Skip to content
codehamsters.com

Data protection and complaints

Data protection (GDPR) policy

How we comply with UK GDPR: who is responsible, how we keep personal information safe, and what we do about requests and data breaches.

All policies and forms

Code Hamsters (Simple Platform Work Limited)
Version 1.0, approved 13 October 2026 by Mathew Long, Designated Safeguarding Lead (DSL). Next review: October 2027, or sooner after any incident or change in the law or guidance.

Code Hamsters holds personal information about parents, carers and children, including health information. This policy explains how we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our privacy policy tells families what information we collect, why, who we share it with and how long we keep it.

1. Who is responsible

Simple Platform Work Limited is the controller of the personal information we hold. Mathew Long is responsible for data protection and is the person to contact at matt@codehamsters.com. As a small organisation we are not required to appoint a Data Protection Officer.

We pay the Information Commissioner’s Office (ICO) data protection fee each year, as the law requires.

2. Our principles

Whenever we handle personal information, we make sure it is:

  • used lawfully, fairly and openly, as our privacy policy describes
  • collected only for clear purposes, and not used for anything unrelated
  • limited to what we actually need
  • accurate, and corrected when we learn it is wrong
  • kept no longer than our privacy policy says
  • kept secure

We keep records that show how we meet these principles.

3. Health and other sensitive information

We collect health, medical and additional needs information only to keep children safe, with a parent’s or carer’s explicit consent, or where safeguarding law allows. Only the tutors working with a child, and anyone who needs it in an emergency, can see it. We delete it within the times set out in our privacy policy. This section, together with sections 2 and 4, is our appropriate policy document under Schedule 1 of the Data Protection Act 2018.

4. Keeping information secure

  • Information is held in access-controlled business accounts, not in personal accounts.
  • Only people who need information to do their job can see it.
  • Paper registers and forms are kept with the tutor at sessions and stored securely afterwards.
  • We securely delete or shred information when we no longer need it.
  • Everyone who works for us is trained in data protection and confidentiality.
  • Service providers who handle information for us do so under a written contract and only on our instructions.

5. Requests from families

Anyone can ask to see, correct or delete the information we hold about them or their child, or use their other rights listed in our privacy policy, by emailing matt@codehamsters.com.

  • We may ask for proof of identity before we act on a request.
  • We respond within one month. For complex or multiple requests we may extend this by up to two further months, and we will tell you why.
  • Requests are usually free. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will explain why.
  • Some information is exempt. For example, we may withhold information if sharing it could put a child at risk, and we keep safeguarding records even if we are asked to delete them.

6. Data breaches

A data breach is when personal information is lost, stolen, destroyed, changed or shared by mistake. If one happens, we will:

  1. act straight away to contain it and recover the information
  2. assess the risk to the people affected
  3. report it to the ICO within 72 hours of becoming aware of it, unless it is unlikely to put anyone at risk
  4. tell the people affected without delay if there is a high risk to them
  5. record every breach, and what we did, even if we do not need to report it

Anyone who works for us must report a suspected breach to Mathew Long immediately. A breach that involves a child’s safety is also handled under our safeguarding and child protection policy.

7. Sharing information to protect children

Data protection law does not stop us sharing information to keep a child safe. Where we are worried about a child, we follow our safeguarding policy and our child protection records policy.

8. New activities

Before we start using personal information in a new way, or use a new service provider, we check that it complies with this policy. If it is likely to be high risk, we assess the risk properly first.

9. Complaints

If you are unhappy with how we have handled your information, please contact us first, as our complaints policy explains. You also have the right to complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.