Privacy notice

Who is responsible for your data

The controller of the personal data described here is Meddalwedd, trading as Safeguarding Context. Contact us about anything in this notice at info@safeguardingcontext.co.uk.

What we collect and why

• Accounts and orders. Your email address, the schools, colleges and settings you order for, your purchase order number if you give one, and the record of payment. Lawful basis: contract. Sign-in is by an emailed link that works once and expires after thirty minutes; no password is stored.
• Children's homes and supported accommodation. The homes and premises you add to your account, held encrypted and deleted as set out below.
• Payment. You pay on Stripe's own page. Stripe receives your email address, the order and the card details you enter there; card details never reach this site, and we receive only the payment's outcome and its receipt. Stripe also uses payment data to prevent fraud, under its own privacy notice. Lawful basis: contract.
• Emails we send you. The sign-in link, the order and report emails, the renewal reminder and any notice that the guidance has changed. A copy of every email about an order is kept in our own mailbox with the order's records; sign-in emails are never copied. Lawful basis: contract.
• Emails to organisations. We may write once, with one follow-up, to an organisation that provides education or care for children, about a duty it carries. We use only the organisation's name, what Ofsted or the Department for Education publish about it, and the general contact address it publishes on its own website, never a person's name or personal address, and we write only to companies and other incorporated bodies. Reply "stop" or email us and we will not write again; we keep the address on a list of those not to contact, and nothing else. Lawful basis: legitimate interest.
• Action logs. For each school you hold, the status, owner role, due date and notes you record against the actions from its report, visible only to your account. They are meant for what the school does about its surroundings and arrangements; the page asks you never to record anything about an individual pupil there. Lawful basis: contract. They are deleted with your account, which you can ask us to do at any time.
• Server logs. The page requested, the time and whether it worked, kept for fault finding and to stop abuse of the forms. The address a request came from is used to limit repeated sign-in attempts and is not kept in the logs; sign-in links and email addresses are removed from them. Lawful basis: legitimate interest.
• Analytics. Google Analytics counts which public pages are visited, how visitors arrived (a search, another site or directly), the type of device and browser, and an approximate town-level location that Google works out from the connection and does not store as an address. We use it only to produce statistics about how the site is used so we can improve it. Lawful basis: legitimate interest. The cookie rules allow this without asking first because it is used solely for statistics to improve this site (the statistical purposes exception in the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025), provided we tell you and you can object. Every public page says so at its foot. To object, block cookies from this site in your browser's settings, which stops Google Analytics on this site at once; you can also email us.
• Our own record of the buying path. We keep a log of the steps between pressing an order button and downloading a report (the order page opened, the order placed, the payment made, the report downloaded) and of what is typed into the school search, so we can see where buying goes wrong and which schools people cannot find. Please type only the name of a school, college or setting there, never a person's name. A cookie of ours remembers the first page you saw and the site or campaign that sent you, so a step can be set beside how the visitor arrived. It is held on our own database, never sent to Google or anyone else, and used only for statistics to improve the site. Lawful basis: legitimate interest. Blocking cookies from this site stops steps being tied to a visit; the steps of an order are then recorded against the account alone.

Google acts only as our processor, under its data processing terms. Every option to share the data with Google for its own purposes is switched off, as are Google signals and advertising personalisation, so Google does not use the data for itself, link it with other information about you, or use it for advertising. Google Analytics does not store your full internet address.

Analytics never runs on the sign-in, account, order, checkout, dashboard or admin pages, so Google never receives your email address, the schools you order for, or anything about payment. The address of a page sent to Google never includes what you typed into a search.

Who processes it for us

• Microsoft hosts the site, its scheduled work and its server logs in its UK South region (Microsoft Azure).
• Our database host keeps accounts, orders, action logs and the record of the buying path on a server in the United Kingdom.
• Promailserver sends our email and holds our mailbox.
• Stripe takes payment, as described above.
• Google runs the site's analytics, as described above.

Each works under a contract that limits it to doing this for us. Stripe and Google may process data in the United States, under the UK extension to the EU-US Data Privacy Framework. UK Crime Statistics, which prepares the police-recorded crime in each report, receives the name, postcode and map position of the school, college or setting ordered and our order reference; it receives nothing about you. For a children's home or supported accommodation premises it receives the postcode and a reference only, as set out below.

