STARTSign in

Your information

START privacy notice

How START for Schools collects, uses, shares and protects personal information, and the rights you have under UK data protection law.

Issued 10 August 2026The High School of Glasgow

About this notice

START is committed to respecting privacy and protecting personal information entrusted to us. This notice explains how we use personal data about you in accordance with UK law.

Part of our commitment to transparency includes providing clear and easy-to-access information about how we collect and use personal data, including through your use of this website. Here we give an overview of what kinds of personal data we may collect, how it is collected and how we may use it. We also explain your rights and how the law protects you.

This notice supplements other statements and information notices that explain how we use personal data. Read it together with any additional privacy information we provide on specific occasions when we collect or process personal data about you, so you fully understand how and why we are using it. Additional information about automated technologies, commonly known as cookies, is explained in our Cookie Notice.

We keep this privacy notice under review. It may change from time to time. This version was issued on 10 August 2026.

Who we are

START for Schools (“START”) is a programme run by The High School of Glasgow for schools across Scotland.

UK law categorises the School as the “controller” of your personal data when you participate in START. In practical terms, this means the School is responsible for deciding how personal information about you is used and is required to provide the information in this notice.

The High School of Glasgow is registered as a charity in Scotland (registration number SC014768) and our registered office is at 637 Crow Road, Glasgow G13 1PL. We refer to ourselves as “we”, “our” and “START” in this notice.

Questions, concerns or complaintsEmail info@startforschools.com for more information about our privacy practices.

Who this notice applies to

This notice applies to:

  • individuals submitting enquiries about START;
  • applicants to participate in START;
  • current and former START participants;
  • family members and friends of START participants attending our events;
  • current and former START mentors or judges, and applicants for those roles;
  • prospective, current and former donors or supporters of START; and
  • individuals from partner organisations, such as schools, who are involved with, support or participate in START.

What is personal data?

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

How START obtains personal data

We may receive personal data about you from the following sources.

Direct interactions

Mostly, we receive personal data directly from you. You may give us personal data when applying to participate in a START programme, communicating with us by phone, email or otherwise, or interacting with us at events. This includes when you:

  • join the START Portal;
  • request information;
  • reserve a place at, or attend, events;
  • subscribe to communications or publications; or
  • give us feedback or contact us.
Third parties

We may receive or collect personal data about you from:

  • educational establishments, such as a lead teacher in your school, college or academy, who shares information to enable participation in a START programme;
  • family members, guardians, representatives, youth support services and organisations with which you have shared information;
  • other professionals working with you, such as external careers advisers acting on your behalf; and
  • partner organisations involved in running START events at which you share personal data, such as the University of Strathclyde, the University of Aberdeen and RBS.
Automated technologies or interactions

As you interact with our website, it automatically collects information about your equipment, browsing actions and patterns. It collects this data using cookies, server logs and similar technologies. Please see our Cookie Notice for further details.

Publicly available sources

We may receive or collect personal data about you from social media and other websites, and from business and financial reference sources such as LinkedIn.

Personal data used by START

Depending on our relationship with you, we may “process” - a legal term that includes collecting, using, storing and sharing - different kinds of personal data. We group these as follows.

Contact data

Address, email address and telephone numbers.

Criminal offence data

Personal data relating to criminal convictions and offences or related security measures. There are limited situations in which we use this information. When we do, it is subject to additional protection due to its sensitive nature.

Education data

Information relating to education and skills, such as:

  • details of current and previous education and schools attended;
  • related information provided by educational establishments, educational professionals or organisations working with you;
  • safeguarding information, such as court orders and professional involvement;
  • exclusion, suspension and behavioural information; and
  • references given or received by the School about participants.
Employment data

Information about employment, career, professional or business skills that you choose to share, such as your current work or business, employer and job title, business name, work history, achievements and professional memberships.

Family, lifestyle and social circumstances data

Information relating to family, lifestyle and social circumstances, for example:

  • names and contact details of other household members, including siblings who participate in START;
  • contact details for next of kin or emergency contacts, including a doctor and doctor’s practice;
  • family work and business activities, travel details, interests, preferences, leisure activities, membership of charitable or voluntary organisations, and philanthropic propensity and capacity to aid fundraising; and
  • car or vehicle details for people providing transport or using parking facilities.
Identity data

First name, maiden name, last name, username or similar identifier, title, gender, pronoun preferences, age, marital status, date of birth and information that identifies an individual and their personal characteristics, including physical description.

