Privacy Policy

1. Who we are

WBS Guardianship (“we”, “us”) is the UK educational guardianship service operated by Which British School. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the data controller for the personal information described in this policy.

You can contact us about anything in this policy at guardians@whichbritishschool.com.

WBS Guardianship and Which British School are operated by Which Independent Schools Ltd., a company registered in England and Wales under company number 09287591, with its registered office at 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom.

2. Who this policy covers

• Students in our guardianship care — almost all of whom are children.
• Parents, carers and the education agents who act for them.
• Host families, including every member of their household.
• Staff at the schools our students attend, and other professional contacts.
• Our own staff and volunteers.

3. The information we hold

What we hold depends on your relationship with us. It can include:

• Identity and contact details — names (including Chinese names), date of birth, nationality, phone, email, address and preferred language.
• Education and placement details — school, boarding house, year group, tutors, term dates, reports and guardian visit notes.
• Travel details — itineraries, flights, transfers and, for unaccompanied minors, the airline's UM service arrangements.
• Homestay details — which host family a student stays with and when, and host home health-and-safety inspection records.
• Wellbeing and medical information about students — a special category of data that we hold to keep children safe and cared for.
• Safeguarding records — concerns raised, action taken and safeguarding sign-off, held with strictly limited access.
• Vetting records — DBS (criminal-record) checks for our staff and for every resident aged 16 or over in a host household, and safeguarding training records.
• Immigration identifiers — passport, visa and BRP details, held in a restricted store that is never exposed to the web browser.

4. Why we use it, and our legal bases

• To deliver the guardianship service your family has contracted with us — performance of a contract.
• To keep children safe and meet our safeguarding duties under UK law and statutory guidance — legal obligation, substantial public interest (safeguarding of children) and, in an emergency, vital interests.
• To meet regulatory and accreditation requirements, including AEGIS inspection and UK immigration rules — legal obligation and legitimate interests.
• To run, secure and improve our systems, including a permanent audit trail of changes to care records — legitimate interests.
• Where we ask for consent — for example photographs or optional activities — that consent, which you can withdraw at any time.

5. Children's information

Most of the people our records describe are children. We collect only what the service and our safeguarding duties require, restrict access to the staff whose role needs it, and never use children's information for marketing.

Parents and carers are kept involved: the family portal shows you your own child's care record, travel and consents, and you can raise anything with us at any time.

6. Who we share information with

We never sell personal information. We share it only where the care of a student or the law requires:

• The student's school and boarding house, so care is joined up.
• The host family a student stays with — limited to the practical details a host needs for the stay.
• Transport providers and airlines, including unaccompanied-minor services, for booked journeys.
• AEGIS, whose inspectors sample records as part of accreditation.
• Local authorities, the police or other agencies where safeguarding or the law requires it.
• The service providers who host and run our systems, listed below.

7. Service providers and international transfers

Our records platform is hosted by Supabase (database and file storage) and Vercel (web hosting), and mobile notifications are delivered via Google Firebase. All act as our processors under data-processing agreements, and notification content never includes details that identify a student.

Because our families are often overseas, communications we send necessarily reach you in your own country, including China. Where personal information is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.

8. How we protect it

• Access is role-based and enforced at the database level (row-level security), so staff see only what their role requires.
• Passport, visa and BRP numbers live in a restricted store, separate from the main records, and are never sent to the browser.
• Every change to a care record is written to a tamper-evident, append-only audit trail.
• Files such as reports and documents are shared through short-lived signed links, and all traffic is encrypted in transit.
• Our staff are DBS-checked and receive safeguarding training with tracked expiry dates.

9. How long we keep it

We keep records for the duration of a student's guardianship and afterwards for as long as the law and statutory safeguarding guidance require. Safeguarding records in particular must be retained well beyond a student leaving our care. When a retention period ends, records are securely deleted.

10. Your rights

You have rights over your personal information, including access, correction, deletion, restriction, objection and portability, and the right to withdraw any consent you have given. Email guardians@whichbritishschool.com and we will respond within one month. To request removal of your personal data, email support@whichbritishschool.com.

Some rights are limited where the law requires us to keep a record — safeguarding records are the main example.

You can complain to the Information Commissioner's Office (ico.org.uk) at any time, though we would welcome the chance to put things right first.

11. Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially affects your family, we will tell you directly.