Privacy Policy

Last updated: 22 August 2025

Bales College (“we”, “our”, “us”) is committed to protecting the privacy of all visitors to our website. This Privacy Policy explains how we collect, use, and protect your personal data when you interact with our website, including how we safeguard information relating to children aged 12–18.

1) Who we are (Data Controller)

Bales College
Address: 2 Kilburn Lane, London, W10 4AA. BALES COLLEGE
Email (privacy contact): ben.moore@balescollege.co.uk (Ben Moore)
Telephone: 020 8960 5899

If you have questions about this policy or how we handle your data, contact Ben Moore using the email above.

2) The data we collect

When you use our website, we may collect:

• Personal information: name, email address, phone number, and details you provide via forms (e.g., enquiries, open day registrations, applications).

• Children’s information (12–18): details about prospective/current students provided by parents/guardians or the students themselves (e.g., name, age, course interests).

• Technical information: IP address, device, browser type/version, operating system.

• Usage data: pages viewed, time on page, referral source, interactions with content and forms.

3) How we collect data

• Directly from you: when you submit a form, register for events, request a prospectus, or contact us.

• From parents/guardians: where information is provided on behalf of a child.

• Automatically: via cookies and similar technologies.

• Third-party tools: Google Analytics, Google Ads, and HubSpot (forms/CRM/email).

4) How and why we use personal data (lawful bases)

We use personal data to:

• Respond to enquiries and provide information about courses, admissions, fees, and events (legitimate interests; contract where applicable).

• Process applications and event registrations (contract; legitimate interests).

• Improve our website and services using analytics/diagnostics (consent for non-essential cookies; legitimate interests for security/essential).

• Run marketing and admissions campaigns (Google Ads; HubSpot email/CRM). Direct email marketing is based on consent (you can withdraw anytime).

• Safeguard our community and comply with law (legal obligation; vital interests in rare cases).

5) Children’s privacy (12–18)

Because our college serves students aged 12–18, we take particular care with children’s data:

• Enquiry and application forms concerning under-18s should be completed by a parent or guardian, or with their knowledge/consent where appropriate.

• We do not knowingly collect personal data directly from children under 13 without parental consent.

• Marketing communications are directed primarily at parents/guardians.

• Any personal data about a child is used only for legitimate school purposes (admissions, enrolment, pastoral/academic support, safeguarding, communications).

6) Cookies and similar technologies

Our website uses cookies to operate, understand usage, and (with your consent) help us improve and tailor information.

• Essential cookies (e.g., security, load balancing): necessary for the site to work.

• Analytics (Google Analytics): helps us understand how visitors use the site (pages visited, session duration).

• Advertising (Google Ads): helps us reach families researching post-16 education; may include remarketing to site visitors.

• HubSpot: records form submissions and on-site engagement; supports our CRM and email communications.

You can manage or withdraw cookie consent at any time via our cookie banner or your browser settings. For more detail, see our Cookie Policy (if separate).

7) Disclosures and processors

We do not sell or rent your data. We share personal data only with trusted providers who process it on our instructions, including:

• Google (Analytics, Ads)

• HubSpot (CRM, forms, email)

• Website/IT service providers (WordPress hosting, maintenance, security)

These providers must keep your data secure and use it only for agreed purposes.

8) International transfers

Some providers (e.g., Google, HubSpot) may transfer data outside the UK/EEA. Where this occurs, we rely on appropriate safeguards (e.g., UK International Data Transfer Agreement/Standard Contractual Clauses and supplementary measures) to protect your data.

9) How long we keep data

We keep personal data only as long as necessary for the purposes above or to meet legal/record-keeping requirements. Typical examples:

• General enquiries: up to 2 years

• Admissions/applicant records: in line with statutory education retention requirements

• Marketing preferences: retained until you withdraw consent or object

10) Your rights (UK GDPR)

You have the right to:

• Access your personal data

• Rectify inaccurate data

• Erase data (where applicable)

• Restrict or object to processing (including direct marketing)

• Withdraw consent at any time (this will not affect prior lawful processing)

• Data portability (for certain data)

To exercise your rights, contact ben.moore@balescollege.co.uk. You can also lodge a complaint with the ICO (Information Commissioner’s Office) if you’re unhappy with how we’ve handled your data.

11) Security

We use appropriate technical and organisational measures to protect personal data, including secure hosting, access controls, staff training, and encryption where appropriate.

12) Third-party links

Our site may link to third-party websites. Those sites have their own privacy information; we are not responsible for their content or practices.

13) Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. The latest version will always appear on this page.