Data Protection (GDPR) Policy

Organisation: Luma Education Recruitment Ltd. ICO registration number: ZC042466. Approved by Daniel Benson and Tom Jackson, Directors.

1. Purpose

Luma Education Recruitment Ltd ("Luma", "the Company") is committed to protecting the privacy of everyone whose personal data we handle. This policy explains how we collect, use, store, share and protect personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations (PECR) and related legislation and guidance, including Keeping Children Safe in Education (KCSIE) and the DBS Code of Practice.

2. Scope

This policy applies to Luma's directors, employees, contractors and consultants, and to third-party service providers that process personal data on our behalf. It covers the personal data of:

• candidates and Workers (temporary, long-term and permanent);

• Luma's own staff and job applicants;

• clients (schools, trusts and other education settings) and their staff;

• suppliers, partners and referees; and

• marketing contacts and website users.

3. Data protection principles

Luma follows the seven UK GDPR principles. Personal data will be:

• Lawful, fair and transparent – processed on a valid legal basis, with clear privacy information given to individuals.

• Purpose limited – collected for specified, explicit and legitimate purposes.

• Minimised – adequate, relevant and limited to what is necessary.

• Accurate – kept up to date and corrected promptly.

• Storage limited – kept no longer than necessary, in line with our Data Retention Schedule.

• Secure – protected against unauthorised access, loss or damage.

• Accountable – Luma can demonstrate compliance through records, policies and audits.

4. Lawful basis for processing

• Contract – to provide recruitment services, engage Workers and fulfil client agreements.

• Legal obligation – for example right to work, tax, pension, the Conduct of Employment Agencies and Employment Businesses Regulations 2003, and safeguarding duties.

• Legitimate interests – for recruitment, business operations, safeguarding and relevant business-to-business marketing, balanced against individuals' rights. Where the Data (Use and Access) Act 2025 recognises a legitimate interest (for example safeguarding vulnerable individuals), we rely on it where applicable.

• Consent – where required, for example for certain marketing; consent can be withdrawn at any time.

5. Special category and criminal offence data

To place Workers safely in schools, Luma processes some sensitive data, including health information (fitness to work), criminal records information (enhanced DBS and children's barred list checks) and, where provided voluntarily, equality monitoring data. We do so under the employment, safeguarding and statutory obligation conditions in Schedule 1 of the Data Protection Act 2018. Access is limited to the directors and authorised staff. DBS certificate information is handled in line with the DBS Code of Practice and is not kept beyond six months after the suitability decision; afterwards we keep only the date, certificate number, check type, Update Service status and decision.

6. Categories of personal data

7. Collecting and processing data

• Data is collected securely, mainly through our Hello Edun candidate onboarding form and compliance system, Matrix eBulk (DBS), email and secure online forms. Luma works paperless; any paper that arises is scanned and shredded.

• Individuals receive privacy information explaining how their data is used when it is collected.

• Access is restricted to authorised personnel on a need-to-know basis.

• Data is shared with clients only as needed to make and manage a placement (for example a compliance summary confirming checks, not full DBS certificates).

8. Data processors and sharing

Luma uses trusted processors, each governed by a written data processing agreement or equivalent contractual terms:

We may also share data where the law requires it, for example with HMRC, the Home Office, the DBS, the Local Authority Designated Officer (LADO), the Teaching Regulation Agency or the police for safeguarding purposes.

9. Data retention

Personal data is kept only as long as necessary, in line with Luma's Data Retention Schedule (v1.0, November 2026), which forms part of this policy. In summary: candidates we do not place are kept for 12 months from last meaningful contact; placed Workers' recruitment and compliance files for 6 years after their last assignment; pay and finance records for 6 years; DBS certificate information for no longer than 6 months; and safeguarding allegation records in line with KCSIE Part 4. The Data Protection Officer reviews all systems against the schedule at least annually and securely deletes data that has passed its retention date. Deletion is paused for any record linked to an ongoing investigation, complaint, claim or audit.

10. Individual rights

Individuals have the right to be informed; of access; to rectification; to erasure; to restrict processing; to data portability; to object; and rights relating to automated decision-making and profiling. Requests should be sent to the Data Protection Officer at info@lumaedrec.com. We will:

• verify the requester's identity and respond within one month (extendable by up to two months for complex requests, with an explanation);

• carry out a reasonable and proportionate search for the information requested; and

• explain where we must keep information by law (for example payroll or safeguarding records).

Luma does not make decisions about candidates based solely on automated processing. Every placement decision is made by a director.

11. Data protection complaints

Anyone may complain to Luma about how we use their personal data by emailing info@lumaedrec.com. In line with the Data (Use and Access) Act 2025, we will acknowledge complaints within 30 days, investigate them without undue delay, and tell the complainant the outcome. Individuals may also complain to the Information Commissioner's Office (see section 18).

12. Data security

Luma uses appropriate technical and organisational measures, including:

• Cyber Essentials certification (valid until September 2027), renewed annually;

• multi-factor authentication (MFA) across all business systems that support it (Microsoft 365, Hello Edun, QUBA and Matrix), reviewed annually;

• individual secure logins, strong passwords and role-based access;

• encryption of devices and of data in transit and at rest, using up-to-date Apple Mac devices with automatic security updates;

• secure cloud storage with no local copies of sensitive files, and no use of personal email or unapproved storage for Luma data;

• a Business Continuity and Disaster Recovery Plan, tested at least annually; and

• regular data protection and cyber security training for all staff.

13. Use of AI and new technology

Luma may use approved AI tools to support business tasks such as reporting and analysis. Staff must use only Company-approved tools, must not enter special category, DBS or safeguarding data into AI tools, and must minimise or remove personal data wherever possible. Before introducing any new system or high-risk processing, the Data Protection Officer will complete a Data Protection Impact Assessment (DPIA) where required.

14. Personal data breaches

• Any suspected breach must be reported immediately to the Data Protection Officer (or Tom Jackson, Director, if unavailable).

• The DPO assesses the risk, contains the breach and records it in the breach log, whether or not it is reportable.

• Breaches likely to pose a risk to individuals' rights are reported to the ICO within 72 hours of becoming aware of them.

• Affected individuals are told without undue delay if there is a high risk to them, and affected clients are told promptly where their data or pupils are involved.

15. International transfers

Personal data is not transferred outside the UK unless the destination is covered by UK adequacy regulations or appropriate safeguards are in place, such as the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

16. Roles and responsibilities

• Directors – ensure compliance, approve this policy and provide resources.

• Data Protection Officer (Daniel Benson) – oversees compliance, handles rights requests and complaints, manages breaches, maintains the retention schedule and records of processing, and liaises with the ICO.

• All staff and contractors – follow this policy, complete training and report concerns or breaches immediately.

17. Training

All staff complete data protection and cyber security training at induction and at least annually, and receive updates whenever legislation or guidance changes.

18. Complaints to the ICO

If you are unhappy with how Luma has handled your personal data, you can contact the Information Commissioner's Office: website ico.org.uk; helpline 0303 123 1113; Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

19. Policy review

This policy is reviewed annually, or sooner if legislation, guidance, our systems or the outcome of a data breach require it. The current version is available on request from info@lumaedrec.com.

Version history

Approved and signed electronically by Daniel Benson (Director and Data Protection Officer) and Tom Jackson (Director) on 30 October 2026.