Privacy Policy

School Passport Privacy Policy

Last updated: September 2026

1. Introduction

This Privacy Policy explains how PE Passport Ltd, operating the School Passport platform (“School Passport”, “we”, “us” or “our”), collects, uses, stores and protects personal information.

We are committed to protecting your privacy and handling personal information fairly, lawfully and transparently.

This Privacy Policy applies to personal information that we process as a data controller, including information relating to customers, prospective customers, suppliers, business contacts and visitors to our website.

School Passport is also used by schools and other educational organisations to manage information relating to pupils and other users.

Where a school or educational organisation uses School Passport to enter, store, manage, assess, evidence or report information relating to pupils or staff, the school or organisation will normally be the data controller and PE Passport Ltd will act as a data processor.

In those circumstances, we process personal information only in accordance with:

• the school’s or organisation’s documented instructions;
• our Data Processing Agreement;
• the UK GDPR;
• the Data Protection Act 2018, as amended;
• the Data (Use and Access) Act 2025; and
• other applicable UK data-protection legislation.

Our Data Processing Agreements contain the provisions required by Article 28 of the UK GDPR.

If you have any questions about this Privacy Policy or the way we use personal information, please contact:

Data Protection Officer: Glyn Musgrove
Email: office@pepassport.co.uk

2. Who We Are

School Passport is operated by:

PE Passport Ltd

Registered address:
Westminster House, 10 Westminster Road, Macclesfield, SK10 1BX

Website: www.schoolpassport.co.uk

Data Protection Officer: Glyn Musgrove
Email: hello@schoolpassport.co.uk

PE Passport Ltd is registered with the Information Commissioner’s Office (ICO).

ICO Registration Number: ZA320528

For the purposes of our own customer, supplier, website and business administration data, PE Passport Ltd is the data controller.

For personal information entered into School Passport by schools and educational organisations, we will normally act as a data processor on behalf of that organisation.

3. Data Protection Legislation

We process personal information in accordance with applicable UK data-protection and privacy legislation, including:

• the UK General Data Protection Regulation (UK GDPR);
• the Data Protection Act 2018;
• the Data (Use and Access) Act 2025;
• the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended; and
• other applicable UK privacy and data-protection legislation and regulatory guidance.

Where our services are likely to be accessed directly by children, we will also take account of applicable requirements relating to children’s privacy, including the ICO’s Children’s Code where relevant.

4. Information We May Collect

The personal information we collect depends upon your relationship with School Passport and how the platform is used.

Customer and business information

We may collect information including:

• name;
• email address;
• telephone number;
• school or organisation name;
• school postcode or address;
• job title or role;
• subscription or trial information;
• account details;
• correspondence with us;
• marketing preferences;
• payment and transaction information;
• support enquiries; and
• information provided through forms, demonstrations, surveys or enquiries.

We may also collect technical information necessary to operate, secure and support our website and platform, such as device, browser, login and security information.

Information processed on behalf of schools

Schools and educational organisations may use School Passport to process information about pupils and staff.

Depending on the features selected by the school, this may include information such as:

• pupil names or identifiers;
• class, year group or teaching group;
• curriculum and assessment information;
• attainment and progress information;
• teacher observations;
• reports;
• photographs, videos or other evidence uploaded by authorised users;
• participation or activity information; and
• other information entered or uploaded by the school.

Some information entered by a school may constitute special category or otherwise sensitive personal information.

Where this occurs, the school remains responsible for determining the lawful basis and purpose for processing that information and School Passport processes it only on the school’s documented instructions.

We do not use pupil information that we process on behalf of schools for our own advertising or direct-marketing purposes.

5. How We Use Personal Information

Where PE Passport Ltd acts as a data controller, we may use personal information to:

• provide and administer School Passport;
• create and manage customer accounts;
• provide trials, demonstrations and subscriptions;
• provide customer support and training;
• respond to enquiries;
• fulfil our contractual obligations;
• process payments and maintain financial records;
• communicate important service information;
• maintain the security and integrity of our systems;
• prevent fraud, misuse or unauthorised access;
• improve our products and services;
• manage our relationships with customers, suppliers and partners;
• comply with legal and regulatory obligations; and
• send relevant marketing communications where permitted by law.

