Privacy Policy

1. Who we are

SEND Navigate is operated by Stephen Mallett, trading as SEND Navigate. Stephen is the data controller responsible for your personal data. Our website is sendnavigate.org and our contact email is stephen@sendnavigate.com.

2. Ask an Expert and ordinary general enquiries

The Ask an Expert pilot is for one general SEN question about education support in England. We collect your own name, email address and question, plus an optional local authority name, question category and broad discovery source. We also receive the required privacy acknowledgement and confirmation that the question meets the general-enquiry boundary. Form handling may involve technical records needed for delivery, security and spam prevention.

We use this information to assess the question’s scope, manage available capacity and contact you privately about the enquiry, including a general reply if Stephen can take it on. We rely on legitimate interests (Article 6(1)(f)) for this ordinary adult enquiry: our interest is in receiving, managing and responding to the enquiry you chose to make. We limit the information to what that purpose needs and have assessed the balance with your privacy interests. You can object by contacting Stephen.

Ask an Expert and the consultancy enquiry form offer the voluntary question “How did you first hear about SEND Navigate?” Choose a broad label or leave it blank; “Prefer not to say” is also available. We do not ask for a group name, social handle, the person who recommended us or a free-text explanation. We use this limited business attribution under legitimate interests to understand how people find SEND Navigate. It does not affect eligibility, access to support or whether Stephen can reply, and it is not marketing consent. The label stays with the private enquiry and owner notification, not website analytics, public logs or published questions. It follows the same retention and deletion policy as the enquiry, including review after 90 days for unconverted ordinary enquiries; it has no separate extended attribution retention period.

The required privacy checkbox acknowledges this information; it is not marketing consent or explicit consent to process health records. Submitting a question does not add you to a newsletter or marketing list. Questions and replies are not automatically published, including as an “anonymised” public Q&A.

If sensitive information is volunteered despite these instructions, we restrict access, avoid requesting or copying more, and assess whether the question can be handled without using it. This enquiry route is not permission to process special-category information. Where individual casework or documents are necessary, we pause the general-enquiry route and agree a separate handling process. Before asking for that information, we must establish the relevant Article 6 lawful basis and an additional Article 9 condition where required, together with appropriate privacy, access and retention arrangements.

A form-service receipt does not confirm human review, an expert answer or an appointment. There is no fixed response time. Administrative acknowledgements are separate from expert replies and do not contain a marketing invitation.

3. Other information we collect and use

• Requested guides, workbooks and resources: name and email address supplied through existing MailerLite signup forms are used to provide the resources requested.
• Optional email updates: where you separately opt in, we use your details for the follow-up email series or updates described by the signup. This relies on consent, which you can withdraw using the unsubscribe link. Ask an Expert is not such a signup.
• School sample requests: contact and school details supplied through the school sample form are used to provide the requested sample and handle the related enquiry. Ordinary request handling relies on legitimate interests; any marketing must have its own applicable permission.
• Consultation bookings: Google Calendar collects booking information such as your name and email address to arrange the appointment, under Google’s Privacy Policy. We use necessary booking details to arrange and conduct the requested discussion.
• Advisory enquiries and engagements: we use necessary contact details and agreed service information to respond, arrange consultations and deliver separately agreed advisory work. Contract performance, including necessary steps you request before an agreement, is the Article 6 basis where applicable. This does not by itself provide an Article 9 condition for health or disability information. Do not send medical records or a case bundle with an initial enquiry; any necessary sensitive-data handling must be confirmed separately before collection.
• School licence payments: Stripe processes the payment information needed for the purchase. We use necessary transaction information to administer the licence agreement; legal obligations may require some transaction records to be retained.
• Optional analytics: only with your consent, Google Analytics (GA4) measures page visits and selected resource, retailer and consultation-link clicks to help us understand website use. Technical information may include device details and cookie identifiers; analytics is not the same as anonymous data.

We do not sell your personal data or share it for other organisations’ own marketing purposes. An enquiry does not commit you to paid work. Scope and fees for any paid service are agreed separately.

