Special Category Data Protection Policy

Last updated: 4 November 2026

1. About this policy
   • This is the “appropriate policy document” for AP Tutoring Limited (trading as Sunbeam Education) setting out how we will protect Special Categories of Personal Data and Criminal Convictions Data.
   • This policy supports Sunbeam Education’s Data Protection Policy (https://sunbeameducation.com/data-protection-policy/).
   • This document meets the requirement of the Data Protection Act 2018 that an appropriate policy document be in place where Processing Special Categories of Personal Data and Criminal Convictions Data in certain circumstances. Some of the conditions we rely on, such as explicit consent, don’t require an appropriate policy document, but we follow this policy whenever we Process Special Categories of Personal Data or Criminal Convictions Data.
   • Tutors and Sunbeam Education are separate, independent Controllers of the customer data we share with tutors through our platform. Tutors should read this policy as if it were their own and, where relevant, follow it, in particular when they handle information about a learner’s health or special educational needs.
2. Definitions
   • Controller: the person or organisation that determines when, why and how to Process Personal Data. Sunbeam Education and each tutor are separate, independent Controllers of the customer data shared with that tutor through our platform.
   • Criminal Convictions Data: personal data relating to criminal convictions and offences, including Personal Data relating to criminal allegations and proceedings.
   • Data Retention Policy: explains how the organisation classifies and manages the retention and disposal of its information. Our Data Retention Policy is paragraph 8 (Data retention) of our Privacy Notice.
   • Data Subject: a living, identified or identifiable individual about whom we hold Personal Data. Data Subjects may be nationals or residents of any country and may have legal rights regarding their Personal Data.
   • Data Protection Impact Assessment (DPIA): tools and assessments used to identify and reduce risks of a data processing activity. A DPIA can be carried out as part of Privacy by Design and should be conducted for all major system or business change programmes involving the Processing of Personal Data.
   • DPA 2018: the Data Protection Act 2018.
   • Data Protection Lead: either of the following:
     1. for Sunbeam Education, Alex Pagett, who you can contact at info@sunbeameducation.com; or
     2. in the case of tutors, the tutor themselves.
   • UK GDPR: the General Data Protection Regulation ((EU) 2016/679) as it forms part of the law of the United Kingdom (see section 3(10) of the DPA 2018).
   • Personal Data: any information identifying a Data Subject or information relating to a Data Subject that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably possess. Personal Data includes Special Categories of Personal Data.
   • Privacy Notice: a separate notice setting out information that may be provided to Data Subjects when the organisation collects information about them. Our Privacy Notice is our privacy policy (https://sunbeameducation.com/privacy-policy/). As a smaller organisation, the Privacy Notice also acts as our Data Retention Policy.
   • Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.
   • Special Categories of Personal Data: information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data. We treat all information about a learner’s medical conditions and special educational needs as data concerning health.
3. Why we process Special Categories of Personal Data and Criminal Convictions Data
   • We process Special Categories of Personal Data and Criminal Convictions Data for the following purposes:
     • matching learners (usually the children of our customers) with appropriate tutors who have experience or are able to deliver tutoring sessions to learners with special educational needs or medical conditions, and sharing what customers tell us about a learner’s needs and health with each tutor they book, so the tutor can prepare;
     • providing our EHCP audit service, if a customer buys it: our own team reviews the Education, Health and Care Plan and professional reports the customer sends us through our order form and prepares a written report, and we don’t share these documents with tutors;
     • assessing a tutor’s fitness to offer their tutoring services on our website and platform, including checking their DBS certificate and checking its status through the DBS Update Service;
     • protecting children and adults at risk, including sharing information with the police, a local authority safeguarding team or the Disclosure and Barring Service where it is needed to protect someone;
     • if you are a tutor, understanding the special educational needs of the learners to whom you will deliver tutoring sessions, so you can prepare for and deliver those sessions;
     • assessing an employee’s fitness to work;
     • complying with health and safety obligations;
     • complying with the Equality Act 2010;
     • checking applicants’ and employees’ right to work in the UK; and
     • verifying that candidates are suitable for employment or continued employment.
4. Personal data protection principles
   • The UK GDPR requires personal data to be processed in accordance with the six principles set out in Article 5(1). Article 5(2) requires controllers to be able to demonstrate compliance with Article 5(1).
   • We comply (and, if you are a tutor, you must comply under section 12 of our Platform Contract) with the principles relating to Processing of Personal Data set out in the UK GDPR which require Personal Data to be:
     • Processed lawfully, fairly and in a transparent manner (Lawfulness, Fairness and Transparency);
     • collected only for specified, explicit and legitimate purposes (Purpose Limitation);
     • adequate, relevant and limited to what is necessary in relation to the purposes for which it is Processed (Data Minimisation);
     • accurate and where necessary kept up to date (Accuracy);
     • not kept in a form which permits identification of Data Subjects for longer than is necessary for the purposes for which the data is Processed (Storage Limitation); and
     • Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful Processing and against accidental loss, destruction or damage (Security, Integrity and Confidentiality).
   • We are responsible for and must be able to demonstrate compliance with the data protection principles listed above (Accountability).
5. Compliance with data protection principles
   • Lawfulness, fairness and transparency

