1. Who we are
Headlite is a service provided by School Leader Support, a partnership registered in England.
| Data Controller | School Leader Support (trading as Headlite) |
| ICO Registration | ZB378294 (Craig McKee) |
| Contact | info@headlite.co.uk |
| Website | headlite.co.uk |
We are committed to protecting the privacy and security of the personal information of all individuals who use our service. This privacy notice explains how we collect, use, store, and protect your data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
2. What Headlite does
Headlite provides personalised briefings, deadline tracking, and resource generation tools for school leaders. We monitor education policy, guidance, and sector developments and deliver filtered, contextualised summaries to help headteachers and senior leaders stay informed and take action.
We do not collect, process, or store any pupil data, student records, or information relating to children. Our service is designed exclusively for school leaders and education professionals in their professional capacity.
3. What personal data we collect
3.1 Account information
When you register for Headlite, we collect:
- Full name
- Email address
- Password (stored in hashed form — we cannot see your password)
- Job title / role within your school
Lawful basis: Contract (Article 6(1)(b) UK GDPR) — this data is necessary to create and manage your account and deliver the service you have signed up for.
3.2 School profile information
To personalise your briefings and resources, we collect institutional data about your school, including:
- School name and URN (Unique Reference Number)
- Phase (e.g., primary, secondary, all-through)
- School type (e.g., LA maintained, academy, free school)
- Pupil Premium percentage
- SEND percentage
- Deprivation index
- Region
This is institutional data drawn from publicly available sources (such as the DfE’s Get Information About Schools service) and is used to filter content relevant to your school’s context. It is not personal data in most cases, but we treat it with the same care.
Lawful basis: Contract (Article 6(1)(b)) and Legitimate Interests (Article 6(1)(f)) — to deliver a personalised, relevant service.
3.3 Payment information
If you subscribe to a paid plan, payment is processed through WooPayments (powered by Stripe). We collect:
- Billing name and address
- Phone number
- Payment card details (processed and stored securely by Stripe — we do not store full card numbers on our servers)
Stripe is PCI DSS Level 1 certified, the highest level of payment security certification. For details of how Stripe handles your data, see Stripe’s Privacy Policy.
Lawful basis: Contract (Article 6(1)(b)) — necessary to process your subscription payments.
3.4 Usage data
When you use the site, we automatically collect:
- IP address
- Browser type and version
- Pages visited and interactions
- Date and time of access
- Referring website
We use Google Analytics to understand how the service is used and to improve it. Google Analytics uses cookies and processes data in accordance with Google’s Privacy Policy. We use IP anonymisation where available.
Lawful basis: Legitimate Interests (Article 6(1)(f)) — to maintain, secure, and improve our service.
3.5 Email marketing
With your explicit consent, we may send you email communications about Headlite updates, new features, and education sector insights. Our email marketing is managed through Brevo (formerly Sendinblue).
- We only send marketing emails where you have given clear, affirmative consent (opt-in)
- Every marketing email includes an unsubscribe link
- You can withdraw consent at any time by clicking unsubscribe or contacting us
- Brevo processes data in accordance with Brevo’s Privacy Policy and is compliant with UK and EU GDPR
Lawful basis: Consent (Article 6(1)(a)) — you can withdraw this at any time without affecting the lawfulness of processing carried out before withdrawal.
4. How we use AI
Headlite uses artificial intelligence to generate personalised briefings and resources (such as policy templates, staff briefings, governor reports, parent letters, action checklists, and risk assessments). We use services provided by OpenAI and Anthropic.
Important safeguards:
- Your personal data is not used to train AI models. Both OpenAI and Anthropic provide API services where data submitted via their APIs is not used for model training.
- We send only the minimum data necessary to generate relevant content — typically your school’s phase, type, and context (not your name, email, or payment information).
- AI-generated content is based on published education guidance, policy, and sector information — not on personal data.
- All AI processing is carried out under our existing data processing agreements with these providers.