Image data

Photographic and video images of participants, and occasionally other people such as mentors, judges, family members or friends who attend events.

Marketing and communications data

Your preferences in receiving communications from us and third parties, including records of consent for electronic direct marketing, including fundraising information, where appropriate.

Participation data

Attendance records, events or sessions attended, number of absences or reasons for absence, trips and activities attended, and correspondence with and concerning participants, including feedback, compliments and complaints about your learning experience.

Profile data

Your username and password, and other information provided to create your online profile, such as your project, interests, aims or objectives and preferences.

Special category data

As defined by law, this includes personal data revealing nationality, racial or ethnic origin, political opinion, religious or philosophical beliefs, and information concerning health. This may cover:

  • medical information about a health condition, treatment, medication or allergies;
  • dietary requirements, including vegetarian, vegan, gluten-free and religious requirements;
  • Special Educational Needs and Disabilities (SEND) or additional support information, including reasonable adjustments;
  • health and safety information, including incident investigations, reports and accident book records; and
  • welfare and safeguarding information.

This information is subject to additional protection due to its sensitive nature.

Technical data

Technical information about the device you use to access our website. This may include your internet protocol (IP) address, browser type and version, time-zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use.

Usage data

Information about how you interact with and use our website and online services.

We also collect, use and share aggregated data, such as statistical or demographic data, which is not personal data because it does not reveal your identity.

Please help us keep your information accurate. Update us if your personal data changes during your relationship with us, for example if you have a new address or email address.

If you fail to provide personal data where we need to collect and use it - for example, to comply with a legal obligation - we may not be able to provide services you expect. We would contact you to discuss any such situation.

How we use personal data lawfully

Under UK data protection law, START must always have a “lawful basis” for collecting and using your personal information. The ICO explains lawful bases in more detail.

Legal obligation

Where we have to collect or use information to comply with the law.

Legitimate interests

Where it is necessary for START’s specific legitimate interests, or those of a third party, and your interests and fundamental rights do not override those interests.

We consider and balance the possible effect on you and your rights before using your personal data for our legitimate interests. These include contributing to educational life in Scotland, promoting the advancement of education for the public good, engaging with the wider community and advancing community development. They also include promoting, marketing and fundraising for START.

Recognised legitimate interests may include detecting, investigating or preventing crime, apprehending or prosecuting offenders, responding to an emergency, and protecting the security of our network and information systems.

Vital interests

In exceptional circumstances, collecting or using information may be needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. Vital interests may be our lawful basis where using personal data is necessary to protect someone’s life.

We may use your personal data under more than one lawful basis, depending on the specific purpose. Please contact us if you require more information.

Generally, we do not rely on consent as a legal basis for processing personal data, but we will obtain consent in some situations. You have the right to withdraw consent at any time by contacting us.

Data protection principles

We apply the general principles in UK data protection legislation. They require personal data to be:

  • used lawfully, fairly and transparently;
  • collected only for specified, explicit and legitimate purposes;
  • adequate, relevant and limited to what is necessary;
  • accurate and, where necessary, kept up to date;
  • kept in an identifiable form for no longer than necessary;
  • processed securely using appropriate technical and organisational measures;
  • transferred to another country only with appropriate safeguards; and
  • handled in a way that enables people to exercise their legal rights.

How START uses personal data

Below are the main ways we use personal data, the lawful bases we rely on and the types of data involved.

Admissions

Administration of admissions or onboarding for new START participants, including mentors and judges. This includes communicating about admissions, complying with legal or regulatory requirements, considering appropriate adjustments related to health or disability, and keeping process records.

Lawful basis

Legal obligation; legitimate interests.

Types of data

For participants: contact, education, family/lifestyle/social circumstances, identity, image, marketing and communications, participation, profile, special category, technical and usage data. For mentors and judges, this may also include criminal offence and employment data.

Communication

Providing START information through online and offline channels; sending emails, newsletters and publications; sharing networking and career opportunities and invitations; publishing reports and resources; and managing queries, complaints, concerns or claims.

Lawful basis

Legitimate interests.

Types of data

Contact, criminal offence, education, employment, family/lifestyle/social circumstances, identity, marketing and communications, participation, profile, special category, technical and usage data.

