Privacy Policy

1. Who We Are

This website, apto-schola.co.uk, is operated by Apto Schola Consultancy Ltd, a company registered in England and Wales. Our registered company number is 14570165 and our registered office address is 222 Kensal Road, Kensington and Chelsea, London, W10 5BN.

We are the data controller in respect of the personal data processed in connection with this website and our consultancy services. This means we determine the purposes and means of processing your personal data.

We are registered with the Information Commissioner's Office. Our ICO registration number is ICO:00014337163. Apto Schola Consultancy Ltd has not appointed a Data Protection Officer.

All data protection queries should be directed to us at info@apto-schola.co.uk or by post to our registered office address above.

2. What Personal Data We Collect

We collect and process the following categories of personal data.

Information you provide to us directly

When you contact us by email, telephone, WhatsApp, or WeChat, or when you submit an enquiry through our website, we may collect your name, email address, telephone number, and the contents of your communication with us, including the contents of any email attachments you choose to send to us.

In the course of providing our consultancy services, we collect information about your child, including their academic profile, school history, interests, character, and aspirations, to the extent that you choose to share this information with us for the purpose of identifying the most suitable school placement. This information is collected from you as the parent or guardian of the child, not from the child directly.

Where you share personal data about any other individual in the course of your enquiry or engagement with us, that personal data will be collected and processed in accordance with this Privacy Policy.

We do not routinely seek special category personal data as defined under Article 9 of the UK General Data Protection Regulation. However, in the course of discussing a child's needs and the most suitable school placement, you may choose to share information that constitutes special category data, such as information about a child's health, a learning difference, a disability, or a religious requirement. Where you choose to share such information with us, we process it on the basis of your explicit consent under Article 9(2)(a) of the UK General Data Protection Regulation, for the sole purpose of identifying and securing an appropriate school placement. You may withdraw that consent at any time by contacting us, as described in Section 7, although this may affect our ability to provide our services. We ask that you do not share special category data about a child unless it is relevant to the placement.

Information collected automatically

When you visit our website, we collect certain technical data automatically through cookies and similar technologies. This includes your IP address, browser type, device type, pages visited, and time spent on the website. This data is collected by Squarespace, our website platform, and by Google Analytics. Further details are set out in Section 8 of this policy.

3. How We Use Your Personal Data and Our Lawful Basis

We process your personal data for the following purposes and on the following lawful bases under Article 6 of the UK General Data Protection Regulation.

To respond to your enquiry

When you contact us with an enquiry, we process your personal data on the basis of our legitimate interests in responding to prospective clients and managing our business operations.

To provide our consultancy services

Where you engage Apto Schola to provide admissions consultancy services, we process your personal data and the personal data of your child on the basis that processing is necessary for the performance of a contract to which you are party, or to take steps at your request prior to entering into a contract.

To communicate with you in the course of providing our services

We process your personal data to communicate with you by email, telephone, WhatsApp, and WeChat in the course of providing our services. This processing is necessary for the performance of our contract with you.

To maintain records of our business activities

We retain records of our communications and engagements on the basis of our legitimate interests in maintaining accurate business records and in defending any legal claims that may arise.

To improve our website

We process technical data collected automatically through our website on the basis of our legitimate interests in understanding how our website is used and improving its performance. This processing is carried out through Squarespace Analytics and Google Analytics, both of which are described further in Section 5 and Section 8 of this policy.

Automated decision-making

Apto Schola does not carry out any automated decision-making or profiling in respect of your personal data.

Direct marketing

Apto Schola does not process your personal data for direct marketing purposes.

Provision of personal data

The provision of your personal data to Apto Schola is not a statutory requirement. It is, however, a practical requirement of engaging our services. If you choose not to provide the personal data necessary for the admissions process, we may be unable to provide our consultancy services to you in full or at all.

4. Personal Data Relating to Children

In the course of providing our consultancy services, Apto Schola processes personal data relating to children, including information about a child's academic profile, school history, personal character, interests, and aspirations. This data is provided to us by the child's parent or guardian and is processed solely for the purpose of identifying and securing the most suitable school placement for the child.

