Privacy Policy

1. Who we are

1.1 FindMySchool is operated by Leovate Ltd, a company registered in England and Wales (company number 16743779) with its registered office at 71-75 Shelton Street, London, WC2H 9JQ. Leovate Ltd is the data controller for personal data processed through findmyschool.uk.

1.2 In this policy, "we", "our" and "us" refer to Leovate Ltd, trading as FindMySchool.

1.3 For all data protection enquiries, including to exercise any of the rights described in section 7, please contact us at info@findmyschool.uk.

2. What personal data we collect

2.1 We collect the following categories of personal data, only where you use the features to which they relate.

2.2 Account data. When you register, we collect your email address, full name, and either a password credential (stored in hashed form) or a Google sign-in identifier.

2.3 Saved schools and saved comparisons. When you save a school or a comparison, we store the school URN(s) and a timestamp recording when the save occurred.

2.4 School-matching preferences. When you use the school-matching tool, we collect the information you provide, which may include a postcode or a place name (such as "London"), the phase of education, a distance preference, gender preference, sector preference, and the child's interests. If you give the explicit consent described in section 2.8, we additionally collect SEN status and faith preference.

2.5 Parent enquiries. When you contact a school through our site, we collect your name, your contact details, and the school URN. Where the school operates a claimed Premium profile, we forward the enquiry by email to the school's verified email address and we do not store the contents of the enquiry on our infrastructure. Where the school does not operate a claimed Premium profile, we may temporarily process the contents of the enquiry to deliver it to the school by other means.

2.5A School Claim data. Where a school claims a profile on FindMySchool, we collect information about the school's authorised representative (the "claimant"), including the claimant's full name, work email address, role or job title, relationship to the school, and any verification evidence the claimant provides. Where an external agency operates the dashboard on behalf of a school, we additionally collect the agency's contact details and the written authorisation we receive from a senior school official authorising the agency to act.

2.5B School Premium data. Where a school subscribes to Premium, we collect the same subscription and purchase data described in section 2.6 in respect of the school as the customer, together with any content the school uploads to its profile (including school logos, photos, video links, event descriptions, and call-to-action links) and anonymised engagement analytics in respect of the school's profile.

2.6 Subscription and purchase data. When you purchase a Plus subscription or a one-off paid service such as the School Match Pack, we collect your plan or product, your Stripe customer ID, and your payment status. We do not store card numbers.

2.7 Technical data. When you sign in and when you perform key account actions, we automatically collect technical information about your device and session, including your IP address, the browser and device you are using, and the timestamp of the action. We use this to keep your account secure and to detect suspicious activity.

2.8 Special category data: SEN status and faith preference. Some answers to questions in the school-matching tool, specifically indicating that your child has special educational needs, or selecting a specific religion or "non-religious schools only", reveal "special category" data within the meaning of Article 9 UK GDPR. Where you make such a selection, we ask for your explicit consent before we process the related information. We do not ask for consent where you select "No" or "No preference", because no special category data is being disclosed. Your answers are retained only as part of a saved match (see section 6.2). You may withdraw your consent and delete the related answers at any time by deleting the saved match, or by emailing info@findmyschool.uk.

2.9 Information about your child. Where you provide information about your child (such as SEN status, gender, or the child's interests) through our school-matching tool, you confirm that you have the authority to share that information on your child's behalf. We do not collect your child's name, date of birth, or other direct identifiers.

2.10 Analytics data. Where you give consent through our cookie banner, Google Analytics 4 collects information about how you use the site, including pages viewed, time on site, country-level approximate location derived from your IP address, and a pseudonymous identifier stored in a cookie. We have configured Google Analytics 4 to use IP-anonymisation features so that full IP addresses are not stored.

2.11 Consequences of not providing data. Provision of account data is required to register and to use account-only features (saved schools, saved comparisons, paid services). Without it we cannot create or operate your account. Provision of school-matching preferences is voluntary, but the matcher cannot generate suggestions without them. Provision of payment data through Stripe is required to purchase a Plus subscription or a one-off paid service. Refusal to consent to analytics cookies has no effect on your access to the service.

