions). These systems are used to support educational delivery and are subject to human oversight. 

12. How to contact us 

To contact us in relation to any of the information contained in this policy notice, to make a complaint, to pursue any rights under the General Data Protection Regulation and to contact our DPO, please email: aurora.wright@teamup.org.uk

Telephone: 07547 666523

If you are unhappy with the way that we have handled your Personal Information, you can make a complaint to the Information Commissioner’s Office (ICO) which is the UK authority responsible for data protection.