Privacy Policy

1. Who we are

This privacy policy applies to CDS SEND Inclusion, operated by Cristina Di Santo as a sole trader.

Data controller

Cristina Di Santo

Address

Chelmsford, Essex

Email

info@cdssendinclusion.co.uk

Website

cdssendinclusion.co.uk

Cristina Di Santo (trading as CDS SEND Inclusion) is registered with the Information Commissioner's Office (ICO) as a data controller. ICO registration number ZC171864. Registration is reviewed annually.

2. What personal data I collect

I collect only the personal data that is necessary for the purposes described in this policy.

2.1 Data you provide directly

• Your name, job title, and the name of your school, college, or organisation.
• Your email address and telephone number.
• Any information you share in an enquiry, contact form submission, or email.
• Information provided in the course of an engagement — for example as part of an audit or advisory project.

2.2 Data collected automatically

• Basic website analytics, such as pages visited and time spent on the site, collected through the website platform hosted by Ionos. This data is aggregated and does not identify you personally.
• IP address and browser type, collected automatically by the website hosting platform.

2.3 Data I do not collect

I do not collect or process any of the following:

• Special category personal data — such as health information, ethnicity, or religious belief — unless you choose to share it voluntarily in the course of an engagement.
• Payment card data — invoices are paid by bank transfer only.
• Data relating to children or young people directly — any pupil data shared as part of an audit must be anonymised before it is shared with me.

3. How I use your personal data

4. Who I share your data with

I do not sell, rent, or share your personal data with third parties for marketing purposes. I may share your data only in the following limited circumstances:

• With professional advisers — such as my accountant — where necessary and subject to confidentiality obligations.
• With technology service providers — such as my website host and email provider — who process data on my behalf as data processors. These providers are subject to appropriate data processing agreements.
• Where I am legally required to do so — for example in response to a court order or regulatory requirement.

I do not transfer your personal data outside the United Kingdom.

5. Cookies and website analytics

The CDS SEND Inclusion website may use cookies and similar technologies to support website functionality and collect basic analytics data. No cookies are used for advertising or tracking purposes.

You can control cookie settings through your browser. Disabling cookies may affect some website functionality but will not prevent you from accessing the site.

The website is built on the Lovable platform. For further information about how Lovable processes data, please refer to Lovable's own privacy policy at lovable.dev.

The CDS SEND Inclusion website is hosted by IONOS Ltd. As part of normal website hosting, IONOS may process basic visitor data including IP addresses and browser information. For further information, please refer to the IONOS privacy policy at ionos.co.uk.

6. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access

You can request a copy of the personal data I hold about you.

Right to rectification

You can ask me to correct inaccurate or incomplete data.

Right to erasure

You can ask me to delete your data where there is no legitimate reason for me to continue processing it.

Right to object

You can object to processing based on legitimate interests.

Right to restrict processing

You can ask me to pause processing of your data in certain circumstances.

Right to data portability

Where processing is based on contract or consent, you can request your data in a portable format.

To exercise any of these rights, please contact me at info@cdssendinclusion.co.uk. I will respond within one calendar month.

7. How I keep your data secure

I take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Using password-protected devices and accounts.
• Storing documents containing personal data in password-protected or encrypted locations.
• Using secure, reputable email and cloud storage providers.
• Not retaining personal data beyond the retention periods set out in Section 3.
• Using SSL encryption (HTTPS) on the CDS SEND Inclusion website to protect personal data submitted via the contact form during transmission.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, I will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

8. Links to other websites

The CDS SEND Inclusion website may contain links to external websites. I am not responsible for the privacy practices or content of those websites. Please read their privacy policies before sharing personal data with them.

9. Children's data

The CDS SEND Inclusion website is not directed at children and I do not knowingly collect personal data from anyone under the age of 18 through this website.

In the course of an audit or other engagement, client organisations may share anonymised pupil data with me. I require that all pupil data is anonymised before it is shared, and I do not retain any pupil-level data beyond the completion of the relevant engagement.

10. Changes to this policy

I may update this privacy policy from time to time. The current version will always be available on the CDS SEND Inclusion website at cdssendinclusion.co.uk. The date at the top of this policy indicates when it was last updated.

Where changes are material, I will take reasonable steps to bring them to your attention.

11. Contact

If you have any questions about this privacy policy or how I handle your personal data, please contact: