ParentCheck+ Privacy Policy

Effective date: 03 March 2026

This Privacy Policy explains how Redwood Collections Ltd ("we", "us") uses personal data when providing the ParentCheck+ service (the "Service").

1) Who we are

2) Important roles (schools and screened individuals)

ParentCheck+ is used by independent schools to screen individuals (for example, parents/fee payers).

  • For screening data (the people a school asks us to screen): the school is the data controller and we act as a data processor on the school's instructions.
  • For school staff account data (the people who log into ParentCheck+): we are the data controller for creating and managing those user accounts.

3) What personal data we collect

A. School staff users (account data)

  • Name
  • Work email address
  • School name

B. Individuals screened by a school (screening input + results)

  • First name
  • Last name
  • Date of birth
  • School internal reference (optional)
  • Screening results (matches/flags generated from the checks)

We don't ask schools to provide special category data (such as health data) via the Service.

4) What we use data for

A. School staff account data (we are controller)

We use this to:

  • create and manage user accounts and access to the portal
  • provide support and respond to requests
  • maintain security and prevent misuse

B. Screening data (we are processor)

We use this to:

  • run single and batch screening checks
  • return results to the school through the portal

5) Legal bases (where we are controller)

When we act as controller for school staff account data, we rely on:

  • Legitimate interests (operating a B2B screening portal, managing accounts, preventing fraud and abuse), and/or
  • Performance of a contract (providing the Service to the school)

When we process screening data, the school determines the lawful basis. Schools commonly rely on legitimate interests and/or compliance-related obligations.

6) Who we share data with

We share personal data only with:

  • the school using the Service (for screening results and administration)
  • service providers that help us deliver the Service, including:
    • OpenSanctions (data source used for screening checks)
    • Render (hosting provider for the Service infrastructure)

We do not sell personal data.

7) Where data is processed

We host and run the Service using our hosting provider. Render allows customers to select the region where a service/datastore is created.

If any personal data is processed outside the UK, we use appropriate safeguards required under UK data protection law (for example, contractual protections).

8) How long we keep data

Screening data (inputs + results)

We retain screening inputs and results for 7 days, then hard delete them.

School staff account data

We retain account information while the school has an active relationship with us, and afterwards for as long as needed for legitimate business purposes (for example, security, audits, and handling disputes). A typical retention period is up to 6 years after the end of the customer relationship.

9) Security

We use appropriate technical and organisational measures designed to protect personal data, including access controls and security monitoring.

10) Cookies and analytics

At present, the ParentCheck+ portal does not use analytics or advertising cookies. If this changes, we will update this policy.

11) Your rights

Rights differ depending on whether we are the controller:

  • If you are a screened individual: the school is the controller, so you should contact the school to exercise your rights (access, correction, deletion, objection, etc.). We will assist the school where required.
  • If you are a school staff user (portal account): you can contact us at support@parentcheck.co.uk to exercise your rights in relation to your account data.

You also have the right to complain to the UK data protection regulator, the Information Commissioner's Office (ICO).

12) Changes to this policy

We may update this policy from time to time. We will post the latest version in the Service and update the effective date above.