Introduction
This Privacy Policy outlines how Bursary Assessment Associates (“we”, “our” or “the Company”) processes personal and financial information provided by applicants and clients (collectively “Users”).
We act on behalf of schools that use our bursary assessment services. Each school remains the Data Controller responsible for determining how and why your data is processed. Bursary Assessment Associates (BAA) acts as their Data Processor, processing your data solely in accordance with their instructions and under a written data-processing agreement.
Grounds for data collection
Processing of personal and financial information is necessary to assess a family’s financial circumstances and validate their eligibility for bursary or fee-assistance awards.
This includes evaluating a family’s ability to contribute to school fees. For example, where arrears exist, our report may note that the family has the financial means to meet outstanding obligations — enabling the school’s finance team to take appropriate action.
Our lawful basis for processing under Article 6(1)(e) and (f) UK GDPR is that the processing is necessary for the performance of a task carried out in the public interest (assessing financial assistance) or for the legitimate interests of the school in administering its bursary programme.
What information we collect
We collect and process:
- Personal details (names, addresses, contact details, dates of birth, parental status).
- Employment information and income details.
- Financial information including expenditure, assets, and liabilities.
- Supporting documentation (e.g. payslips, tax returns, bank statements, mortgage statements).
- Any additional information voluntarily supplied by applicants to support their application.
How we receive information about you
Applications are submitted to BAA via the online bursary portal together with supporting documentation.
In exceptional circumstances, paper application forms and documents may be sent either to the school or directly to BAA.
- If received by the school, these will be scanned and transmitted securely to BAA.
- If received by BAA, documents will be scanned and saved to our secure server, and all paper copies will be shredded securely once uploaded.
How we use your data
- The school is the Data Controller of your information.
- BAA acts as the Data Processor on behalf of the school.
BAA is registered with the Information Commissioner’s Office and has satisfied the client school regarding the security and confidentiality of all information and documents processed as part of your application.
Our processing activities
- We review the information you provide and may contact you to request missing details or supporting documents.
- Acting on behalf of the school, we process your information and share it securely with authorised representatives of the school, which may include members of the bursary, admissions, finance, or governance teams involved in bursary decisions.
- Where requested by the school, we will contact you to arrange an appointment to discuss your application to ensure that the assessment is accurate and comprehensive.
- Once the assessment is complete, we send our confidential report securely to the authorised representatives of the school. This may include members of the bursary, admissions, finance, or governance teams involved in the decision process.
- As the Data Controller, the school may request access to your submitted information or supporting documents at any time. This access may extend to authorised members of school staff and governors who are involved in admissions, bursary or financial-aid decision-making. BAA will facilitate such access securely and only in accordance with our data-processing agreement and the school’s data-protection policies.
- We scan and store securely all paper applications, notes, and supporting documents, and destroy paper copies once scanned.
This process is undertaken solely for the purposes of assessing bursary or fee-assistance applications.
Your information will not be shared with any third party other than your child’s school and, where applicable, additional schools you have applied to with your explicit consent.
Where a family has made applications to multiple client schools, and with the family’s and schools’ agreement, BAA may conduct a single meeting and assessment to support all relevant applications. In that case, the data provided by the applicant will be shared securely with each participating school for their independent decision process.
The confidential report produced by BAA remains the property of the client school and, in line with ICO guidance, is considered exempt from subject access requests.
User rights
Under the UK GDPR, you have the right to:
- Request confirmation of whether your personal data is being processed and access a copy of that data.
- Receive data you have provided to us in a structured, commonly used, and machine-readable format.
- Request rectification of inaccurate or incomplete data that is within our control.
- Request erasure of personal data (subject to the school’s legal or legitimate-interest requirements).
- Object to or request restriction of processing by either BAA or the school.
- Lodge a complaint with the Information Commissioner’s Office (ICO).
Please note that these rights are not absolute and may be limited where processing is necessary for legitimate interests or legal obligations.
To exercise any of these rights, please contact our Data Protection Lead: Natalie Williams.
office@bursaryassessmentassociates.co.uk
Data retention
Retention periods are determined in line with the school’s requirements and relevant legal obligations.
Typically:
- Application forms are retained for seven years, and
- Supporting documents for two years following the conclusion of the bursary decision process,
unless the school instructs otherwise.
All records are securely deleted or destroyed once retention periods expire.
How we safeguard your information
BAA is registered with the Information Commissioner’s Office and takes all reasonable technical and organisational measures to protect personal data from unauthorised access, misuse, or loss.
All team members:
- Receive annual data-protection training,
- Are bound by confidentiality clauses in their contracts, and
- Are required to adhere to secure data-handling procedures at all times.
We employ industry-standard security controls — including encrypted transmission, restricted access, and secure backups — and require any third-party suppliers to meet equivalent standards.
Updates to this Privacy Policy
We may periodically update this policy to reflect changes in law, regulation, or operational practice.
Material changes will take effect immediately upon publication of the revised policy on our website or notification to client schools.
How to contact us
You can contact us at office@bursaryassessmentassociates.co.uk
Registered office:
Bursary Assessment Associates
The White House
Wilderspool Business Park
Greenall’s Avenue
Warrington
WA4 6HL
The company is registered with companies’ house, registration number is 11078885.
We are registered with the information commissioner’s office (ICO) – reference number A8422092