Operated by: Nudge Education Ltd · Version: Jul 2026 · Owner: Data Protection Lead
This notice is for employees, workers, contractors, volunteers, trainees and job applicants of Nudge Education Ltd, including Nudge Education Online (NEO). Approved by the Director of Operations, 16 July 2026. Reviewed annually.
1. Who we are
Nudge Education Ltd (“Nudge”, “we”, “us”) of Sirius House, Amethyst Road, Newcastle upon Tyne NE4 7YL is the data controller for the personal information we hold about you as a member of staff, volunteer, contractor or applicant. This notice explains what we collect, why, who we share it with, how long we keep it, and your rights. It is written under the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (together, “data protection laws”).
Questions or concerns: contact the Data Protection Lead at privacy@nudgeeducation.co.uk. We are supported by an external data protection service, Data Protection People.
2. What we collect
Recruitment and vetting. Application and interview records; references; identity, right-to-work and qualification evidence; DBS certificate information (including children’s barred list checks); checks against teacher prohibition, section 128 and misconduct records via the DfE’s Check a Teacher’s Record service; overseas checks where you have lived abroad; and, in line with Keeping Children Safe in Education, the results of online searches carried out as part of shortlisting. Vetting outcomes are recorded on our Single Central Record.
Employment administration. Contact details, emergency contacts, contract terms, payroll and bank details, tax and National Insurance information, pension enrolment, expenses, working patterns, leave.
Performance and development. Induction, training and CPD records (including statutory safeguarding training), supervision, appraisal, capability and disciplinary records.
Health and wellbeing. Sickness absence, occupational health referrals and reports, reasonable-adjustment and access needs, homeworking and display screen equipment (DSE) assessments.
Safeguarding. Records of any safeguarding concern, low-level concern or allegation involving you, held and shared in accordance with Keeping Children Safe in Education and our Managing Allegations Against Staff Policy.
Systems and delivery records. Because our provision is delivered online and we operate audited systems by design, we keep logs of access to our platforms (sign-ins, access to learner records, permission changes and administrative actions), and lessons you deliver may be recorded where a documented justification exists under our recording arrangements. Audit logs exist to protect children, staff and the organisation; we do not use them for covert monitoring, and any use for management purposes is proportionate and documented.
3. Why we process it (lawful bases)
- Your employment contract — to employ and pay you (UK GDPR Art 6(1)(b)).
- Legal obligations — safer-recruitment vetting, tax and pensions, health and safety duties including for homeworkers (Art 6(1)(c)).
- Legitimate interests — running a safe, well-governed organisation: systems security and audit, business administration, quality assurance, insurance (Art 6(1)(f)), balanced against your rights.
- Special category data (health; and any data revealing protected characteristics) — employment and social-security purposes (Art 9(2)(b) with DPA 2018 Schedule 1 Part 1) and, for safeguarding, substantial public interest (Art 9(2)(g) with Schedule 1 Part 2 paragraph 18 — safeguarding of children).
- Criminal offence data (DBS) — Schedule 1 safeguarding and employment conditions, under our appropriate policy document.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects. Where AI tools assist administrative work, no shortlisting or appointment decision is made by an AI tool alone, and our NEO Artificial Intelligence Policy applies.
4. Who we share it with
HMRC, our pension provider and payroll processor; the Disclosure and Barring Service and the DfE (vetting and, where legally required, referrals); the Teaching Regulation Agency where a referral duty arises; local authorities and commissioning schools, limited to safer-recruitment assurance (for example, confirmation that checks have been completed — we provide confirmation, not certificate contents, unless legally required); our IT and platform providers acting as processors (including Google Workspace); our insurers and professional advisers; and Data Protection People as our external data protection service. We never sell your information.
Where a processor stores information outside the UK, we use UK adequacy regulations or the UK International Data Transfer Agreement / Addendum, applying the data protection test under the Data (Use and Access) Act 2025.
5. How long we keep it
In line with our retention schedule: staff records are kept for 7 years after employment ends; records of safeguarding allegations are kept in accordance with Keeping Children Safe in Education (at least until normal pension age, or 10 years from the allegation if longer); Single Central Record entries are maintained while you work with us; unsuccessful application records are kept for 6 months unless you consent to a longer talent-pool retention; systems audit logs are retained under our audit retention arrangements, which exist for child-safeguarding and accountability reasons.
6. Your rights
You can ask for access to your information (we respond within one calendar month), correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. Some rights are limited where safeguarding or legal obligations apply — for example, we cannot delete vetting records the law requires us to keep.
Complaints. You can complain to us electronically at privacy@nudgeeducation.co.uk (or by any other route in our Complaints Policy). We will acknowledge your data protection complaint within 30 days and respond without undue delay, as required by the Data (Use and Access) Act 2025 — in practice we aim much faster. You can also complain to the Information Commissioner’s Office (ico.org.uk / 0303 123 1113) at any time.
7. Changes
We will tell you about material changes to this notice before they take effect. The current version always lives in the policy library.