3. Why we use your personal data and our legal basis for doing so

3.1 We use personal data for the purposes set out in this section, relying on the lawful bases described below.

3.2 We operate your account and store your saved schools, comparisons, and preferences on the basis that doing so is necessary for the performance of our contract with you (Article 6(1)(b) UK GDPR).

3.3 We match you to schools based on your preferences on the basis that doing so is necessary for the performance of our contract with you (Article 6(1)(b)). Where those preferences include special category data, we additionally rely on your explicit consent (Article 9(2)(a)).

3.4 We process enquiries you send to schools through our site, including by forwarding the enquiry to the school where the school operates a claimed Premium profile, on the basis that doing so is necessary for the performance of our contract with you (Article 6(1)(b)).

3.5 We process payments for Plus subscriptions, School Premium subscriptions, and one-off paid services on the basis that doing so is necessary for the performance of our contract with you (Article 6(1)(b)).

3.6 We send transactional emails relating to your account, password, subscription, and one-off purchases on the basis that doing so is necessary for the performance of our contract with you (Article 6(1)(b)).

3.7 We process information about school claimants, including verification evidence and authorisations from external agencies, on the basis that doing so is necessary to operate School Claim and to verify that updates to school profiles come from authorised representatives. Our lawful basis is performance of our contract with the school (Article 6(1)(b)) and our legitimate interests (Article 6(1)(f)) in maintaining the integrity of school-profile content. The legitimate interests pursued are ensuring that profile updates are authorised, and we consider these proportionate given the limited information processed and the alternative risk of unverified changes to public information about schools.

3.8 We maintain security, fraud-prevention, and audit logs on the basis of our legitimate interests (Article 6(1)(f)). The legitimate interests pursued are protecting the integrity of the service against unauthorised access, abuse, and fraud, and maintaining a reliable record of authentication events for security investigations. We have assessed these interests against your rights and consider them proportionate, given that the data processed is limited to what is necessary for security purposes and is retained only for the periods set out in section 6.

3.9 We comply with applicable legal obligations, including tax, accounting, and responses to lawful requests, on the basis that doing so is necessary to comply with a legal obligation to which we are subject (Article 6(1)(c)).

3.10 We process analytics data through Google Analytics 4 on the basis of your consent (Article 6(1)(a) UK GDPR). We comply with Regulation 6 of the Privacy and Electronic Communications Regulations 2003 by obtaining your consent through our cookie banner before any analytics cookies are set.

4. Who we share your personal data with

4.1 We do not sell your personal data. We share your personal data with the recipients listed in this section. Each recipient acts on our documented instructions as a processor under a data-processing agreement that complies with Article 28 UK GDPR, except where this section identifies a recipient as an independent controller.

4.2 Database, authentication, and storage. We use a managed database, authentication, and storage service for your account record, saved schools, matcher sessions, school claims, content uploads, and audit logs. Your account record and saved-schools list are stored in the United Kingdom.

4.3 Hosting. We use a cloud hosting provider for application delivery. Personal data passes through the hosting provider's infrastructure in transit. The hosting provider does not persistently store account data on our behalf.

4.3A Web Vitals telemetry. We also use an aggregate Web Vitals telemetry service to monitor site performance. This service records anonymised page-view counts and performance measurements without setting cookies and without persisting personal data.

4.4 Transactional email. We use a third-party transactional email service for delivery of account confirmation, password-reset, claim verification, parent enquiry, and subscription-related emails. The service processes your email address and associated delivery metadata solely for the purpose of delivering these messages.

4.5 Stripe, Inc. provides payment processing for Plus subscriptions and one-off paid services. Where you make a payment, Stripe receives the information necessary to process your payment. Stripe acts as an independent controller for fraud-prevention and regulatory compliance purposes; for other processing it acts as our processor. Stripe's terms are published at https://stripe.com/legal/dpa and https://stripe.com/privacy.

