Privacy Policy

Last updated: 30.04.2026

1. Introduction

This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website or engage with our sustainability assessment, audit and advisory services for schools and education settings.

We are committed to protecting privacy, handling data responsibly and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognise that schools, trusts and education professionals handle sensitive information and expect the highest standards of confidentiality and care.

This policy should be read alongside our Terms of Use, Rules of Service, and Data Protection & Confidentiality Statement.

2. Who We Are

We provide independent sustainability assessment, audit, reporting, strategy writing and guidance services to schools, academies and Multi‑Academy Trusts.

For the purpose of data protection law:

• Data Controller: eco-soar®
• Contact email: info@eco-soar.co.uk
• Website: eco-soar.co.uk

Where we act as an independent auditor or assessor, schools or trusts remain the owners of their data, and we act as an independent professional processor or reviewer in line with agreed purposes.

3. Information We May Collect

3.1 Website Visitors

When you visit our website, we may collect limited technical information such as:

• IP address
• Browser type and device information
• Pages visited and time spent on the site

This data does not normally identify you personally and is used only to understand website usage and improve functionality.

3.2 Contact and Enquiry Information

If you contact us via forms, email or phone, we may collect:

• Name
• Job title and organisation
• Email address and phone number
• Details of your enquiry

This information is provided voluntarily and used solely to respond to your request or discuss our services.

3.3 School and Trust Audit Information

When delivering sustainability assessments or audits, we may have access to information including (but not limited to):

• Energy, water, waste and carbon data
• Policies, strategies and governance documents
• Procurement or operational information
• Estate or building‑related information
• Engagement or curriculum‑related evidence

This information may be commercially sensitive or operationally confidential and is handled accordingly.

4. How We Use Information

We use information only where there is a clear and lawful purpose, including to:

• Respond to enquiries and communicate about our services
• Deliver sustainability assessments, audits and reporting
• Provide guidance, strategy writing and advisory support
• Produce audit outputs agreed with schools or trusts
• Improve our website and user experience

We do not sell, trade, or reuse datafor unrelated or marketing purposes without consent.

5. Lawful Basis for Processing

Under UK GDPR, we process personal data on the following lawful bases:

• Legitimate interests –      delivering independent professional assessment and guidance
• Contractual necessity –      where services have been formally commissioned
• Consent – where required (for example, optional      communications)

We collect and retain only the minimum information necessary to fulfil the agreed purpose.

6. Confidentiality and Professional Standards

All information provided to us is treated as confidential.

We commit to:

• Using information solely for the agreed assessment or advisory      purpose
• Not sharing data with third parties without explicit consent
• Not publishing identifiable school or trust data without written      agreement
• Reporting findings at school or trust level unless otherwise agreed

All work is carried out in accordance with:

• UK GDPR principles
• Professional codes of conduct
• Registered Environmental Practitioner (REnvP) standards where applicable
• Principles of integrity, impartiality and confidentiality

7. Data Security

We take reasonable and proportionate measures to protect information, including:

• Secure digital storage
• Access limited to authorised individuals only
• Avoiding unnecessary duplication of data
• Secure deletion once data is no longer required

Where physical documents are used, they are stored securely and returned or destroyed appropriately.

8. Data Retention

We retain information only for as long as necessary to:

• Complete the agreed work and reporting
• Respond to reasonable follow‑up queries
• Support reassessment, where agreed

Unless otherwise agreed, information is not retained beyond a reasonable professional timeframe.

9. Sharing of Information

We do not share personal or school‑level data externally unless:

• You have given explicit consent, or
• There is a legal obligation to do so

Schools and trusts may choose to share audit results for:

• Governor or board assurance
• Internal reporting and improvement planning
• External awards or recognition

Such sharing is controlled by the school or trust, not by us.

10. Cookies and Analytics

Our website may use limited cookies or analytics tools to:

• Understand how the site is used
• Improve performance and usability

These do not normally collect identifiable personal data. You can control cookies through your browser settings.

11. Your Data Protection Rights

Under UK GDPR, you have the right to:

• Request access to personal data we hold about you
• Request correction of inaccurate data
• Request clarification on how your data is used
• Request deletion of data where appropriate

Requests should be made in writing to: info@eco-soar.co.uk

We will respond within statutory timescales.

12. Links to Other Websites

Our website may contain links to external sites. We are not responsible for the privacy practices or content of external websites, and we encourage users to review their privacy policies separately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, regulatory or operational changes.
The latest version will always be published on our website.

14. Summary Statement

All personal and school‑level information is treated with care, confidentiality and professionalism. Data is used solely to deliver independent sustainability assessment, audit, reporting and guidance — nothing more.