     Personal Data must be processed lawfully, fairly and in a transparent manner in relation to the Data Subject.

     We will only Process Personal Data fairly and lawfully and for specified purposes. The UK GDPR restricts our actions regarding Personal Data to specified lawful purposes. We can Process Special Categories of Personal Data and Criminal Convictions Data only if we have a legal ground for Processing and one of the specific Processing conditions relating to Special Categories of Personal Data or Criminal Convictions Data applies. We will identify and document the legal ground and specific Processing condition relied on for each Processing activity.

     When collecting Special Categories of Personal Data and Criminal Convictions Data from Data Subjects, either directly from Data Subjects or indirectly (for example from a third party or publicly available source), we will provide Data Subjects with a Privacy Notice setting out all the information required by the UK GDPR in a privacy notice which is concise, transparent, intelligible, easily accessible and in clear plain language which can be easily understood.

     Lawful Processing basis	Processing condition for Special Categories of Personal Data and Criminal Convictions Data
     Data concerning the health and special educational needs of learners Consent (Article 6(1)(a)).	Explicit consent, which the customer gives when they book, whenever they choose a special educational needs or health support type or describe the learner’s needs (unless they have already given it), or when they order our EHCP audit service. We keep a record of the consent: for bookings, with the customer’s account; for an EHCP audit, with the order. The customer can withdraw it at any time by contacting us. (Article 9(2)(a), UK GDPR.)
     Criminal Convictions Data (tutors’ DBS certificates and DBS Update Service status checks) In the organisation’s legitimate interests in keeping children safe and making sure tutors meet our requirements (Article 6(1)(f)), which are not outweighed by the fundamental rights and freedoms of the Data Subject.	Consent, which the tutor gives when they send us their DBS certificate details and agree to our DBS Update Service status checks. A tutor can withdraw their consent at any time by contacting us, but we can then no longer list them as a tutor. (Paragraph 29, Schedule 1, DPA 2018.)
     Data concerning health and special educational needs, and Criminal Convictions Data, that we need to share to protect someone In the organisation’s legitimate interests in keeping children and adults at risk safe (Article 6(1)(f)), or compliance with a legal obligation (Article 6(1)(c)) where the law requires us to share it.	Necessary to protect a child or an adult at risk from harm, where consent can’t be given, we can’t reasonably be expected to get it, or asking for it would put that protection at risk. (Paragraph 18, Schedule 1, DPA 2018.) Necessary for preventing or detecting unlawful acts. (Paragraph 10(1), Schedule 1, DPA 2018.) For Criminal Convictions Data, these conditions apply through Paragraph 36, Schedule 1, DPA 2018.
     Data concerning the health of our employees and job applicants Compliance with a legal obligation (Article 6 (1)(c)) or necessary for the performance of a contract with the Data Subject (Article 6(1)(b)).	Necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the Data Subject in connection with employment, social security or social protection. (Paragraph 1(1)(a), Schedule 1, DPA 2018.)
     Racial or ethnic origin data (our employees and job applicants) Compliance with a legal obligation (Article 6(1)(c)).	Necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the Data Subject in connection with employment, social security or social protection. (Paragraph 1(1)(a), Schedule 1, DPA 2018.)
     Equal opportunity data (our employees and job applicants) In the organisation’s legitimate interests (Article 6(1)(f)) which are not outweighed by the fundamental rights and freedoms of the Data Subject.	Necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained. (Paragraph 8(1)(b), Schedule 1, DPA 2018.)

   • Purpose limitation

     Personal Data must be collected only for specified, explicit and legitimate purposes. They must not be further Processed in any manner incompatible with those purposes.

     We will only collect personal data for specified purposes and will inform Data Subjects what those purposes are in a published Privacy Notice. If we use Personal Data for a new compatible purpose then we will inform the Data Subject first.

   • Data minimisation

     Personal Data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

     We will only collect or disclose the minimum Personal Data required for the purpose for which the data is collected or disclosed. We will ensure that we do not collect excessive data and that the Personal Data collected is adequate and relevant for the intended purposes.

