Last updated: 15 October 2026

1. About us

Williams Consultancy Group is a trading name of Williams Consultancy Group Ltd.

Company: Williams Consultancy Group Ltd. Company number: 17201663. Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. Email: info@williamsconsultancygroup.com

For UK data-protection law, Williams Consultancy Group Ltd will normally be the controller of the personal information described in this policy.

Where we provide services under the instructions of a school, local authority or other organisation, that organisation may be the controller and we may act as its processor. The relevant service agreement will explain the parties’ respective responsibilities.

​

2. Information we may collect

Depending on your relationship with us, we may collect:

names, addresses and contact details;

booking, appointment and payment information;

correspondence sent by email, website forms, WhatsApp or other communication services;

information about a child’s education, school, progress, attendance and support needs;

assessment information, reports, professional opinions and consultation notes;

information about SEND, ALN, disabilities, health or wellbeing where relevant;

information provided by parents, carers, schools, professionals and authorised representatives;

records of advice, meetings, agreed actions and services supplied;

consultation recordings where recording has been agreed in advance;

newsletter and marketing preferences;

website usage information, device information and cookie identifiers; and

information needed to satisfy legal, accounting, safeguarding and regulatory responsibilities.

We do not normally receive or retain complete payment-card details. Payments are processed by services such as Wix Payments or PayPal, which handle payment information under their own privacy terms.

​

3. Children’s information

Our work may involve personal information about children and young people. We aim to collect only the information reasonably necessary to provide the requested service.

Where a parent or carer provides information about a child, they confirm that they are authorised to provide it. Where a school or organisation supplies pupil information, it is responsible for ensuring that it has an appropriate lawful basis and authority to share that information with us.

We will consider the child’s age, understanding, rights and best interests when using their information.

​

4. Special-category information

Information concerning health, disabilities, SEND, ALN, ethnicity, religion or other particularly sensitive matters may constitute special-category data.

We will only process this information where we have both:

a lawful basis under UK data-protection law; and

an appropriate additional condition for processing special-category data.

This will commonly involve explicit consent where that is appropriate and valid. Other conditions may apply where processing is necessary for safeguarding, legal claims or another purpose permitted by law.

Consent for special-category information will be recorded and can normally be withdrawn. Withdrawal does not affect processing that was lawful before consent was withdrawn or information we must retain for another lawful reason.

​

5. Why we use personal information

We may use personal information to:

respond to enquiries;

arrange and administer bookings;

provide consultancy, assessment, advocacy, mentoring or professional-development services;

communicate with clients, schools and professionals;

prepare reports, recommendations and resources;

process payments and maintain financial records;

manage contracts and resolve concerns or complaints;

maintain appropriate professional and safeguarding records;

improve our website and services;

send newsletters and marketing where permission has been provided;

prevent misuse, fraud or security incidents; and

meet legal, accounting and regulatory responsibilities.

​

6. Our lawful bases

Depending on the purpose, we may rely on:

Contract: where processing is necessary to take steps at your request or deliver an agreed service.

Legal obligation: where we must keep or use information to comply with the law.

Legitimate interests: where reasonably necessary to operate, protect and improve our business, respond to enquiries, maintain appropriate records or establish and defend legal claims, provided that individual rights do not override those interests.

Consent: particularly for optional marketing, certain recordings and circumstances involving sensitive information.

Vital interests or safeguarding-related conditions: in exceptional situations involving the protection of an individual.

Consent to marketing can be withdrawn at any time.

​

7. Meeting recordings

A consultation or meeting will not normally be recorded without advance notice and agreement.

Before recording begins, participants will be told:

that recording is proposed;

why it is needed;

how it will be used;

who may receive it; and

how long it will be retained.

Where a child may be recorded, appropriate parental, carer or organisational authorisation must be obtained. Participants may raise concerns or request a non-recorded alternative where reasonably possible.

Recordings will not be published or used for marketing without separate express permission.

​

8. Marketing

We may send newsletters, updates and information about our services where you have consented or where another lawful marketing provision applies.

Every marketing email will provide a method of unsubscribing. You can also withdraw your permission by contacting info@williamsconsultancygroup.com.

Service communications concerning an existing booking or contract are not marketing messages and may still be sent where necessary.

9. Who we may share information with

We may share information, where necessary, with:

Wix, including Wix Bookings and Wix Payments;

PayPal and other payment providers;

Google, including Google Drive and Google Analytics;

Zoom and other agreed communication platforms;

professional advisers, accountants, insurers and IT providers;

schools, local authorities and professionals authorised to participate in the service;

safeguarding bodies, emergency services or public authorities where disclosure is necessary and lawful; and

courts, regulators or law-enforcement bodies where legally required.

We do not sell personal information.

Providers acting on our behalf are expected to process information only for authorised purposes and protect it appropriately.

​

10. International services and transfers

We work with clients in the UK and internationally. Some technology providers may process information in countries outside the UK.

Where UK data-protection law requires it, we will use an approved transfer mechanism or another lawful safeguard, such as an adequacy regulation, the UK International Data Transfer Agreement or an approved UK addendum to contractual clauses.

Clients outside the UK should be aware that their information may be processed in the United Kingdom and through the service providers identified in this policy.

11. Storage and security

Client documents, notes and records are stored within a controlled Google Drive account. We take proportionate measures to protect information, including:

password protection and two-step verification;

access restrictions;

secure devices and current software;

controlled sharing permissions;

avoiding public document links for confidential material; and

periodically reviewing and deleting information that is no longer needed.

No electronic system can guarantee absolute security. If a personal-data breach creates a risk to individuals, we will assess it and make any notifications required by law.

​

12. Retention

We currently apply the following general retention periods:

enquiries that do not lead to a service: normally 12 months;

client notes, reports and service correspondence: normally six years after the engagement ends;

financial and transaction records: normally six years;

consultation recordings: normally no longer than 90 days, unless a longer period is necessary and has been explained;

marketing information: until consent is withdrawn, the person unsubscribes or the information is no longer needed; and

consent records: for as long as necessary to demonstrate the consent on which processing relies.

School-commissioned information may be returned, retained or deleted according to the school’s written instructions and the applicable agreement.

Information may be retained longer where reasonably necessary for safeguarding, legal proceedings, insurance or another legal obligation. Retention will be reviewed, and unnecessary information will be securely deleted or anonymised.

​

13. Your rights

Depending on the circumstances, you may have the right to:

be informed about how your information is used;

request access to your personal information;

request correction of inaccurate or incomplete information;

request deletion;

request restriction of processing;

object to certain processing;

receive certain information in a portable format;

withdraw consent; and

complain about our use of your information.

These rights are not absolute and may depend on the lawful basis being used.

To exercise a right, contact info@williamsconsultancygroup.com. We may ask for information needed to confirm your identity.

You can also complain to the Information Commissioner’s Office at www.ico.org.uk. We would appreciate the opportunity to address your concern first.

​

14. Changes to this policy

We may update this policy when our services, providers or legal responsibilities change. The current version will be published on our website with its revision date.