The School Food Project | Chefs in Schools Privacy Policy
This website covers two areas: the School Food Project and Chefs in Schools’ own programmes and activities. Both are operated by Chefs in Schools as data controller. This privacy policy applies to both areas. Please read the note at the start of this policy to understand which provisions are relevant to you.
About this website and how to use this policy
This website is operated by us, Chefs in Schools (registered charity number 1178964), which is the data controller for all personal data collected and processed through it.
The website has two distinct areas, reflecting the different roles and activities of Chefs in Schools:
The School Food Project area. Part of this website is dedicated to the School Food Project, a national programme run by a coalition of five organisations (including Chefs in Schools) that work together to improve school food in England. If you have come to this website in connection with the School Food Project, or if your school is participating in the School Food Project programme, the provisions dealing with the coalition and its members (in particular Section 2, Section 10, Section 12 and the coalition partner sharing described in Section 14) are relevant to you.
The Chefs in Schools area. The website also has a dedicated area for Chefs in Schools’ own activities. These include the Hub, the Members area (some features of which are subscription-based), and other school-related programmes run directly by Chefs in Schools, independently of the School Food Project. If you are engaging with Chefs in Schools through this area of the website, the provisions specific to the School Food Project coalition (Section 2 and the coalition partner sharing in Section 14) do not apply to your use of the website. Section 9 of this policy sets out how Chefs in Schools processes personal data in connection with its own activities.
Where you are unsure which area of the website you are using, or which provisions of this policy apply to you, please contact us using the details in Section 4.
Chefs in Schools is the data controller for personal data processed in both areas of this website. A single privacy policy covers both areas. Where a provision applies only to one area, we say so.
1. Who we are
Chefs in Schools (registered charity number 1178964) is the data controller for the personal data collected and processed through this website. That means we are responsible for deciding how and why your personal data is used, and for keeping it safe. Our registered address is: First Floor, River House, 1 Maidstone Road, Sidcup, Kent DA14 5RH.
Email: [email protected]
2. Our role in the School Food Project
This section applies to personal data processed in connection with the School Food Project. If you are using the Chefs in Schools area of this website, this section does not apply to your engagement with us. In that context, Chefs in Schools processes your personal data in its own right and not as part of the coalition arrangements described below.
Chefs in Schools is one of five organisations in a coalition known as the School Food Project, working together to improve school food across England. The other coalition members are The Food Foundation (charity number 1187611), School Food Matters (charity number 1134094), Bite Back (charity number 1180969), and Jamie’s Ministry of Food Foundation (company number 15371190).
We operate the School Food Project part of this website as part of the coalition arrangements, alongside our other roles in the programme. We share some personal data with other coalition members where this is necessary for delivering the programme. Each coalition member otherwise acts as a separate data controller for the data it handles.
Brightminded, our website developer and hosting provider, processes personal data on our behalf as a data processor. This means Brightminded handles your data on our instructions and for the purposes we specify. We have a data processing agreement in place with Brightminded.
3. What this policy covers
This policy explains what personal data we collect when you use this website, whether through the School Food Project area or the Chefs in Schools area, why we collect it, how we use it, and your rights. It applies to, for example:
- visitors to this website
- people who sign up to our newsletter or mailing list
- school staff, head teachers, catering managers and other education professionals who engage with the School Food Project or with Chefs in Schools’ own school programmes
- registered users of the Hub
- Members (from September 2026, Members) including those who subscribe to paid membership features
- participants in events, research or evaluation activities run by either Chefs in Schools or the School Food Project
- parents and guardians who interact with the programme
This policy covers personal data processed through the website and also our programme activities. Chefs in Schools may have separate privacy notices for other purposes (for example, employment). We have a separate Cookie Policy that explains how we use cookies and similar technologies on this website. This policy does not cover cookies in detail.
4. How to contact us
If you have any questions about this policy or about how we use your personal data, or if you wish to exercise any of your rights (see Section 19), please contact us at [email protected]
5. What personal data we collect and why
The table below sets out all the personal data we collect, who it concerns, why we collect it, and the lawful basis we rely on under UK data protection law.