4. How long we keep information

• Unconverted ordinary general enquiries, including Ask an Expert: our policy is to review them after 90 days and delete information when the enquiry purpose has ended. A live enquiry can be retained while it is still needed; necessary complaint or legal records may be retained for that separate purpose. This is a staff-managed review and deletion policy, not a promise that the website automatically deletes every record on day 90. Review must cover form storage, email copies and any working records.
• Email subscribers: details are retained in our MailerLite account while subscribed. You may unsubscribe at any time; limited suppression information may be needed to respect an opt-out.
• Advisory engagements: the retention decision is separate from the general-enquiry pilot and depends on the agreed service, ongoing purpose and any necessary complaint or legal retention. We review documents and correspondence when the engagement ends and delete information that is no longer needed. This is not an automatic erasure promise or an instruction to delete existing case records indiscriminately.
• Payment and other required records: necessary records may be retained to fulfil applicable legal obligations or address a complaint or legal claim.
• Analytics: retention depends on the analytics account configuration. Contact Stephen for the current setting.

Stephen is responsible for carrying out these reviews and coordinating deletion across the services used. Contact him if you would like information about a record or its retention.

5. Providers and private email

We use service providers to run the website and deliver the services you request. They may process information on their systems, and some processing may take place outside the UK. Appropriate provider terms and transfer safeguards must be in place where required; contact Stephen for information about the arrangements relevant to your enquiry.

• Netlify: website hosting and Netlify Forms submission storage. Netlify may process technical logs, including IP addresses, and stores information submitted through its forms. See Netlify’s Privacy Policy.
• Resend: transactional email delivery for administrative form acknowledgements where enabled. A successful form response is separate from a successful mail send, and neither proves delivery to your inbox. See Resend’s Privacy Policy.
• Email providers: the providers used for SEND Navigate’s correspondence and for your email address process messages in transmission and storage. Replies are sent privately to the address you supplied; email is not anonymous or end-to-end encrypted. Please do not email health records or detailed child information through the general-enquiry route.
• MailerLite: requested-resource delivery, email marketing and list management through existing signup forms. See MailerLite’s Privacy Policy.
• Google Calendar and Google Analytics: appointment booking and consent-based website analytics. See Google’s Privacy Policy.
• Stripe: school licence payment processing under its own payment-security arrangements. See Stripe’s Privacy Policy.

Access to enquiries should be limited to those who need it for the requested purpose. We do not automatically send Ask an Expert questions to an AI service to generate answers or copy their contents into website analytics.

6. Your rights

Depending on the circumstances and lawful basis, you can request access to your data, correction, erasure, restriction or portability. You can object to processing based on legitimate interests, including ordinary general-enquiry handling. Where we rely on consent, you can withdraw it; this does not affect earlier lawful processing.

Contact stephen@sendnavigate.com to exercise your rights. We normally respond within one month, subject to the identification checks and extensions permitted by data protection law. Some rights have exceptions; we will explain any that apply.

7. Complaints

Please contact Stephen if you are concerned about how we handle your information. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

8. Cookies and your analytics choice

We do not load the website’s Google Analytics tag until you accept analytics. Reject analytics and Accept analytics are available together. Your choice is stored in your browser’s local storage. You can revisit Analytics preferences in the footer to withdraw your choice; future measurement stops and the site attempts to remove accessible analytics cookies. Withdrawing consent does not erase information already collected.

Our custom measurement does not send enquiry text, discovery source, question category, local authority, children’s records, names, email addresses or URL query strings. If analytics consent is already active at the first meaningful interaction with the expert form, we record one fixed form-start event for that page lifecycle, without input values. We do not replay an earlier unconsented interaction. A successful HTTP submission response can trigger a separate fixed response event. Neither event proves validated intake, a genuine enquiry, human review or email delivery. A calendar-link click is not a completed booking; an Amazon click is not a book sale. Visiting a confirmation page is not proof of validated intake, human review, email delivery or payment. We do not load Google Ads tags on the website.

External services such as Google Calendar, Amazon, Stripe and embedded signup forms apply their own privacy and cookie controls. Rejecting this site’s optional analytics does not prevent access to resources, form submission, payments or booking. You can also control or delete cookies and local storage in your browser settings.

9. Changes to this policy

We may update this policy as our services or processing arrangements change. We update the date above when we do so.

10. Contact us

Stephen Mallett
Trading as SEND Navigate
Email: stephen@sendnavigate.com
Website: sendnavigate.org