Mentoring, educating and supporting

Delivering project-based learning and educational services; mentoring and supporting learning; monitoring and reporting progress; organising related or extra-curricular events; and providing references about participation where appropriate. Personal data is shared for references only with your consent.

Lawful basis

Legitimate interests; consent in the limited situation described above.

Types of data

Contact, criminal offence, education, employment, family/lifestyle/social circumstances, identity, image, marketing and communications, participation, profile, special category, technical and usage data.

Ensuring welfare, including safeguarding

Safeguarding welfare, keeping participants safe, providing appropriate care, contacting families in emergencies, and contacting agencies such as law enforcement or social services when a disclosure indicates that a child or young person may be at risk of harm or is being harmed.

Lawful basis

Legal obligation; vital interests; legitimate interests.

Types of data

Contact, criminal offence, education, employment, family/lifestyle/social circumstances, identity, image, marketing and communications, participation, profile, special category, technical and usage data.

Ensuring security

Securing our network and information systems, protecting our organisation using security technologies on our website and in communications, and managing security incidents, including preventing unauthorised access or misuse.

Lawful basis

Legitimate interests, including the recognised legitimate interest of ensuring security.

Types of data

Contact, criminal offence, education, employment, family/lifestyle/social circumstances, identity, image, marketing and communications, participation, profile, special category, technical and usage data.

Regulation, reporting and legal compliance

Fulfilling regulatory and legal duties; enabling authorities such as the Information Commissioner or Health and Safety Executive to assess our work; cooperating with investigations and complaints; preventing, detecting, investigating, reporting or prosecuting suspected fraud or crime; and notifying you about changes to our terms or privacy notice.

Lawful basis

Legal obligation; legitimate interests.

Types of data

Contact, criminal offence, education, employment, family/lifestyle/social circumstances, identity, image, marketing and communications, participation, profile, special category, technical and usage data.

Project management

Management planning and forecasting, accounting and auditing, research and statistical analysis including diversity analysis required by law, assessing service quality, handling complaints, and establishing, exercising or defending legal claims.

Lawful basis

Legal obligation; legitimate interests.

Types of data

Contact, criminal offence, education, employment, family/lifestyle/social circumstances, identity, image, marketing and communications, participation, profile, special category, technical and usage data.

Sharing outcomes, including publications

Preparing, editing or publishing reports, resources and news about START and the achievements of people involved, including electronic formats such as podcasts and video; distributing or publishing these materials on our website or social media; and maintaining resources connected with START’s objectives.

Lawful basis

Legitimate interests.

Types of data

Contact, criminal offence, education, employment, family/lifestyle/social circumstances, identity, image, marketing and communications, participation, profile, special category, technical and usage data.

Engagement with former participants

Sharing information about START, networking, reunions and events with former participants, and organising and running those events.

Lawful basis

Legitimate interests.

Types of data

Contact, criminal offence, education, employment, family/lifestyle/social circumstances, identity, image, marketing and communications, participation, profile, special category, technical and usage data.

Fundraising, marketing and promotional activities

Raising funds to support capital projects, widen access or expand projects; sending marketing and fundraising communications by email or text and making calls; and carrying out donor due diligence, including confirming prospective donors’ identities where required by law.

Lawful basis

Legal obligation; legitimate interests; consent where given for specific electronic direct marketing communications, such as fundraising.

Types of data

Contact, criminal offence, education, employment, family/lifestyle/social circumstances, identity, image, marketing and communications, participation, profile, special category, technical and usage data.

Changes of purpose. We use personal data only for the purposes for which we collected it, unless we reasonably consider that we need to use it for a compatible reason. Contact us if you would like an explanation of how a new purpose is compatible with the original purpose.

Special category and criminal offence data

We may be required to process special category personal data and criminal offence data. We treat this sensitive personal information with particular care. Processing is done only when necessary and with respect for individual privacy, using appropriate security and safeguards.

As permitted by data protection law, we may use it:

  1. when necessary for reasons of substantial public interest, including supporting people with a disability or medical condition, safeguarding children or people at risk, ensuring equality of opportunity or treatment, preventing or detecting unlawful acts, meeting regulatory requirements or insurance purposes;
  2. to protect your vital interests, or those of another person, in a medical or other emergency where the person is physically or legally incapable of giving consent;
  3. to establish, exercise or defend legal claims, including obtaining legal advice and dealing with actual or prospective court proceedings;
  4. where necessary for archiving in the public interest, scientific or historical research, or statistical purposes, where this is proportionate and includes suitable safeguards for your rights and interests; or
  5. where you have made the information public.