We will only use your personal data for the purposes set out in this table unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will let you know and explain the legal basis for doing so.
| Personal data | Who this concerns | Why we collect it (purpose) | Lawful basis |
|---|---|---|---|
| Contact and Identity | |||
| Name | School staff, senior leaders, catering staff, sector stakeholders, Hub users | To contact individuals, manage programme relationships, and provide platform access | Legitimate interests (running our charitable programme and maintaining relationships with schools and stakeholders) |
| Email address | School staff, catering staff, stakeholders, Hub users, newsletter subscribers | To send programme communications, manage Hub access, and distribute updates. Consent-based email marketing is sent only to those who have opted in. | Legitimate interests (programme communications); Consent (newsletter and marketing emails) |
| Phone number | School staff, senior leaders | To respond to enquiries and coordinate programme delivery | Legitimate interests |
| Job title and role | School staff, catering staff, stakeholders, Hub users | To understand who we are working with and tailor our communications and support | Legitimate interests |
| School or organisation name | School staff and institutional contacts | To identify the school or organisation linked to each contact | Legitimate interests |
| Account login details (username and password) | Registered Hub users and Members | To provide secure access to the Hub platform | Contract (providing the platform service to you) |
| Consent records | Individuals who have opted in to mailing lists or media and communications activity | To record your communication preferences and comply with data protection law | Legal obligation (UK GDPR Article 7; ICO guidance on consent records) |
| Pupil Data | |||
| M&E data (pupil initials, age, gender, free school meal eligibility) | Pupils in programme schools | Collected directly by Bite Back, a separate coalition member, for programme monitoring and evaluation purposes. CIS does not collect or retain this data. Please refer to Bite Back’s own privacy notice here for full details of how Bite Back handles this data. | Bite Back’s responsibility as a separate controller. |
| Free school meal eligibility | Pupils (Bite Back, M&E purposes) | To understand the socioeconomic profile of pupils reached | Legitimate interests [as above] |
| Dietary requirements and allergens (special category data) | Pupils in programme schools | To enable CIS staff to manage allergen risk safely during cooking and food tasting sessions. This information is provided to CIS by the school before each session; CIS does not collect it directly. CIS does not retain dietary or allergen information at individual pupil level; any information retained is anonymised and held at class level only. | CIS accesses this data on the basis of the school’s sharing, the school having obtained parental consent. CIS processes no individually identifiable dietary data beyond what it sees during session delivery. |
| Cultural and religious dietary needs (special category data) | Pupils in programme schools | To enable CIS staff to plan and deliver menus that are inclusive and appropriate. As above, this information is provided to CIS by the school; CIS does not collect it directly and does not retain it at individual pupil level. | As above, accessed on the basis of the school’s sharing arrangements, with parental consent obtained by the school |
| School Kitchen Staff (HR Support Context) | |||
| CV, work history and personal statement | Head Chefs and kitchen staff at programme schools | Received as part of HR or recruitment support provided to schools; used to assess suitability for roles or inform staffing decisions | Legitimate interests (supporting programme schools with staffing) |
| Salary and pay information | Head Chefs and kitchen staff | To provide pay benchmarking or staffing advice to schools | Legitimate interests |
| Personal circumstances | Head Chefs and kitchen staff | Shared by schools or volunteered by the individual in the context of HR or workforce support. Handled with strict discretion and not retained beyond the immediate need. | Legitimate interests; (adapting programme delivery to support kitchen staff effectively). Where information shared incidentally includes health or other sensitive personal detail, Chefs in Schools’ practice is to record only the practical accommodation required rather than the underlying personal information, so that special category data is not retained |
| HR and competency process information (may include special category data) | Head Chefs and kitchen staff | To support schools with HR processes, performance or workforce development | Legitimate interests; Explicit consent for any special category elements |
| Hub and Platform Activity | |||
| Session attendance and participation timestamps | Registered Hub users and Members | To monitor engagement with learning sessions and Hub activities | Legitimate interests (monitoring and improving programme delivery) |
| Resources accessed and download activity | Registered Hub users and Members | To understand which resources are used and improve Hub content | Legitimate interests |
| Login activity and platform usage data | Registered Hub users and Members | To monitor platform performance and engagement levels | Legitimate interests |
| Forum posts and comments | Registered Members | To facilitate peer discussion and knowledge sharing among Members | Contract (membership terms); Legitimate interests |
| Survey and evaluation responses | Registered Hub users and Members | To evaluate Hub usefulness and improve programme delivery | Legitimate interests; Consent (where explicitly sought for specific surveys) |
| Photography, Video and Media | |||
| Photographs and video footage of identifiable individuals (may be special category biometric data where processed to identify individuals) | Event attendees, school staff, pupils, kitchen teams | To document programme delivery and support communications, fundraising and advocacy | Consent (via our media consent form). Where footage is processed in a way that constitutes biometric processing: Explicit consent. |
