NEOby Nudge Education

Nudge Education Policy Library

NEO — Data Protection, Confidentiality and Privacy Policy

4 min read

Download as PDF
Date14 October 2026
Review DateDecember 2026, then annually, or sooner if practice or legislation changes
OwnerData Protection Officer (Nudge Education Ltd), with the external data protection adviser and the Director, NEO & Head of School
Approved byApproved by the Director, NEO & Head of School on 14 October 2026 under authority delegated by the Proprietor (CEO of Nudge Education Ltd) on 13 October 2026; for noting at the NEO board on 3 December 2026
Versionv10.26

A fully online alternative provision for learners aged 11–18

Where this policy lives

Twenty NEO documents refer to the “NEO Data Protection, Confidentiality and Privacy Policy”. This page is that policy’s front door. The policy itself is the Nudge Education Data Protection and Information Security Policy together with its NEO Online Addendum (v04.26, approved April 2026, review April 2027), which is published at the end of that page and applies the company policy to the online provision: lawful bases for learner data, the ICO Children’s Code, Google Workspace as the platform, learner accounts and retention, transcripts, filtering and monitoring data, data sharing with commissioners and home schools, breach response and learners’ rights. There is one data protection policy for Nudge Education Ltd, and NEO’s provisions sit inside it, so that nobody has to work out which of two documents is current.

What NEO staff need to know on one page

  • Controller: Nudge Education Ltd (Company Number 10192753) is the controller for all NEO learner, family and staff data. Commissioning local authorities and home schools are separate controllers for what they hold; sharing with them is under the placement agreement and the safeguarding information-sharing provisions.
  • Platforms: NEO learner data lives in the NEO Google Workspace tenant and the NEO operational system. It is not moved to personal accounts, to the Nudge Education tenant, or to any AI tool that has not been reviewed under the NEO — Artificial Intelligence Policy. The NEO platform DPIA covers Google Workspace, the transcription tool, Smoothwall Cloud Filter and Monitor, Peerscroller and Pear Deck, and is reviewed by the external data protection adviser.
  • Learner-facing documents: what learners and families are told is in the NEO — Privacy Notice for Learners (v0.3, 30 September 2026) and the NEO — Digital Consent and AI Safety Parent Guide. Where this policy and the Privacy Notice differ on a point of fact, the Privacy Notice is corrected or the practice is changed; the two are never left to disagree.
  • Recording and transcripts: live lessons are not recorded. Transcripts, where a host enables them, are kept for one term and used for safeguarding and lesson reporting only.
  • Sharing to safeguard: the Data Protection Act 2018 and UK GDPR do not prevent sharing information to keep a child safe. Staff share with the DSL first; the DSL decides onward sharing.
  • Breaches: any suspected breach goes to the DPO function the same day; the 72-hour ICO clock starts when NEO becomes aware. Learners’ and families’ rights requests go to neo@nudgeeducation.online and are answered within one month.
  • Where NEO stands today (14 October 2026): full-time learners learn on a NEO account and a NEO-managed Chromebook, where the protections in this policy apply in full. Learners on the Discovery Phase, part-time packages and tuition use their own devices, so protection is at account level only (see the NEO Remote Learning Policy). Learners who came to NEO from Nudge Education’s existing online tuition are being moved onto NEO accounts during the 2026/27 year; until a learner has a NEO account, their sessions run on the practitioner’s Nudge Education account and NEO has no account-level visibility of them. NEO is auditing those sessions, has identified the risk, and will update this page in December 2026 with the position then. NEO does not describe its data protection as complete where it is not.
  • Shared surfaces: learner and special-category data stay out of shared drives, chats and documents that are synced across the two Nudge tenants unless the DPIA covers it. Board papers carry counts, never names.

Graph View

Backlinks