This means that, where permitted by law and in accordance with this notice, personal data may be used without your knowledge or consent.

When special category or criminal offence data is used, we seek explicit consent unless the use is necessary and the law allows us to proceed without explicit consent in the limited and exceptional circumstances described above.

Sharing personal data

Where necessary and lawful, we share personal data with other people and external organisations, including:

  • START partner organisations, including schools, academies, colleges, universities and other educational establishments such as the University of Strathclyde; education or training providers such as Skillfluence Limited; corporate partners such as Morgan Stanley; event organisers; venue and catering providers; transport providers; and insurance providers, brokers or intermediaries;
  • organisations with which we need to share information for safeguarding reasons;
  • external auditors or inspectors, legal bodies and regulatory authorities such as the HSE and ICO;
  • Police Scotland, external investigators or the Procurator Fiscal in relation to suspected or alleged fraudulent or criminal activity;
  • organisations or people with whom we are legally obliged to share personal information, for example under a court order;
  • your family or emergency contacts, healthcare providers or emergency services, for example in an urgent situation;
  • independent professional advisers, including legal and financial advisers and auditors; and
  • suppliers and service providers carrying out specific tasks for us, including IT, security, website, HR and system administration, mailing and distribution, fundraising, marketing and promotional services.

We do not allow third-party service providers to use personal data for their own purposes. We permit them to process it only for specified purposes and according to our instructions.

Personal data may be made publicly available by START. An example is sharing an event or case-study video on a social media platform such as YouTube or LinkedIn.

International transfers

We may sometimes transfer personal data to service providers carrying out functions outside the UK. We ensure a similar degree of protection by transferring only to countries the UK government has found to provide an adequate level of protection, such as countries in the EEA, or by using specific standard contractual terms approved for use in the UK.

Security and retention

Keeping personal data safe

We use appropriate security measures to prevent personal data being accidentally lost, used or accessed without authorisation, altered or disclosed.

Internal access is limited to staff with a need to know. They have a duty of confidentiality and process personal data only on our instructions and in line with policies that meet our legal obligations.

We have procedures to deal with suspected personal data breaches and will notify you and any applicable regulator where required by law.

How long we keep personal data

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which we collected it, including legal, regulatory, tax, accounting and reporting requirements.

To decide the appropriate retention period, we consider the amount, nature and sensitivity of the data, the possible risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether those purposes can be achieved in other ways, and applicable legal, regulatory, tax, accounting or other requirements. Contact us if you require further details.

Your legal rights

You have rights under data protection law in relation to your personal data. The lawful basis we rely on affects which rights apply, and exemptions may apply in some circumstances.

  • AccessYou can ask for a copy of the personal information we hold about you and check that we process it lawfully. Exemptions mean you may not receive everything you ask for. Read ICO guidance on access.
  • RestrictionYou can ask us to suspend use of your personal information, for example while we establish its accuracy or the reason for processing it. Read ICO guidance on restriction.
  • RectificationYou can ask us to correct incomplete or inaccurate personal information. Read ICO guidance on rectification.
  • ErasureYou can ask us to delete or remove personal information where there is no good reason for us to continue processing it, including in some cases where you have objected to processing. Read ICO guidance on erasure.
  • Object to processingYou can object where we rely on legitimate interests and your particular situation gives you a reason to object. You can also object to direct marketing, including fundraising. Read ICO guidance on objecting.
  • Data portabilityIn specific situations, you can ask us to transfer personal information you gave us to you or another organisation. Read ICO guidance on data portability.
  • Withdraw consentWhere we rely on consent, you can withdraw it at any time by contacting us.
  • ComplainIf you have concerns about how we use your personal data, email info@startforschools.com. If you remain unhappy, you can make a complaint to the Information Commissioner.

How we respond to requests

We must respond without undue delay and within one month. It may take longer if your request is particularly complex or you make several requests. In that case, we will notify you and keep you updated.

We may ask for specific information to confirm your identity. This security measure helps ensure personal data is not disclosed to someone who has no right to receive it. We may also ask for more information or clarification to help us respond more quickly.

You do not normally have to pay a fee to exercise your rights. We may charge a reasonable fee where a request is clearly unfounded, repetitive or excessive, or we may refuse the request in those circumstances.