| Names and attributed quotes (case studies and testimonials) | School leaders, teachers, catering staff, pupils (with consent) | To demonstrate programme impact and support advocacy and fundraising | Consent |
| Named school endorsements | Headteachers, principals and CEOs | To build credibility and encourage other schools to apply to the programme | Consent; Legitimate interests (where the individual acts in a professional public capacity) |
| Research and Evaluation | |||
| Audio and video recordings (may be special category data) | Focus group participants and user research participants | To capture qualitative data for Hub and programme evaluation | Consent (obtained from each participant before the session begins) |
| Research interviews, focus group responses, consultation responses, surveys and session logs | School leaders, staff, pupils, parents, stakeholders and research participants | To gather qualitative and quantitative data informing programme design, delivery and learning. Attributable quotes are treated as personal data even where anonymisation is intended. | Consent; Legitimate interests (where data is collected as part of programme management and evaluation) |
6. Sensitive (special category) data
Some of the data described in Section 5 is classified as ‘special category’ personal data under data protection law. This type of data is treated with additional care because of its sensitivity. Where we process special category data, we are required to identify both a lawful basis and a separate condition under UK GDPR.
We process the following types of special category data:
Dietary requirements, allergens and cultural or religious dietary needs
Where we deliver cooking and food education sessions in schools, schools may share information about pupils’ dietary requirements, allergies and allergens and cultural or religious dietary needs with us before the session. This information is collected by the school, which obtains consent from parents or guardians. CIS does not collect it directly from pupils of parents. We use this information during the relevant session to enable staff to plan appropriate menus and manage allergen risk. CIS does not retain this information at individual pupil level. Staff who encounter this information are expected to treat this data with strict discretion and share it only with those who need it for safe session delivery (including chef trainers, the kitchen team and the relevant programme lead).
Photographs and video (biometric data)
Some photographs and video footage we collect may constitute biometric data where we process it in a way that allows individuals to be uniquely identified. We collect this only with consent and use it for the communications and advocacy purposes described in Section 10.
Personal circumstances and health information (school kitchen staff)
In providing HR and workforce support to schools, Chefs in Schools may be told about personal circumstances of kitchen staff, for example, caring responsibilities, family situation or health conditions, that are relevant to how programme support is delivered, This information is typically shared verbally by the school or volunteered by the individual. Chefs in Schools’ practice is to record only the practical implication for programme delivery (for example, that adjusted scheduling is needed), rather than the underlying personal detail. Any information noted is used solely to adapt the support provided and is not shared beyond the relevant programme lead and the school’s senior leadership team. Meeting notes containing this information are deleted once the relevant HR support has concluded.
Audio and video recordings (research and evaluation)
Where we conduct focus groups or research sessions, we may record audio and video. These recordings may constitute special category data. We obtain explicit consent from all participants before any recording begins.
7. How we collect your data
We collect personal data in the following ways:
- Directly from you: when you fill in a form on our website, sign up to our newsletter or mailing list, register for the Hub, attend an event, take part in research, or contact us.
- Automatically via the website: when you use our website, we may automatically collect technical data about your device, browser and how you interact with our pages. See our Cookie Policy for details.
- From coalition partners: we may receive contact information from other School Food Project members where they have been working with your school and have shared your details for programme purposes.
- From referrals and nominations: we may receive your details if you have been nominated or referred by an existing member, school or partner organisation. Where this happens, we will contact you promptly and provide you with this privacy policy.
- From your school: in the HR support context (Section 12), information about kitchen staff may be shared with us directly by the school.
8. The Hub and members area
The Hub is an online platform on this website that provides resources, training materials and tools for school food professionals. You will need to register for an account to access the Hub.
From September 2026, the website will include a Members area. Membership will give registered Members access to additional features, including peer forums, exclusive resources and community discussion boards. Details of any membership fees and the terms of membership will be set out in the membership terms and conditions.
When you use the Hub or Members area, we collect the data described in the ‘Hub and Platform Activity’ section of the table in Section 5, including your session attendance, the resources you access, and your login and usage activity. We use this information to run the platform, monitor performance and improve the service.
Forum posts and comments made in the Members area will be visible to other Members and to the Chefs in Schools team. Please do not post personal information about third parties in the forum without their knowledge.