   • Accuracy

     Personal Data must be accurate and, where necessary, kept up to date. It must be corrected or deleted without delay when inaccurate.

     We will ensure that the Personal Data we hold and use is accurate, complete, kept up to date and relevant to the purpose for which it is collected by us. We check the accuracy of any Personal Data at the point of collection and at regular intervals afterwards. We take all reasonable steps to destroy or amend inaccurate or out-of-date Personal Data.

   • Storage limitation

     We only keep Personal Data in an identifiable form for as long as is necessary for the purposes for which it was collected, or where we have a legal obligation to do so. Once we no longer need Personal Data it shall be deleted or rendered permanently anonymous.

     Our Data Retention Policy (paragraph 8 of our privacy policy) sets out how long we keep each type of Personal Data. We delete Personal Data at the end of that time, unless we are legally required to retain that data for longer.

     We will ensure Data Subjects are informed of the period for which data is stored and how that period is determined in any applicable Privacy Notice.

   • Security, integrity, confidentiality

     Personal Data shall be Processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorised or unlawful Processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

     We will implement and maintain reasonable and appropriate security measures against unlawful or unauthorised Processing of Personal Data and against the accidental loss of or damage to Personal Data.

   • Accountability principle

     We are responsible for, and able to demonstrate compliance with these principles. Our Data Protection Lead (or, if a tutor, the tutor themselves) is responsible for ensuring that we are compliant with these principles. Any questions about this policy should be sent to our Data Protection Lead at info@sunbeameducation.com.

     We will:

     • Ensure that records are kept of all Personal Data Processing activities, and that these are provided to the Information Commissioner on request.
     • Carry out a DPIA for any high-risk Personal Data Processing to understand how Processing may affect Data Subjects and consult the Information Commissioner if appropriate.
     • Ensure that our Data Protection Lead oversees how we handle Personal Data and monitors our compliance with this policy.
     • Have internal processes to ensure that Personal Data is only collected, used or handled in a way that is compliant with data protection law.
6. Controller’s policies on retention and erasure of personal data

   We take the security of Special Categories of Personal Data and Criminal Convictions Data very seriously. We have administrative, physical and technical safeguards in place to protect Personal Data against unlawful or unauthorised Processing, or accidental loss or damage. We will ensure, where Special Categories of Personal Data or Criminal Convictions Data are Processed that:

   • The Processing is recorded, and the record sets out, where possible, a suitable time period for the safe and permanent erasure of the different categories of data in accordance with our Data Retention Policy.
   • Where we no longer require Special Categories of Personal Data or Criminal Convictions Data for the purpose for which it was collected, we will delete it or render it permanently anonymous as soon as possible.
   • Where records are destroyed we will ensure that they are safely and permanently disposed of.

   Our Data Retention Policy is paragraph 8 (Data retention) of our privacy policy. For Special Categories of Personal Data and Criminal Convictions Data, this means:

   • We keep what customers tell us about a learner’s needs and health when they book until they withdraw their consent or delete their account, and for no more than 12 months after the learner’s last session.
   • The type of support booked (for example ADHD or dyslexia) is part of our booking records, which we keep for six years from the end of the financial year in which the booking took place, to meet tax and accounting rules and to deal with any claims.
   • We delete the EHCP and professional reports a customer sends us for an EHCP audit 3 months after we deliver our report, and keep our report for 12 months unless the customer asks us to delete it sooner.
   • Messages between customers and tutors, which may include information about a learner’s needs, are kept while both accounts in the conversation are open, and for no more than 2 years after the last message.
   • We delete the copy of a tutor’s DBS certificate within 6 months of our decision on it. We keep a record of the certificate number, each DBS Update Service check and its result, and our decision while the tutor is listed with us and for six years after they leave. If a tutor’s application doesn’t go ahead, we keep it for 12 months after our decision.
   • We may keep data for longer if there is a complaint, a safeguarding concern or a legal claim.

   Data Subjects receive a Privacy Notice setting out how their Personal Data will be handled when we first obtain their Personal Data, and this will include the period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period. The Privacy Notice is also available on our website.

7. Review
   • This policy on Processing Special Categories of Personal Data and Criminal Convictions Data is reviewed on a yearly basis.
   • The policy will be retained where we process Special Categories of Personal Data and Criminal Convictions Data and for a period of at least six months after we stop carrying out such processing.
   • A copy of this policy will be provided to the Information Commissioner on request and free of charge.

Further information:

For further information about our compliance with data protection law, please contact our Data Protection Lead, Alex Pagett, at info@sunbeameducation.com.