Last Updated: March 2026

1. Our Mission and Values

At Challenge Partners, our mission is to reduce educational inequality and improve the life chances of all children. Through collaboration, challenge, and leadership development, we work to ensure every school community benefits from the combined wisdom of the education system. Our values of Excellence, Equity, Collaboration, Challenge, Innovation, and Courageous Leadership are embedded in this policy and underpin everything we do.

2. Introduction

Excellent communication and information sharing are critical to our network's success. We want all stakeholders—including our staff, partners, suppliers, and donors—to be comfortable with how we store and use their personal data. This policy explains our data practices and how we ensure compliance with the UK GDPR and the Data (Use and Access) Act 2025.

3. Who We Are

Challenge Partners is a national partnership of schools and trusts. We are a company limited by guarantee and a registered charity. We are registered with the Information Commissioner’s Office (ICO). Our Director of Finance & Operations is our designated Data Protection Officer (DPO).

4. How We Collect Your Personal Information

We collect information about you when you interact with us directly, or via your school/trust. This includes when:

• Your school or trust joins a network or programme.
• You sign up for a newsletter, attend an event, or contact us with an inquiry.
• You provide a donation or grant to the charity.
• Direct Interaction: We collect information—including contact details, financial information, and visual media (such as photography or video)—when you interact with us directly or via your school/trust.
• School and Trust visits & events: We collect data when you, your colleagues participate in school visits, programme activities, or Challenge Partners events.
• Publicly available sources: We may collect data from Companies House, the Charity Commission, or philanthropic research for donor due diligence.
• Our Website: We use cookies to improve your experience and analyse site traffic in accordance with PECR (as amended).

5. Detailed Use of Your Data

We use the information collected to enable collaboration across our partnership and fulfil our charitable objectives.

5.1. For School and Trust Partners

We use your professional contact details, role, and school-level data and images/video of staff and pupils to:

• Deliver Services: Manage your participation in our school and trust improvement programmes and networks.
• Evaluation & Research: Analyse programme impact and school improvement trends to share "combined wisdom" across the partnership and education sector.
• Support & Guidance: Provide tailored support, respond to complaints or queries, and facilitate peer-to-peer networking.
• Impact & Promotion: Showcase the impact of our work and celebrate school success through photography, film and names of contributors, used on our website, social media and marketing materials.
• Financial Management: Manage membership subscriptions and process payments for services.

5.2. For Donors and Grant-makers 

We use your contact and financial information, including data from publicly available sources, to:

• Relationship Management: Manage our relationship with you and provide updates on our mission and impact.
• Due Diligence: Conduct "Know Your Donor" checks to comply with anti-money laundering regulations and the 2025 Act’s standards for ethical fundraising.
• Strategic Research: Understand your professional history and philanthropic interests to ensure our engagement remains relevant and proportionate.

5.3. For Current and Former Staff

We use your personal, financial, and HR data to:

• Employment Management: To manage payroll, pensions, and tax contributions.
• HR Administration: To fulfil our duties as an employer, manage performance, and provide professional references.
• Legal Compliance: To meet HMRC requirements and ensure health and safety standards are upheld in the workplace.

5.4. For Third-Party Contractors

We use your contact and financial information to:

• Contract Management: To formalise agreements, manage workflows, and process payments for services rendered.
• Operational Delivery: To enable you to interact with our school partners or staff where required for your specific project or role.
• To thank contractors in our Impact Reporting that directly contribute to our mission.

6. Lawful Basis for Processing

We only process data where we have a legal basis to do so under the UK GDPR and the 2025 Act:

• Consent: Where you have given clear consent for a specific purpose. This includes the use of identifiable images or videos of school/trust employees or pupils, which we only use after obtaining explicit consent or receiving written confirmation from our partners that the necessary consents for Challenge Partners’ use have been obtained and verified.
• Contract: Where processing is necessary for a contract (e.g., school partnership agreements or employment contracts).
• Legal Obligation: Necessary for compliance with the law (e.g., Gift Aid reporting or employment law).
• Legitimate Interests: For our internal administrative purposes or "Recognised Legitimate Interests" under the 2025 Act, such as safeguarding, crime prevention, or furthering our charitable mission through proportionate fundraising.

7. Marketing and the "Charity Soft Opt-in"

We use personal data to offer insights into the education sector and share updates on our programmes and networks.

• The Soft Opt-in: Under the Data (Use and Access) Act 2025 and PECR (as amended), if you are an existing supporter or partner, we may contact you about similar charitable aims via a "soft opt-in" email (where a specific opt-in option selection is no longer required).
• Your Choice: You can opt out of marketing at any time via the "unsubscribe" link in our emails or by contacting us directly.

8. AI and Automated Processing

To improve efficiency, we may use AI tools for data analysis or donor research. We ensure that:

• No solely automated decisions are made that have a legal or significant effect on you without a right to human intervention and a right to contest the decision.
• All AI-generated insights are subject to human review.
• We only use AI providers that meet high standards for UK data security and "explainability" requirements.

9. Sharing and Keeping Your Data

We will never sell your personal information. We share data only with trusted third parties (such as Lead Reviewers, Programme Facilitators or HMRC) when necessary. We retain data only as long as required to fulfil our charitable objectives, respond to queries, or satisfy statutory rules (e.g., 6 years for financial records).

10. Your Rights and Complaints

You have the right to Access, Correct, Erase, or Port your data.

• Subject Access Requests: We perform "reasonable and proportionate" searches and may verify your identity before releasing data. In accordance with the 2025 Act, we may "stop the clock" on the response period if we require further information to clarify your request or verify your identity.
• Complaints: In accordance with the 2026 Statutory Complaints Procedure, we will acknowledge data complaints within 30 days and investigate without undue delay. The ICO generally requires you to exhaust this internal process before escalating a matter to them.

11. Cookies

• A cookie consists of information sent by a web browser and stored by the browser. The information is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.
• We use Google Analytics to analyse the use of this website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users' computers. The information generated relating to our website is used to create reports about the use of the website. Google will store this information. Google's privacy policy is available here.
• Most browsers allow you to reject all cookies, whilst some browsers allow you to reject just third-party cookies. For example, in Internet Explorer you can refuse all cookies by clicking "Tools", "Internet Options", "Privacy", and selecting "Block all cookies" using the sliding selector. Blocking all cookies will, however, have ae negative impact upon the usability of many websites.
• Our website does contain links to other websites. We are not responsible for the privacy policies of practices of third-party websites.

12. Contact Us

For any questions regarding this policy, please contact our Data Protection Officer:

• Please contact us: via the website here
• Post: Challenge Partners, Oxford House, 49 Oxford Road, London N4 3EY.