9. Chefs in Schools’ own programmes and activities
Separate from its role in the School Food Project, Chefs in Schools runs its own school-related programmes and activities. These currently include the Chefs in Schools School Transformation Programme, School Chef Educator Programme, Membership Programme and bespoke training events. The Chefs in Schools area of the website, including the Hub and Members area (described in Section 8), also operates in support of Chefs in Schools’ own activities.
When you engage with Chefs in Schools through this area of the website, your personal data is processed by Chefs in Schools in its own right, and not as part of the School Food Project coalition. The data sharing with coalition partners described in Section 15 does not apply to personal data you provide in connection with Chefs in Schools’ own activities.
The types of personal data we collect in connection with Chefs in Schools’ own programmes are the same as those described in the table in Section 5, to the extent relevant to your engagement with us (for example, contact and identity data, Hub activity data and, where applicable, research and evaluation data). We use that data for the corresponding purposes and on the lawful bases set out in that table.
Subscription-based membership
The Members area of the website is available on a subscription basis. Where you subscribe to paid membership, we may collect:
- your name, email address and billing address;
- payment details — these are processed securely by our payment provider, currently Stripe; Chefs in Schools does not store payment card details; and
- your subscription history and renewal dates.
We use this information to process your subscription, manage your account and send you renewal and billing notices. The lawful basis for this processing is ‘contract’ (we need this information to perform the membership agreement with you). We retain billing records for six years from the date of each transaction to comply with our statutory accounting obligations.
10. Photography, video and media
We may take photographs or video footage at events, in schools and during programme activities. We use this material to document our programme and its impact, to share our work through our communications channels, including our website, LinkedIn, Instagram, Facebook and YouTube, to support fundraising, advocacy and grant reporting, and to produce case studies and testimonials (with named consent).
We will always ask for your consent before photographing or filming you. Where we photograph or film children, we obtain consent from parents or guardians (or from the school acting on their behalf) before the activity takes place.
You can withdraw your consent for the use of photographs or footage featuring you at any time by contacting us at [email protected]. We will remove the material from our active channels as soon as reasonably practicable. Please note that once material has been shared publicly (for example in printed publications) it may not be possible to remove it from every source.
Where we publish case studies or testimonials with attributed quotes, we do so only with the explicit consent of the individual concerned.
11. Children and pupils
Our programme works in schools and therefore involves children to a limited extent. We take our responsibilities in relation to children’s personal data very seriously.
Where we collect or process personal data relating to pupils, this is limited to what is necessary for programme delivery (for example, dietary and allergen information for cooking sessions) or for monitoring and evaluation purposes. The position differs depending on which coalition organisation is collecting the data:
Monitoring and evaluation data (initials, age, gender and free school meal eligibility): This data is collected by Bite Back, another coalition member, which leads the programme’s monitoring and evaluation activity. Bite Back acts as a separate data controller for this processing. This policy does not cover Bite Back’s processing of this data. Please contact Bite Back for information about how they handle it. You can access their Privacy Policy here.
Dietary, allergen and cultural or religious dietary data: this information is collected and held by the school, which obtains parental consent. The school shares it with CIS solely to enable safe session delivery. CIS accesses it during sessions but does not retain it at individual pupil level; any information CIS holds is anonymised and recorded by class. The school is responsible for its own data protection obligations in relation to this data, including obtaining and recording parental consent.
We do not knowingly collect personal data directly from children through this website. The Hub and Members area are intended for adult professionals. If we become aware that we have inadvertently collected personal data from a child under 18 through the website without appropriate parental consent, we will delete it promptly.
Chefs in Schools staff who work in schools are expected to handle any pupil data they incidentally encounter on site (for example, on registers or school systems) with discretion and in accordance with the school’s own data protection policies. We do not record, store or act on incidentally observed pupil data independently.
12. School kitchen staff
Part of our programme involves providing HR and workforce support to schools, which may include helping with recruitment, staffing decisions or pay benchmarking for head chefs and kitchen teams. In this context, we may receive personal data about kitchen staff, including CVs, work history, salary information and, in some cases, information about personal circumstances.
This data is received from the school (typically the senior leadership team) or, occasionally, volunteered directly by the individual. It is used only to inform the support we are providing to that school and is shared only with the school’s senior leadership and the relevant Chefs in Schools programme lead.