4.6 Google LLC (Sign-in). If you choose to register or sign in using Google, Google LLC processes your email address, name, and Google profile information to authenticate you. Our basis for this processing is the performance of our contract with you (Article 6(1)(b) UK GDPR). Details of Google's own processing are set out in Google's privacy policy at https://policies.google.com/privacy.

4.7 Google LLC (Maps Platform) processes school-location queries when you use map features. The Maps API does not receive your account data; it receives only the location query (postcode or coordinates) at the moment the map is used.

4.7A Geocoding. We also use a separate third-party geocoding service to convert postcodes you enter into geographic coordinates. The geocoding service receives only the postcode. No other personal data is transmitted.

4.7B Meta Platforms, Inc. (Instagram). Where a school has claimed its profile and holds a current Premium subscription, the school may connect its own Instagram account so that its most recent public Instagram posts appear on its school profile page. This is the only Instagram integration we operate.

When a school administrator connects an account, Meta receives the administrator's Instagram user ID and the scopes granted. Meta acts as an independent controller for this processing. We store the resulting access token and handle solely to display the school's public posts. We fetch the posts from Meta server-side and serve them from our own infrastructure, so visitor browsers do not interact with Meta when viewing a school profile. The posts displayed are content the school has chosen to publish on Instagram; the school is the controller of its own Instagram content and its relationship with Meta is governed separately by Meta's own terms. Details of Meta's processing are at https://privacycenter.instagram.com/policy.

4.8 Google LLC (Google Analytics 4) processes analytics data on our behalf where you have given consent. Google's terms governing this processing, including the data processing terms incorporated by reference, are published at https://marketingplatform.google.com/about/analytics/terms/gb/. We have configured Google Analytics 4 with IP-anonymisation features and have switched off the data-sharing settings that would allow Google to use this data for advertising purposes.

4.9 Rate-limit and cache service. We use a third-party rate-limit and cache service to protect the service from abuse and to improve performance. Identifiers used for rate limiting (such as IP addresses or user IDs) are stored for short periods, typically minutes to hours, and are automatically deleted by time-to-live expiry. The data is stored in the United Kingdom.

4.10 We may also disclose personal data where we are required to do so by law, by court order, or to protect the rights, safety, or security of our users or of the service.

5. International transfers of personal data

5.1 Our primary data storage is in the United Kingdom.

5.2 We may store the data we collect from you outside the United Kingdom, or transfer it to organisations outside the United Kingdom. When we do this, we make sure that your data is protected by relying on either an adequacy decision under Article 45 UK GDPR, or by entering into specific contracts approved for use in the United Kingdom (such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses) which give personal data the same protection as it has in the United Kingdom. If you would like more information about the specific safeguards we use, please email info@findmyschool.uk.

6. How long we keep your personal data

6.1 We retain account records, including your email, full name, user ID, password credential (stored in hashed form), saved schools, and saved comparisons, for as long as your account remains active. If your account becomes inactive, we will retain these records for up to 60 months before deleting them.

6.2 When the matcher returns results, we retain the preferences and the matched schools so that you can return to them without re-running the matcher. You can view and delete your matcher history at any time from your account, individually or in bulk. We delete your matcher history automatically when you delete your account. Where the matcher returns no results, no data is retained.

6.3 We retain a record of parent enquiries (your name, contact details, and the school URN, but not the contents) for 24 months from the date of the enquiry. Where the enquiry is forwarded to a Premium school, the contents are forwarded by email and not stored on our infrastructure.

6.3A We retain school-claim records, including claimant identity, verification status, and any agency authorisations, for as long as the school's profile remains claimed and for 12 months after the claim ends.

6.4 We retain subscription and one-off purchase records for 6 years from the end of the accounting year to which they relate, in order to meet our tax, accounting, and Companies Act obligations.

6.5 We retain authentication audit logs on a rolling 24-month basis. We retain session and sign-in logs on a rolling 12-month basis. Records falling outside these periods are deleted automatically.

6.6 If you delete your account, we will remove account and profile records from our live systems within 30 days. Data that we are required to retain to comply with a legal obligation will be kept for the period required by that obligation and then deleted.