For details of how these providers handle data:
5. Who we share your data with
We do not sell, rent, or share your personal data with third parties for their own marketing purposes.
We share data only with the following categories of service providers, who act as data processors on our behalf:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| SiteGround | Website hosting | All site data (encrypted at rest and in transit) | EU/UK data centres |
| Stripe (via WooPayments) | Payment processing | Billing details, payment card data | UK/EU (with US processing under adequate safeguards) |
| Brevo | Email marketing | Name, email (where consent given) | EU |
| OpenAI | AI content generation | School context data only (no personal identifiers) | US (under Standard Contractual Clauses) |
| Anthropic | AI content generation | School context data only (no personal identifiers) | US (under Standard Contractual Clauses) |
| Analytics | Anonymised usage data via cookies | US (under adequate safeguards) |
All processors are bound by data processing agreements and are required to process data only on our instructions and in compliance with UK GDPR.
International transfers
Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the ICO, or reliance on adequacy decisions where applicable.
6. How we protect your data
We take the security of your data seriously and implement appropriate technical and organisational measures, including:
- SSL/TLS encryption for all data in transit
- Encrypted storage of data at rest
- Hashed passwords (we cannot access your password)
- Regular security updates and patching
- Access controls limiting who can view personal data
- Secure payment processing via PCI DSS Level 1 certified infrastructure (Stripe)
7. How long we keep your data
| Data type | Retention period |
|---|---|
| Account information | For the duration of your account, plus 12 months after deletion to comply with legal obligations |
| School profile data | For the duration of your account; deleted on account closure |
| Payment records | 6 years from the date of transaction (as required by HMRC) |
| Email marketing data | Until you withdraw consent or unsubscribe |
| Server logs | 90 days |
| Analytics data | 26 months (Google Analytics default) |
When data is no longer required, it is securely deleted or anonymised.
8. Your rights
Under UK GDPR, you have the following rights:
| Right | What this means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate or incomplete data |
| Erasure | Ask us to delete your data (the “right to be forgotten”) |
| Restriction | Ask us to limit how we use your data |
| Portability | Request your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests |
| Withdraw consent | Where processing is based on consent, withdraw it at any time |
To exercise any of these rights, contact us at info@headlite.co.uk. We will respond within one calendar month as required by law.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
9. Cookies
We use cookies to operate the site and improve your experience. Cookies fall into the following categories:
| Category | Purpose | Examples |
|---|---|---|
| Strictly necessary | Required for the site to function (login sessions, security, shopping cart) | WordPress session cookies, WooCommerce cart |
| Functional | Remember your preferences and settings | Dismissed briefings, filter preferences |
| Analytics | Help us understand how the site is used | Google Analytics (_ga, _gid) |
Strictly necessary cookies are set without consent as they are essential for the service to operate. Analytics cookies are only set with your consent via our cookie notice.
You can control cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the site from functioning correctly.
10. Children’s data
Headlite is a professional service designed for school leaders and education professionals. We do not knowingly collect personal data from anyone under the age of 18. Our service does not collect, process, or store any pupil data, student records, or child-level information of any kind.
If you believe that data relating to a child has been submitted to us in error, please contact us immediately at info@headlite.co.uk and we will delete it without delay.
11. Data relating to schools and the DfE
School profile data used by Headlite (such as school phase, type, URN, and published statistics) is drawn from publicly available sources including the Department for Education’s Get Information About Schools (GIAS) service. This data is already in the public domain and is used solely to personalise your experience.
We do not access any DfE secure systems, school management information systems, or any data that could identify individual pupils or families.
12. Changes to this notice
We may update this privacy notice from time to time to reflect changes in our practices or legal requirements. Where changes are significant, we will notify you by email or through a notice on the site. The “last updated” date at the top of this page indicates when the notice was most recently revised.
13. Contact us
If you have any questions about this privacy notice, how we handle your data, or wish to exercise your rights, please contact:
School Leader Support (trading as Headlite)
Email: info@headlite.co.uk
ICO Registration: ZB378294