Where personal circumstances are raised in the course of an HR or other support conversation, our staff record the practical accommodation or adjustment need, not the underlying personal or health detail. We treat this information with strict discretion, use it only for the immediate purpose for which it was shared, and do not retain it once our support in that area has concluded.
If your data has been shared with us in this way and you would like to know more about how we handle it, please contact us at [email protected]
13. Research, evaluation and focus groups
This section covers research and evaluation activities conducted by Chefs in Schools. Monitoring and evaluation of pupil outcomes is conducted by Bite Back as a separate data controller and is not described here; please see Section 11 and Bite Back’s privacy notice here for further information.
We may invite school leaders, staff, pupils, parents and other stakeholders to take part in research or evaluation activities, such as interviews, focus groups, surveys and consultation sessions. Participation is always voluntary.
Where we record audio or video during these sessions, we will ask for your explicit consent before the recording begins. You may withdraw your consent at any time, in which case we will not use the recording for any further purpose.
Research data is used to evaluate and improve our programme. Where findings are shared externally (for example in reports to funders), we use aggregated or anonymised data wherever possible. Where we attribute a quote to an individual in a publication, we will obtain their specific consent for that use.
We share research data with our coalition partners where relevant, and with funders in aggregated form only.
14. Future data collection (planned features)
The following data processing activities are planned but not yet in operation. We will update this policy before any of these features are launched.
Payment and transaction data
When payment functionality is added to the Members area, we will collect payment and billing details (including name, address and payment card information) to process purchases. We will use a third-party payment processor for this purpose, currently Stripe. Payment card details will be processed directly by the payment processor and will not be stored by Chefs in School.
Geographic data
We plan to collect postcode data from individuals signing up to the Hub or mailing list. This will be used to understand the geographic spread of our programme reach and will be shared with our programme team, M&E team and funders in aggregated form only.
Parent and guardian contact details
We may, in future, collect contact details from parents and guardians to communicate with them about programme activities, events or resources. We will update this policy to reflect this when it begins.
User-generated content
Members who upload resources, documents or images to the platform should be aware that uploaded content may be visible to other Members and to the Chefs in Schools team, depending on the platform settings. Members should not upload content that contains personal data about third parties without their knowledge.
Referral and nomination data
We may receive the names and contact details of individuals nominated or referred by existing members or schools. We will contact nominated individuals promptly and provide them with this privacy policy.
Recruitment board
A future recruitment board feature would allow organisations to advertise roles and receive applications. Job applicants’ CVs and personal statements may incidentally include special category data (for example, information about health conditions). CVs will be shared only with the relevant hiring organisation and programme partner, and retained for the duration of the recruitment process.
15. Who we share your data with
We may share your personal data with the following categories of recipient, in each case for the purposes described in this policy:
Coalition Partners
We share relevant personal data (such as contact details, consent records and programme engagement data) with other School Food Project coalition members where this is necessary to deliver the programme. Each coalition member is a separate data controller and is responsible for its own use of your data. The Coalition members are: The Food Foundation (charity number 1187611), School Food Matters (charity number 1134094), Bite Back (charity number 11408816), and Jamie’s Ministry of Food Foundation (company number 15371190), and further details are set out in Section 2 of this policy.
This sharing applies solely to the School Food Project. Personal data that you provide in connection with Chefs in Schools’ own programmes and activities (Section 9) is not shared with coalition partners and is handled by Chefs in Schools alone.
Brightminded (website developer and hosting provider)
Brightminded hosts and maintains this website and processes personal data on our behalf as a data processor. Brightminded acts only on our instructions and is bound by a data processing agreement with us.
Sodalis CRM
We use Sodalis as our customer relationship management (CRM) system to manage contacts and programme relationships. Sodalis processes personal data (such as name, email and organisation) on our behalf as a data processor.
Loqate (address lookup)
We use Loqate, a service provided by GBG Group (UK), to power the address lookup functionality on our sign-up forms. When you begin entering an address, partial address data (including postcode) is sent to Loqate’s servers to generate address suggestions. Loqate processes this data on our behalf as a data processor and does not use it for its own purposes.
Mailchimp
We use Mailchimp to manage our mailing list and send newsletter and programme communications. Mailchimp processes email addresses and related contact data on our behalf as a data processor. Please see Section 16 for information about international data transfers relating to Mailchimp.
