Privacy Notice
Happy Hedgehog Learning
In brief:
This notice explains how Happy Hedgehog Learning collects, uses, stores and protects personal information relating to parents, carers and children. It applies when you visit our website, make an enquiry, join a waiting list, use our tuition or learning services, purchase a product, join a membership, request a resource or communicate with us.
1. Who we are
Joanne Adams, trading as Happy Hedgehog Learning, is the data controller responsible for the personal information described in this notice.
If you have questions about this notice, wish to exercise a data-protection right or want to make a data-protection complaint, please contact:
Email: [email protected]
Website: www.happyhedgehoglearning.co.uk
The public website and purchasing process are intended for parents and carers. Children may take part in tuition and use learning materials, memberships or online services under the arrangements made by their parent or carer. We take particular care when handling children's information and aim to explain its use clearly.
2. Personal information we collect
Personal information means information that identifies, or could reasonably identify, an individual. Depending on how you interact with us, we may collect the following information.
Identity and contact information
Names of parents, carers and children.
Postal address, email address and telephone number.
A child's age, date of birth, school year and school, where relevant.
Tuition and learning information
- Tuition bookings, attendance and participation.
- Assessment scores, submitted work, homework and learning activity.
- Learning needs, educational targets and progress records.
- Lesson notes, reports and communications with parents or carers.
- Information provided when joining a membership, course or learning programme.
Purchase, payment and account information
- Products and services purchased, membership details and account information.
- Invoices, payments, transaction records and refund information.
- We do not retain complete payment-card details; these are processed securely by our payment provider.
Marketing and communication information
- Enquiries, waiting-list registrations and resource requests.
- Marketing preferences, consent records and unsubscribe requests.
- Information about how you interact with our emails, where our email platform provides this information.
Technical and website information
- IP address, browser type, device information and website-usage information.
- Cookies and similar technologies, where applicable.
Photographs, testimonials and recordings
We may collect photographs, video, audio, testimonials or feedback where this is relevant and permitted. We will explain the proposed use and obtain any consent that is required. Photography and filming are also governed by any separate permissions or policy provided to you.
3. Special-category information
We may receive limited information about a child's health, disability, diagnosed or suspected special educational needs, medical needs, anxiety or other matters affecting their learning. This may include relevant reports voluntarily supplied by a parent or carer.
We collect this information only where it is relevant and necessary to provide safe, appropriate and effective tuition or learning support. Access is restricted, and we take additional care to keep it secure.
Our Article 6 lawful basis is our legitimate interest in providing safe, appropriate and effective tuition and learning support. Where the information is special-category data, we rely on explicit consent under Article 9(2)(a) of the UK GDPR. We will request this consent separately.
A parent or carer may withdraw explicit consent at any time by contacting us. Withdrawal does not affect processing that has already taken place, but it may limit our ability to make particular adjustments or provide appropriately tailored support.
4. How we collect personal information
We collect personal information in several ways:
- directly from parents, carers or children through forms, email, telephone, messages, meetings, lessons, submitted work and purchases;
- through our website, booking, membership, payment and email systems;
- from schools, teachers or other professionals when a parent or carer has asked or authorised them to share relevant information;
- automatically through cookies, server logs and similar website technologies; and
- from publicly available sources where this is lawful and relevant.
If you provide information about another person, including a child or another parent or carer, you should ensure that you are authorised to do so and that they are aware of this notice where appropriate.
5. How and why we use personal information (Purpose | Information used | Lawful basis)
We use personal information only where the law allows us to. The table below sets out our main purposes and lawful bases. More than one basis may apply, depending on the circumstances.
PurposeInformaion usedwful basis
Respond to enquiries about tuition, memberships, products or services - Identity, contact and enquiry information - Steps before entering a contract where the enquiry concerns a potential booking or purchase; otherwise legitimate interests in responding and providing information.
Manage waiting lists and offer suitable places - Parent/carer and child details, contact details, school year and tuition requirements - Legitimate interests in managing demand and offering suitable services.
Enrol pupils and manage agreements with parents or carers - Identity, contact, booking, account and payment information - Contract.
Plan, provide and adapt tuition or learning services - Child identity, age, learning information, assessments, submitted work and progress - Legitimate interests in providing effective, appropriate tuition and monitoring progress. Special-category information is also covered by section 3.
Administer memberships, courses and online learning programmes - Account, contact, purchase, membership and relevant learning information - Contract for the parent's purchase or account; legitimate interests for the child's information needed to deliver and improve the learning service.
Communicate about lessons, attendance, homework, progress and service changes - Identity, contact, attendance, communication and learning information - Contract where needed to provide the purchased service; otherwise legitimate interests in keeping families informed and supporting learning.