7. Your rights

7.1 You have the right to access the personal data we hold about you (Article 15 UK GDPR).

7.2 You have the right to request rectification of inaccurate personal data (Article 16).

7.3 You have the right to request erasure of your personal data (Article 17).

7.4 You have the right to request restriction of processing (Article 18).

7.5 You have the right to data portability (Article 20).

7.6 You have the right to object to processing (Article 21).

7.7 Where we rely on your consent (including for analytics and the processing of SEN status and faith preference), you have the right to withdraw that consent at any time (Article 7(3)). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You may withdraw consent for analytics through the "Cookie settings" link in our footer, or for any consent-based processing by emailing info@findmyschool.uk.

7.8 You have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).

7.9 To exercise any of these rights, please email info@findmyschool.uk. We will respond within 30 days of receipt of your request.

8. Source of the personal data

8.1 Most personal data described in section 2 is collected directly from you when you register for and use the service. We do not purchase personal data or enrich your data from third-party sources.

8.2 Where an external agency operates a school's dashboard on the school's behalf, some of the personal data described in section 2.5A may be provided by the agency or by the school rather than directly by the claimant.

8.3 Section 9 below applies separately, where we process limited information about individuals named on school profiles (such as head teachers and senior staff) which we obtain from public sources rather than from those individuals directly.

9. Information about individuals named on school profiles

9.1 This section applies to individuals named on FindMySchool school profiles, including head teachers, principals, and other senior staff. It is provided in accordance with Article 14 UK GDPR.

9.2 What we process. We process the individual's name and the role and school with which the individual is associated, as published in official sources.

9.3 Source of the data. We obtain this information from publicly accessible official sources.

9.4 Lawful basis. We process this information on the basis of our legitimate interests under Article 6(1)(f) UK GDPR. The legitimate interests pursued are providing prospective parents and the public with accurate, comprehensive information about schools in England, including the senior staff who lead them. We have assessed these interests against the rights of the individuals concerned and consider them proportionate, taking into account that the information processed is limited to professional details published in official public sources, that the individuals concerned hold public-facing roles whose details are routinely published, and that no contact details, special category data, or private information are processed.

9.5 Recipients, transfers, and retention. The processors listed in section 4 may host or transmit this information in the same way as other content on the site. International transfer safeguards described in section 5 apply equally. We retain this information for as long as the individual is associated with the school in published official sources, and update or remove it as those sources change.

9.6 Your rights. If you are an individual named on a school profile, you have the rights described in section 7, including the right to request rectification of inaccurate information, the right to object to processing under Article 21, and the right to lodge a complaint with the Information Commissioner's Office. To exercise any of these rights, please email info@findmyschool.uk.

10. Automated decision-making

10.1 We do not carry out automated decision-making or profiling producing legal or similarly significant effects on you within the meaning of Article 22 UK GDPR.

10.2 Our school-matching tool produces suggestions based on your preferences; all decisions about which school to apply to remain entirely with you.

11. Children

11.1 FindMySchool is aimed at parents and carers of school-age children, not at children themselves. Users must be 18 or over to create an account.

11.2 FindMySchool is designed for adults. Account registration is restricted to users aged 18 or over.

12. Security

12.1 We use appropriate technical and organisational measures to protect personal data in accordance with Article 32 UK GDPR.

13. Cookies and similar technologies

13.1 Our use of cookies and similar technologies is set out in our Cookie Policy. Strictly necessary cookies are exempt from the consent requirement under Regulation 6(4) of the Privacy and Electronic Communications Regulations 2003. All other cookies are set only if you give consent through our cookie banner. You can manage your preferences at any time through the "Cookie settings" link in our footer.

14. Changes to this policy

14.1 We may update this policy from time to time. The "Last updated" date at the top of this document shows when it was last changed.

14.2 Where changes are material, we will notify you by email and on next sign-in.

15. Contact

15.1 If you have any questions or complaints about how we handle your personal data, please contact us at info@findmyschool.uk in the first instance.

15.2 You also have the right to complain to the supervisory authority:

Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone: 0303 123 1113 Website: ico.org.uk

Last updated: 29 April 2026