Who we are

UK School AI Policy Advisory Service is a trading name of Luke Thomas, a sole trader registered in England.

Contact email: luke@the-growth-forge.com

For the purposes of data protection law, we are the data controller for any personal data you provide to us.

What personal data we collect

Data you provide directly

When you use our enquiry form, request information, or contact us, we collect:

• your name
• your work email address
• your school or trust name

Data we obtain from public sources

When we contact schools and trusts about our services, we may obtain professional contact details from:

• the DfE Get Information About Schools (GIAS) service
• school and trust websites (publicly listed contact information)
• professional directories and publicly available records

This may include school or trust name and address, generic contact email addresses (e.g. office@, enquiries@), and names and professional email addresses of senior staff where publicly listed in a professional capacity.

We do not collect sensitive personal data, financial information, or pupil data.

Why we collect it

We use your personal data to:

• respond to your enquiry
• send you the materials you requested (such as the AI Policy Checklist)
• communicate with you about our services
• contact schools and trusts about our AI policy advisory services
• manage our customer relationship if you become a client

Our legal basis for processing is:

• Legitimate interests (Article 6(1)(f) UK GDPR) for responding to enquiries, sending relevant information you have requested, and contacting schools about our services where we believe there is a genuine professional relevance
• Contract performance (Article 6(1)(b) UK GDPR) where you become a paying client

If we contact you without a prior relationship

Where we obtain your professional contact details from public sources rather than directly from you, we are required to tell you:

• Who we are: UK School AI Policy Advisory Service (Luke Thomas, sole trader)
• What data we hold: your name (if applicable), professional email address, school or trust name, and job title or role (if publicly listed)
• Where we got it: the DfE GIAS database, your school or trust website, or another publicly available professional source
• Why we are contacting you: to make you aware of our AI policy advisory services, which we believe are relevant to your professional responsibilities
• Legal basis: legitimate interests (see above)
• Your rights: you can object to our processing at any time (see Your Rights below). The right to object to direct marketing is absolute — we will stop immediately and add you to our suppression list.

How we store and protect it

Your data is stored in Google Workspace (Google Sheets, Gmail), Netlify (form submissions), and Instantly (email communications). Each processor handles data in accordance with their respective data processing terms, which may include transfers outside the UK/EEA subject to appropriate safeguards.

We use reasonable technical and organisational measures to protect your data, including access controls, encrypted connections, and limiting access to the business owner only.

Who we share it with

We do not sell your data or share it with third parties for marketing purposes.

Your data may be processed by:

• Google (as a data processor, under their data processing terms) for email and data storage
• Netlify (as a data processor, under their data processing terms) for form submissions
• Instantly (as a data processor, under their data processing terms) for email communications
• No other third parties unless required by law

How long we keep it

• Enquiry data: up to 2 years after your last contact with us, then deleted
• Client data: for the duration of your engagement plus 2 years, then deleted
• Outreach data (where we contact you from public sources and you do not engage): deleted within 6 months of last contact
• Suppression list data (opt-outs): retained indefinitely to ensure we do not contact you again
• You can request deletion at any time

Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you
• request correction of inaccurate data
• request deletion of your data
• object to processing based on legitimate interests
• request restriction of processing
• data portability

To exercise any of these rights, contact us at: luke@the-growth-forge.com

We will respond within one calendar month.

Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

Changes to this notice

We may update this privacy notice from time to time. The current version will always be available on our website.

This privacy notice is current as of March 2026. It applies to personal data collected through our website, enquiry forms, direct communications, and outreach activities.