We process children's personal data with particular care, in accordance with our obligations under the UK General Data Protection Regulation and the Data Use and Access Act 2025, which requires us to take into account children's higher protection matters when processing their personal data. In particular, we recognise that children may be less aware of the risks associated with the processing of their personal data, and that they merit specific protection. We collect only the information that is necessary for the purpose of the placement, we do not share children's personal data with any third party other than the schools being considered for that child's placement, and we retain children's personal data only for the periods set out in Section 6 of this policy.

Where a parent or guardian submits information about their child through a contact form on our website, that information will also be processed by Squarespace Inc. as our website platform operator, as described further in Section 5 of this policy.

5. Who We Share Your Personal Data With

We share your personal data only in the following circumstances.

Schools

In the course of providing our consultancy services, we share relevant personal data about you and your child with the schools being considered for your child's placement. All the schools are located in the United Kingdom. This sharing is necessary for the performance of our contract with you and is an integral part of the admissions process.

Squarespace

Our website is hosted and operated by Squarespace Inc., which processes certain personal data on our behalf as a data processor under a Data Processing Agreement. Squarespace processes data in connection with the operation of our website, including any data submitted through contact forms and technical analytics data. Squarespace's servers are primarily located in the United States. This transfer is subject to appropriate safeguards under the UK-US Data Bridge framework, under which Squarespace is certified through the UK Extension to the EU-US Data Privacy Framework. You can verify Squarespace's current certification status at dataprivacyframework.gov/list.

Google Analytics

We use Google Analytics, provided by Google LLC, to collect and analyse information about how visitors use our website. Google Analytics processes technical data including IP address, browser type, device type, and pages visited. Google's servers are primarily located in the United States. This transfer is subject to appropriate safeguards under the UK-US Data Bridge framework, under which Google is certified through the UK Extension to the EU-US Data Privacy Framework. You can verify Google's current certification status at dataprivacyframework.gov/list.

GoDaddy

Our email account at info@apto-schola.co.uk is hosted and operated by GoDaddy Inc., which processes personal data contained in email communications on our behalf as a data processor. GoDaddy's servers are primarily located in the United States. This transfer is subject to appropriate safeguards under the UK-US Data Bridge framework, under which GoDaddy is certified through the UK Extension to the EU-US Data Privacy Framework. You can verify GoDaddy's current certification status at dataprivacyframework.gov/list.

WeChat

If you choose to contact us via WeChat, your communications and associated personal data will be processed by Tencent Holdings Ltd, the operator of WeChat, whose servers are located in the People's Republic of China. China does not have a UK adequacy decision. This transfer takes place because you have chosen to initiate contact with us via WeChat, and the transfer is therefore necessary to take steps at your request prior to entering into a contract. Where an engagement proceeds, we will ordinarily continue substantive correspondence through email, telephone, or WhatsApp. If you would prefer at any point to communicate through a channel that does not involve a transfer to China, you are welcome to contact us by email, telephone, or WhatsApp instead.

WhatsApp

If you choose to contact us via WhatsApp, your communications and associated personal data will be processed by Meta Platforms Inc., the operator of WhatsApp, whose servers are primarily located in the United States. This transfer is subject to appropriate safeguards under the UK-US Data Bridge framework, under which Meta Platforms Inc. is certified through the UK Extension to the EU-US Data Privacy Framework. You can verify Meta's current certification status at dataprivacyframework.gov/list.

Legal obligations

We may disclose your personal data to law enforcement agencies, courts, or other public authorities where we are required to do so by applicable law.

We do not sell your personal data to any third party. We do not share your personal data with any third party for marketing purposes.

Apto Schola periodically reviews the certification status of its data processors under the UK-US Data Bridge framework to confirm that appropriate safeguards remain in place. For further information about how each of the third-party processors named above handles personal data, please refer to their respective privacy policies.

6. How Long We Keep Your Personal Data

We retain your personal data for the following periods.

Enquiry data from prospective clients who do not proceed to engagement: 12 months from the date of last contact.

Personal data of active clients and personal data relating to their child, including all associated communication records: for the duration of the engagement and for a period of six years thereafter. This retention period reflects our legitimate interests in maintaining records in accordance with the Limitation Act 1980, which governs the period within which contractual claims may be brought.

General communication records from prospective clients who do not proceed to engagement: two years from the date of last contact.

At the end of the applicable retention period, your personal data will be securely deleted or anonymised.

Please note that personal data held by third-party processors, including Squarespace, Google Analytics, GoDaddy, WhatsApp, and WeChat, is subject to those processors' own retention and deletion practices. We encourage you to review the privacy policies of each processor for further information.