Record attendance, assessments, lesson notes and progress - Attendance, learning, assessment and progress information - Legitimate interests in maintaining accurate records, monitoring progress and providing consistent tuition.
Process payments, invoices, refunds and financial records - Identity, contact, transaction, payment and invoice information - Contract and legal obligation, including accounting and tax requirements.
Deliver a requested guide, worksheet or resource - Name, email address and resource request - Steps taken at the person's request and legitimate interests in delivering the selected resource.
Send newsletters, educational advice, news and offers - Name, email address, interests, preferences and engagement information - Consent where a person actively opts in. We may use legitimate interests together with the PECR soft opt-in only where every legal condition is met.
Manage consent, marketing preferences and opt-outs - Contact details, consent and preference records - Legal obligation and legitimate interests in demonstrating compliance and respecting preferences.
Use photographs, testimonials or recordings - Images, video, audio, names and testimonial information - Consent where required and, for necessary lesson recordings, contract or legitimate interests as explained at the time.
Safeguard children and deal with emergencies, complaints or legal claims - Relevant identity, contact, attendance, communication, learning and incident information - Legitimate interests, legal obligation and, in a genuine emergency involving life or physical safety, vital interests.
Operate, secure and improve our website and services - Technical, usage, device, cookie and communication information - Legitimate interests; consent where legally required for non-essential cookies or similar technologies.
Work with service providers and professional advisers - Relevant information required for the service or advice - The basis applying to the original purpose and legitimate interests in operating the business securely and efficiently.
Meet legal, regulatory or official requirements - Any relevant information required - Legal obligation.
Legitimate interests
Where we rely on legitimate interests, this means that using the information is reasonably necessary for operating Happy Hedgehog Learning, providing effective learning support, communicating with families, protecting pupils or maintaining appropriate business records. We consider and balance these interests against the individual's rights, interests and reasonable expectations. You may contact us for further information about this assessment.
Changing the purpose
We will normally use personal information only for the purpose for which it was collected. If we reasonably need to use it for a compatible purpose, we may do so where the law permits. If we need to use it for an unrelated purpose, we will explain the new purpose and lawful basis before doing so, unless the law allows or requires otherwise.
6. Marketing and service communications
We use Funnel Sketchers to manage email communications and marketing preferences. We send newsletters, educational advice, news and promotional offers by email when a person has actively opted in, or where the limited PECR soft opt-in lawfully applies.
Opting in to marketing is optional. You may unsubscribe at any time using the link in a marketing email or by contacting us. We may keep a minimal suppression record so that we continue to respect your request.
Choosing not to receive marketing will not affect essential service communications about tuition, purchases, memberships, payments, safety or changes to a service you use.
We do not knowingly direct electronic marketing to children.
7. Cookies and website technology
Our website may use cookies and similar technologies to make the site work, keep it secure, understand how it is used and, where applicable, support marketing. Essential cookies may be used without consent where permitted by law. We ask for consent before using non-essential cookies where consent is required.
You can use the cookie settings on our website to accept, reject or change your choices. You can also control cookies through your browser. Please see our Cookie Policy or cookie-settings tool for further details, including the cookies in use and their duration.
8. Sharing personal information
We may share relevant personal information with trusted organisations that help us operate Happy Hedgehog Learning. These may include:
- customer relationship, membership and email-platform providers, including WordPress, Funnel Sketchers/GoHighLevel; Google Workspace services such as Gmail, Drive and Forms and Microsoft OneNote;
- payment processors and banking providers, including Stripe and Mettle;
- accounting software, including FreeAgent, and our accountant;
- video-conferencing providers, including Zoom;
- website hosting, maintenance and technical-support providers;
- professional advisers, insurers, regulators, public authorities, safeguarding bodies or law-enforcement agencies where relevant; and
- contractors or assistants who support the business and are authorised to access information for their work.
We share only the information reasonably required for the relevant purpose. Where an organisation processes information on our behalf, we require it to protect the information and use it only as permitted by our agreement and applicable law.
We may also disclose information where required by law, to protect a child or another person, to establish or defend legal claims, or in connection with a sale or transfer of the business. We do not sell personal information.
9. International transfers
Some service providers may store or process personal information outside the UK. Where this happens, we take reasonable steps to ensure that an appropriate level of protection is provided. Where required, we rely on safeguards recognised under UK data-protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.
Please contact us if you would like further information about the safeguard used for a particular transfer.
10. Data security
We use appropriate technical and organisational measures to protect personal information from accidental loss, unauthorised access, alteration or disclosure. These measures include access controls, passwords, secure service providers, device and account security, appropriate backups and limiting access to people who need the information for their work.