What we do not do

• No cookies for advertising or for following you across other sites. The analytics cookies, Google's and our own, are the only ones the site does not strictly need, and they are used only for statistics.
• No decisions about you made by a computer alone.
• No advertising on this site, no tracking pixels (our own advertisements elsewhere link here with campaign tags only), no sale or sharing of your details with anyone for marketing.
• No profiling of pupils or learners. The site and the report describe the area around a school or college and never the school, the college or its pupils and learners.
• No profiling of children or of the people who look after them. The pages and reports for nurseries, pre-schools and out-of-school clubs describe the area around a setting and the local authority; they carry the facts Ofsted publishes about the setting, never an inspection outcome, and they never name a registered person who is an individual or a childminder. Where a setting shares a site with a school, the school is not named.
• No public page, search entry or map point for any children's home or supported accommodation premises, and no rating of a home, its staff or the children and young people living there.

Cookies

Two cookies are needed for the site to work and are set when their feature is used. The two Google Analytics cookies and our own visit cookie are set on public pages. A third cookie of ours is no longer set but is still read where a browser holds it.

Your browser's settings can block or delete these cookies at any time. Blocking cookies from this site stops Google Analytics and our visit cookie; the cookies needed to sign in and to send forms are then blocked too.

Children's homes and supported accommodation

The location of a children's home or a supported accommodation premises tells anyone who holds it where children or young people live. We treat it as personal data about them and hold it to the strictest rule on this site.

• What we hold. For each home or premises you add: the postcode and the point it stands for, your own label for it, the local authority and the police force, the broad groups of its statement of purpose you tick, the review dates and the role of each person who signs off a review, the consultation tracker's fixed statuses and outcomes, and the action log with no notes. The postcode, the point, your label and the area figures that name streets are encrypted by the application with a key held only in the site's settings. Lawful basis: contract, and legitimate interest for the location as it relates to the children living there.
• What we never hold. The Ofsted URN is checked when you enter it and never kept, in any form. A spreadsheet of premises is read and discarded, never saved. Nothing about any child or young person is held: the tracker takes fixed outcomes only, the action log has no notes, and the children's or young people's views are gathered on paper and never entered here.
• Where it goes. Emails, Stripe's payment page, its receipts and invoices, and our receipt name each location by a reference such as "Location K7Q2MX4PA9HD", never by your label, its kind or its area, and the postcode is never in an address, a log or our analytics. UK Crime Statistics receives the postcode and that reference only, with no label, kind, authority or map position, and deletes both after delivery. The pack prints the postcode on its cover alone; the staff briefing, the slides and the placing authority summary carry no address, postcode or street. Our admin pages never show the postcode.
• What the pack leaves out. Every crime recorded within 200 metres of the postcode is left out of every figure, to leave out what is recorded at the home itself. Other chapters, such as the road collisions, may still name the roads near the home, so the full pack stays confidential.
• How long. Everything about a location (the location itself, its reviews, consultations, reminders, action log and crime figures) is deleted 90 days after the year you paid for ends, or 90 days after you remove it if that is sooner. A location never ordered is deleted soon after you remove it, or 90 days after you entered it. Deleted data leaves the database host's backups within its backup window. The order and payment records tax law makes us keep name the location only by its reference.
• If something went wrong. Any breach involving a location would be treated as high risk to the children living there: we would report it to the Information Commissioner's Office and tell you at once, naming each location by its reference, so you can tell your placing authorities.

How long we keep it

Order and payment records, and the copies of the emails about an order, are kept for six years because tax law requires it. An account with no orders is deleted automatically after twelve months without a sign-in, with its action logs. Server logs are kept for thirty days. Google Analytics keeps visit-level data for no more than fourteen months; after that only totals remain. Our own record of the buying path is deleted after fourteen months, automatically.

How we keep it safe

Everything travels over an encrypted connection. Only the people who run the site can reach the database and the logs, and the admin area is open only to them. Sign-in links work once and expire after thirty minutes, and they are removed from the logs. If something ever went wrong with your data, we would tell you and the Information Commissioner's Office where the law requires it.

Your rights

You can ask for a copy of what we hold about you and for it in a form you can take elsewhere, ask for it to be corrected or deleted, ask us to stop using it while a question is settled, or object to how it is used. Email the address below; we will answer within a month, and there is no charge. When you ask us to delete your account we remove your action logs and everything else that is not part of the order and payment records tax law makes us keep, which stay for the rest of their six years.

If you are not satisfied with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

The site is for staff, governors, trustees and owners of schools, colleges and childcare settings, and for the managers and providers of children's homes. It is not meant for children, and we do not knowingly collect anything about a child.

Contact: info@safeguardingcontext.co.uk.

The data on the pages

School and college facts come from the Department for Education's Get Information About Schools register, and the facts about nurseries, pre-schools and clubs from Ofsted's register of childcare providers, both under the Open Government Licence. Other datasets used in the report are named on the page or in the report with their licence and attribution. None of them contains personal data about pupils or children, and no page names a registered childcare provider who is an individual.