7. Your Rights

Under the UK General Data Protection Regulation, you have the following rights in respect of your personal data.

The right of access

You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request. We will respond to your request within one month of receipt. Where your request is complex or where we receive a number of requests simultaneously, we may extend this period by a further two months. We will notify you of any such extension within one month of receiving your request. Where we reasonably require you to confirm your identity or to clarify the scope of your request in order to respond, we may pause the response period until you provide the information required, at which point the response period resumes.

The right to rectification

You have the right to request that we correct any personal data we hold about you that is inaccurate or incomplete.

The right to erasure

You have the right to request that we delete your personal data in certain circumstances, including where the data is no longer necessary for the purpose for which it was collected.

The right to restriction of processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or where you have objected to our processing.

The right to data portability

Where we process your personal data on the basis of contract necessity or consent, and the processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

The right to object

You have the right to object to our processing of your personal data where that processing is based on our legitimate interests. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. As noted in Section 3, Apto Schola does not process personal data for direct marketing purposes, and accordingly the absolute right to object to direct marketing processing does not arise in practice.

The right to withdraw consent

Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The right to lodge a complaint with the ICO

You have the right to lodge a complaint with the Information Commissioner's Office if you believe that we have processed your personal data in a manner that is not compliant with UK data protection law. Further details of how to contact the ICO are set out in Section 9 of this policy.

Responses to data subject requests are provided free of charge in the first instance. Where requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or to decline to respond, in accordance with Article 12 of the UK General Data Protection Regulation. Where we intend to charge a fee or decline a request on these grounds, we will notify you promptly and explain our reasons.

To exercise any of the rights set out above, please contact us at info@apto-schola.co.uk or by post to our registered office address. We will respond to your request within one month of receipt, subject to the extension and pause provisions noted above in relation to Subject Access Requests.

8. Cookies

Our website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit a website. The use of cookies on our website is governed by the Privacy and Electronic Communications Regulations 2003, as amended by the Data Use and Access Act 2025.

Strictly necessary cookies

The following strictly necessary cookies are placed on your device by Squarespace to enable the operation of the website. These cookies do not require your consent and cannot be disabled without affecting the functioning of the website.

Squarespace places strictly necessary cookies for website security, including protection against cross-site request forgery attacks, and for the operation of essential website features. These cookies are first-party cookies set by Squarespace and vary depending on the features used on the website.

Analytics and performance cookies

The following analytics cookies are placed on your device only with your consent, which you may provide or decline through our cookie consent banner when you first visit the website. You may change your cookie preferences at any time by accessing the cookie settings on our website. If you decline analytics cookies, no analytical tracking will take place during your visit.

Squarespace Analytics places a unique visitor cookie with a duration of two years, which is used to estimate the total number of individual visitors to the website. Squarespace Analytics also places a session cookie with a duration of 30 minutes, which is used to count visits to the website within a single browsing session.

Google Analytics places cookies on your device to collect information about how you use the website, including the pages you visit, the time you spend on the website, and the device and browser you use. This information is used to improve the performance and content of the website. You may also opt out of Google Analytics at any time by installing the Google Analytics opt-out browser add-on, available at tools.google.com/dlpage/gaoptout.

For further information about how to manage and disable cookies through your browser settings, please refer to your browser's help documentation.

9. Data Protection Complaints

If you have a concern about the way in which we have handled your personal data, you have the right to make a complaint to us directly. You may submit a data protection complaint to us electronically using the contact form on our website, or by email to info@apto-schola.co.uk, or by post to our registered office address. We will acknowledge receipt of your complaint within 30 days, will investigate it without undue delay, will keep you informed of the progress of our investigation, and will inform you of the outcome without undue delay.

If you are not satisfied with our response, or if you believe that we are processing your personal data in a manner that is not compliant with UK data protection law, you have the right to lodge a complaint with the Information Commissioner's Office, the UK's supervisory authority for data protection matters.

The Information Commissioner's Office can be contacted at:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

Website: ico.org.uk

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The date at the top of this policy indicates when it was last updated. Where material changes are made to this policy, we will notify individuals whose personal data we are processing directly where practicable, before those changes take effect. We encourage you to review this policy periodically.

11. Governing Law

This Privacy Policy is governed by the laws of England and Wales. Any disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.