Last updated: 3 October 2026
This policy explains how Which Independent Schools Ltd, trading as Which British School, WBS and WBS Guardians, collects, uses and protects personal information. It covers our website, our member platform (SchoolMatchMaker) and our consultancy, school placement, tutoring, guardianship and clearing services.
Who we are
The data controller is Which Independent Schools Ltd, a private limited company registered in England and Wales under company number 09287591, whose registered office is at 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB688394.
For any privacy question or request, email privacy@whichbritishschool.com or write to us at the address above.
Information we collect
- Enquiries and contact details: names, email addresses, phone numbers, country and the content of your messages.
- Information about students: name, date of birth, nationality, passport details where needed for school or visa purposes, photographs, school reports, test results, personal statements, personal videos, interests, English level and school preferences.
- Special category and sensitive information, only where necessary: health, medical, dietary and special educational needs information, and safeguarding or welfare information, particularly for guardianship.
- Parent and guardian details: contact details, emergency contacts, travel arrangements and, where relevant, information needed for bursary applications.
- Account information for our member platform: your name, email address, role (for example parent, school, representative or student), password (stored in hashed form), settings, and the messages, documents and notes you add.
- School information: for school and school-group accounts, the school’s details, admissions requirements and the contact details of the staff who use the platform.
- Technical information: IP address, browser type, device information and security logs, used to keep the website and platform secure.
How we use it, and our lawful basis
- To provide our services: advising on and applying to schools, preparing Student Profiles, tutoring, guardianship and clearing. Lawful basis: performing our contract with you, or taking steps at your request before entering into one.
- To share Student Profiles and applications with schools you have chosen, or that we recommend and you agree to. Lawful basis: contract and, where needed, consent.
- To keep children safe, including recording and sharing safeguarding concerns with schools, local authority designated officers (LADO), children’s services or the police. Lawful basis: legal obligation, vital interests and the substantial public interest in safeguarding children, under the Data Protection Act 2018.
- To process health and special educational needs information so that a child is properly cared for. Lawful basis: explicit consent from a parent, or the substantial public interest in safeguarding where consent cannot reasonably be obtained.
- To suggest suitable schools on the platform, by comparing a student’s profile with each school’s requirements. This is automated, but it only produces suggestions: families and schools make every decision. Lawful basis: contract and our legitimate interests.
- To send account emails, such as invitations, password resets and notifications you have chosen to receive. Lawful basis: contract and our legitimate interests.
- To keep financial records for services you buy under a separate agreement. Lawful basis: contract and legal obligation.
- To keep our website and systems secure and prevent spam and fraud. Lawful basis: our legitimate interests.
Children’s information
Most of the information we hold about children is provided by their parents or guardians, or with their consent. Accounts and Student Profiles for children under 18 must be set up by, or with the agreement of, a parent or legal guardian, and a student is only given their own login with a parent’s agreement. We follow the ICO’s Age Appropriate Design Code (the Children’s Code):
- Private by default: student profiles are not public. Schools see only students who match their requirements, and a familya family’s contact details are hidden from a school until contact has been agreed.rsquo;s contact details stay hidden from a school until the school has contacted the family through the platform.
- Need to know: representatives see only the students they work with, and school entry requirements are visible only to that school and WBS staff.
- Collect only what we need for school placement, and use special category information, such as special educational needs or health, only with a parent’s explicit consent or where needed to keep a child safe.
- No marketing: we do not use children’s information for marketing or for profiling unrelated to finding a school.
We also apply the safeguards described in our Safeguarding and Data Protection policies.
Who we share information with
- Schools you are applying to, or that we recommend and you agree to; on the platform, schools see only students who match their requirements
- Representatives (agents and consultants) you have chosen to work with
- Host families, tutors and guardianship staff who care for or teach your child, under confidentiality and safeguarding agreements
- Local authorities, the police and other agencies, where we are required to share information or must do so to protect a child
- Service providers who process data for us: Vercel (website and platform hosting, and website statistics if you allow them), Supabase (database and file storage) and Resend (account emails). They may only use the information to provide services to us, under data processing terms.
- Professional advisers, such as accountants and lawyers, where necessary
We never sell personal information.
International transfers
Some of our service providers process data outside the UK, for example in the United States. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge) or the ICO’s International Data Transfer Agreement or Addendum, to make sure your information stays protected. Many of our families live overseas, so we also send information to you and your representatives in your country.
How long we keep information
We keep personal information only as long as we need it for the purposes above. In general:
- Client and student records: six years after our services end, to meet legal and accounting requirements.
- Safeguarding records: in line with statutory guidance and our Safeguarding Policy, which may be considerably longer.
- Enquiries that do not lead to a service: up to two years.
- Member platform accounts: until the account is closed, then deleted within a reasonable period unless we must keep information for the reasons above. Server and security logs: up to 12 months.
Your rights
Under UK data protection law (the UK GDPR and the Data Protection Act 2018), you have the right to:
- access the personal information we hold about you;
- have inaccurate information corrected;
- have information deleted, where there is no good reason for us to keep it;
- restrict or object to certain processing, including direct marketing;
- receive your information in a portable format;
- withdraw consent at any time, where we rely on consent; and
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects. Our school matching only makes suggestions; people make the decisions.
To make a request, email privacy@whichbritishschool.com. We will respond within one month. Parents may make requests on behalf of younger children. Older children may be able to exercise their own rights.
Cookies
Cookies are small files stored on your device. We use cookies and similar storage that are necessary for the website and platform to work and to keep them secure:
- A login session cookie for our member platform, which keeps you signed in
- Browser storage that remembers your cookie notice choice and a few display preferences
Because these are strictly necessary, they do not require consent.
Website statistics (optional)
If you choose “Allow statistics” in our cookie notice, we use Vercel Web Analytics to count visits to our pages. It does not set cookies or store anything on your device. It records the page address, the referring site, your country and region, and your browser, operating system and device type. Visitors are counted using a code derived from the request that Vercel discards after 24 hours, and we only see totals, so the statistics cannot identify you. Vercel processes this information for us under data processing terms. Lawful basis: consent. If you choose “Necessary only”, the statistics script is not loaded. You can change your choice at any time with the “Cookie settings” link at the bottom of every page.
We do not use advertising or tracking cookies. You can control or delete cookies through your browser settings, but parts of the website, such as logging in, may then not work.
Security
We protect personal information with appropriate technical and organisational measures. These include encrypted connections, hashed passwords, role-based access controls, regular security reviews and staff training in data protection and safeguarding. If a data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
Complaints
If you are unhappy with how we have handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. This policy replaces the SchoolMatchMaker Privacy Policy of 17 March 2026.