We will not use personal information for purposes that are incompatible with the purposes for which it was collected unless permitted or required by law.

6. Our Lawful Bases for Processing

Under the UK GDPR we must have a lawful basis for processing personal information.

Depending upon the circumstances, we may rely upon:

Contract

Where processing is necessary to provide a School Passport subscription, trial, service or other product requested from us.

Legitimate interests

Where processing is necessary for our legitimate business interests and those interests are not overridden by an individual’s rights and freedoms.

This may include customer relationship management, administration, service improvement, network and information security and certain business-to-business marketing activities.

Where required, we will assess and balance our legitimate interests against the rights and reasonable expectations of the individual.

Legal obligation

Where processing is necessary to comply with an obligation imposed on us by law, including accounting, taxation, regulatory and data-protection requirements.

Consent

Where we specifically ask an individual to consent to a particular use of their information.

Where consent is relied upon, it can be withdrawn at any time.

Other lawful bases may apply where permitted by the UK GDPR and applicable legislation.

7. Marketing Communications

We may provide customers and business contacts with information about School Passport, our products, services, updates, resources or relevant offers where permitted by law.

Electronic marketing communications are sent in accordance with applicable requirements under the UK GDPR and PECR.

You can object to direct marketing or unsubscribe from marketing communications at any time.

Each electronic marketing communication will provide an appropriate method of opting out, or you can contact us at:

office@pepassport.co.uk

Opting out of marketing will not prevent us from sending essential administrative or service-related communications relating to an account or subscription.

8. Cookies and Similar Technologies

The School Passport website and platform may use cookies or similar technologies to operate, secure and improve our services.

Some cookies may be necessary for the operation, security or functionality of the website and platform.

Other cookies, including certain analytics or optional technologies, will be used in accordance with PECR and other applicable privacy legislation. Where consent is legally required, these technologies will not be activated until the appropriate consent has been provided.

Certain limited uses of cookies or similar technologies may be permitted without consent where an exemption under PECR applies.

Further information about the cookies used by School Passport should be provided through our Cookie Policy and cookie preference controls.

Users can change their cookie preferences where applicable.

9. Pupil and Children’s Information

School Passport has been developed specifically for use within educational settings and may therefore process information relating to children.

Where a school enters pupil information into School Passport, the school is normally the data controller and PE Passport Ltd acts as the school’s data processor.

The school is responsible for determining:

• what pupil information is entered;
• why that information is processed;
• the lawful basis for processing;
• which staff members may access the information;
• how long the information should be retained; and
• how requests from pupils, parents or guardians should be handled.

We process such information only for the purpose of providing School Passport and in accordance with the school’s instructions and our Data Processing Agreement.

If a pupil, parent or guardian wishes to exercise rights relating to information held within a school’s School Passport account, they should normally contact the relevant school in the first instance.

Where School Passport itself acts as the controller of children’s personal information, we will apply appropriate safeguards and take account of the best interests and particular privacy rights of children.

10. How We Protect Personal Information

We take appropriate technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure; and
• other unlawful processing.

Security measures may include access controls, encrypted communications, password protection, secure hosting infrastructure, system backups, monitoring and other appropriate security measures.

Access to personal information is restricted to authorised persons who require access for legitimate business or service purposes.

No internet-based system can be guaranteed to be completely secure. However, we continually review and maintain proportionate safeguards appropriate to the nature of the information we process and the risks involved.

11. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, contractual, regulatory and accounting requirements.

Retention periods may vary depending upon the type of information and why it is being processed.

Where we process pupil or other school information as a data processor, retention and deletion will be governed by:

• the school’s instructions;
• our contract with the school;
• our Data Processing Agreement; and
• applicable law.

At the end of a contract, personal information processed on behalf of a school will be returned, deleted or otherwise dealt with in accordance with the applicable contractual and legal requirements.

We periodically review information we hold and securely delete or anonymise personal information that is no longer required.

12. Sharing Personal Information

We do not sell personal information.

We may share personal information with trusted third-party service providers where this is necessary to operate our business and provide School Passport.

These may include providers of:

• cloud hosting and IT infrastructure;
• customer relationship management systems;
• email communications;
• accounting and invoicing;
• payment processing;
• technical support;
• analytics;
• website services; and
• professional or regulatory services.