People who process personal information for us must keep it confidential and follow our instructions. If a personal-data breach occurs, we will assess it and notify affected people and the Information Commissioner's Office where the law requires us to do so.
No internet or email system can be guaranteed completely secure. Please take care when sending sensitive information and contact us if you believe information has been sent to the wrong person or an account may have been compromised.
11. How long we keep personal information
We keep personal information only for as long as it is needed for the purpose for which it was collected, including legal, accounting, safeguarding and dispute-resolution needs. Our usual periods are set out below. We may keep information for longer where a legal requirement, safeguarding concern, complaint, dispute or active claim makes this necessary, or delete it sooner where it is no longer needed.
Record
Ul rtention period
- Enquiries that do not become customers - Usually 18 months after the last meaningful contact.
- Waiting-list records - Until a place is offered, the person asks to be removed, or 24 months after the last confirmation of interest, whichever comes first.
- Core customer, booking, attendance and tuition records - Usually 6 years after the service or customer relationship ends, where needed to manage queries, complaints or legal claims.
- Detailed lesson notes, submitted work and routine progress material - Usually 2 years after tuition or membership ends, unless needed for an ongoing matter or retained as part of a core record.
- Special-category health, medical and SEND information - Reviewed when tuition ends and normally deleted within 2 years unless continued retention is necessary for safeguarding, a complaint or a legal claim.
- Financial and tax records - Normally 6 years, or for any longer period required by HMRC or other law.
- Marketing contacts and consent records - While marketing remains active. Inactive records are reviewed at least every 24 months. Opt-out or suppression records may be kept as long as needed to respect the request.
- Photographs, testimonials and promotional recordings - For the period explained when permission is obtained, until consent is withdrawn where applicable, or until the material is no longer used. Published printed material may remain in circulation.
- Routine online-lesson recordings - Normally no longer than 390 days unless a different period is explained and agreed for a specific purpose.
- Complaints and legal claims - Usually 6 years after the matter closes, or longer where legal proceedings require it.
- Safeguarding records - For as long as reasonably necessary having regard to the nature of the concern, safeguarding guidance, the child's age and any legal or regulatory requirement.
- Website logs, analytics and cookies - According to the periods shown in the cookie settings or Cookie Policy of the relevant provider.
The timelines above are a guide. We may decide to delete data much earlier than outlined above where we do not feel there is a legitimate reason to retain it. When information is no longer required, we securely delete it or anonymise it so that it no longer identifies anyone. Backup copies may remain for a limited period until they are overwritten or put beyond use.
12. Your data-protection rights
Depending on the circumstances, you may have the right to:
- ask for access to personal information and receive a copy;
- ask us to correct incomplete or inaccurate information;
- ask us to delete information where there is no good reason for us to continue using it;
- object to processing based on legitimate interests or to direct marketing;
- ask us to restrict the use of information in certain circumstances;
- ask us to transfer information you supplied to you or another organisation where the right to data portability applies;
- withdraw consent at any time where we rely on consent; and
- complain about how personal information has been handled.
These rights are not absolute and may not apply in every situation. We may need to verify identity and clarify the request. We will normally respond within one month, although the law allows more time for certain complex or multiple requests. We do not usually charge a fee. However, where permitted by law, we may charage a reasonable fee based on the administrative costs of dealing with a request that is manifestly unfounded or excessive or we may refuse to act on the request.
Children have their own data-protection rights. A parent or carer may exercise a right on a child's behalf where this is appropriate, but we will consider the child's age, understanding, wishes and best interests.
13. Automated decision-making
We do not use personal information to make solely automated decisions that have legal or similarly significant effects. Our systems may use tags or activity information to organise contacts or send relevant communications, but important decisions about tuition, learning support or access to services involve human judgement.
14. Data-protection complaints
If you are concerned about how we have used personal information, please contact us at [email protected] and describe the issue. We will:
- provide a clear way for you to make the complaint;
- acknowledge it within 30 days of receipt;
- take appropriate steps to investigate it without undue delay;
- keep you informed about progress where appropriate; and
- tell you the outcome when our investigation is complete.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator. We would appreciate the opportunity to address your concern first, but this does not affect your right to contact the ICO.
Website: www.ico.org.uk
Telephone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
15. Changes to this notice
We may update this notice when our services, systems or legal obligations change. The latest version will be published on our website and the date at the top or bottom of the notice will be updated. Where a change has a significant effect on how we use personal information, we will take reasonable steps to bring it to the attention of affected people.
16. Keeping your information up to date
Please tell us if your contact details or other relevant information change during your relationship with Happy Hedgehog Learning. This helps us keep our records accurate and communicate with you safely.
Last updated 10th August 2026
Copyright 2026 ©️ - Happy Hedgehog Learning - Privacy and Cookie Policy