Our existing service providers may include:

Mailchimp – email communications and marketing.

Pipedrive – customer relationship management and recording customer correspondence.

KashFlow – accounting, invoicing and payment administration.

Where a third party processes personal information on our behalf, we require appropriate contractual, confidentiality, security and data-protection arrangements.

We may also disclose personal information where:

• required by law;
• required by a court, regulator or public authority;
• necessary to establish, exercise or defend legal rights;
• necessary to prevent or investigate fraud or security incidents;
• necessary to protect the rights, property or safety of individuals; or
• our business or substantially all of its assets is sold or transferred, subject to appropriate safeguards.

13. International Transfers

Some of our suppliers or service providers may process or make personal information accessible outside the United Kingdom.

Where this constitutes a restricted international transfer under UK data-protection law, we will ensure that an appropriate legal mechanism is in place.

This may include:

• UK adequacy regulations;
• an approved International Data Transfer Agreement (IDTA);
• the UK International Data Transfer Addendum to approved EU Standard Contractual Clauses;
• another appropriate safeguard recognised under UK data-protection law; or
• a permitted statutory exception where appropriate.

Where required, we will also undertake the appropriate assessment of the protection provided for the information being transferred and implement additional technical, contractual or organisational safeguards.

14. Your Data Protection Rights

Depending upon the circumstances and the lawful basis on which your information is processed, you may have the right to:

• request confirmation that we process your personal information;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• request restriction of processing;
• object to processing;
• object to direct marketing;
• request the transfer of your personal information in certain circumstances;
• withdraw consent where processing is based upon consent; and
• complain about how your personal information has been handled.

These rights are not absolute and exemptions may apply depending upon the circumstances.

We will respond to valid data-protection requests in accordance with the time limits and requirements of applicable legislation.

To exercise your rights in relation to information for which PE Passport Ltd is the data controller, contact:

office@pepassport.co.uk

Where the information is held within School Passport on behalf of a school, please contact the relevant school first, as the school will normally be the data controller.

15. Data Protection Complaints

You have the right to make a complaint if you believe that we have not handled your personal information in accordance with data-protection law.

Data-protection complaints can be submitted to:

Data Protection Officer: Glyn Musgrove
Email: office@pepassport.co.uk

We will facilitate the making of data-protection complaints and will:

• acknowledge receipt of a data-protection complaint within 30 days;
• take appropriate steps to investigate the complaint without undue delay;
• keep the complainant appropriately informed about progress; and
• communicate the outcome without undue delay.

If you remain dissatisfied with the way your personal information has been handled, you also have the right to complain to the Information Commissioner’s Office (ICO).

Information about raising a complaint is available at:

www.ico.org.uk

Nothing in this Privacy Policy affects your statutory rights or your ability to seek an appropriate legal remedy.

16. Automated Decision-Making and Profiling

We do not currently use personal information for solely automated decision-making that produces legal effects or similarly significant effects on individuals.

School Passport may provide digital or AI-assisted tools that help users create, organise or work with educational content. These tools are not used by PE Passport Ltd to make significant automated decisions about pupils or customers.

If this position changes, we will update this Privacy Policy and provide any information and safeguards required under applicable data-protection legislation.

17. Links to Other Websites

Our website or platform may contain links to websites operated by third parties.

This Privacy Policy does not apply to those third-party websites.

We do not control how third-party websites collect, store or use personal information. Users should review the privacy information provided by those organisations before providing personal information to them.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to School Passport;
• changes to the way we process personal information;
• changes to our suppliers or service providers;
• changes to data-protection legislation or regulatory guidance; or
• other operational or legal requirements.

The latest version will be published on our website.

Where a change is significant, we may also notify customers or users by email or through the School Passport platform.

19. Contact Us

For questions about this Privacy Policy, the use of personal information or your data-protection rights, please contact:

PE Passport Ltd – School Passport

Data Protection Officer: Glyn Musgrove

Email: office@pepassport.co.uk

Registered address:
Westminster House, 10 Westminster Road, Macclesfield, SK10 1BX

ICO Registration Number: ZA320528

Website: www.schoolpassport.co.uk

© 2026 PE Passport Ltd. All rights reserved.