Social media platforms
Where we post photographs, videos or case studies on our social media channels (for example, LinkedIn, Instagram, Facebook and YouTube), the personal data in that content will be processed by those platforms in accordance with their own privacy policies. We only post content about identifiable individuals where we have obtained their consent.
Funders
We may share aggregated, anonymised monitoring and evaluation data with our funders as part of grant reporting. We do not share personally identifiable data with funders.
Programme and delivery partners
We share relevant contact data with delivery partners (for example, chef trainers and programme leads) where this is necessary for the delivery of specific sessions or activities.
M&E team
Personal data relating to programme engagement, Hub usage and research participation may be shared with the programme’s monitoring and evaluation teams working on the programme (which may include staff from one or more coalition members. This team uses the data to measure programme impact and report to funders. Where Bite Back is involved in this activity, it acts as a separate data controller for any data it receives and processes for M&E purposes, and is independently responsible for its own compliance. Please refer to Bite Back’s privacy note here.
Other recipients
We may also disclose your personal data to:
- external media and publications, where you have consented to the use of your name or image in a case study or testimonial
- professional advisers (such as lawyers or auditors) under appropriate confidentiality obligations
- law enforcement or regulators where we are legally required to do so
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow third-party processors to use your personal data for their own purposes and only permit them to process it for the purposes we specify and in accordance with our instructions.
16. International transfers
Most of the personal data we process is stored and handled within the United Kingdom. However, some of the third-party services we use may transfer personal data outside the UK.
Mailchimp
Mailchimp is operated by Intuit Inc., which is based in the United States. When we use Mailchimp to send communications, personal data (including email addresses and contact details) may be transferred to and stored in the United States. Mailchimp uses standard contractual clauses (including the UK Addendum to the EU Standard Contractual Clauses) to ensure that data transferred outside the UK receives a comparable level of protection.
Other transfers
We use Google Analytics, provided by Google LLC (United States), to collect information about how visitors use this website, such as pages viewed, time spent on site and device type. IP addresses are anonymised before storage. Personal data collected through Google Analytics is transferred to the United States; Google LLC participates in the UK-US Data Bridge, which provides an adequate level of protection for such transfers. You can opt out of Google Analytics. For more detail on analytics cookies and how to manage your preferences, see our Cookies Policy.
Where we transfer personal data outside the UK, we take steps to ensure that appropriate safeguards are in place, including by using standard contractual clauses approved for use in the UK (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses). You can request a copy of the relevant safeguards by contacting us at [email protected].
17. Cookies and analytics
This website uses cookies and similar technologies to help us understand how visitors use the site and to improve your experience. A ‘cookie’ is a small text file stored on your device when you visit a website.
We also use web analytics tools to collect information about how visitors use our website (for example, which pages are visited most often and how long people spend on them). This data is used in aggregated form and is not used to identify individual visitors.
For full details of the cookies we use, how to manage your cookie preferences, and your rights in relation to cookies, please see our Cookie Policy.
18. Data security
We take the security of your personal data seriously. We have put in place appropriate technical and organisational measures to protect your data from accidental loss, unauthorised access, alteration or disclosure. These include:
- secure, password-protected accounts for Hub users
- encrypted connections (HTTPS) for data transmitted through the website
- access controls so that personal data is accessible only to those who need it
- data processing agreements with our service providers (including Brightminded)
We have procedures in place to deal with any suspected personal data breach. We will notify you and the Information Commissioner’s Office (ICO) of a breach where we are legally required to do so.
While we take appropriate steps to protect your data, no system is completely secure. If you create a Hub account, you are responsible for keeping your password confidential. Please contact us immediately if you believe your account has been compromised.
19. How long we keep your data
We keep personal data only for as long as is necessary for the purposes described in this policy, including to satisfy any legal, regulatory or reporting obligations. The table below sets out our indicative retention periods.
| Category of data | How long we keep it |
|---|---|
| Contact and programme management data (name, email, job title, phone, school) | Duration of the programme relationship, plus 2 years, after which we will review and delete unless there is a continuing legitimate reason to retain it. |
| Newsletter and email subscriptions | Until you unsubscribe or withdraw consent, after which we will delete your details within 30 days. |
| Hub account and login data | While your account remains active. Following account closure or inactivity for 12 months, we will delete your account data. |
| Hub and platform activity data (session logs, access logs) | While your account is active, plus 1 year after account closure. |
| Consent records | 6 years from the date consent was recorded, to enable us to demonstrate compliance. |
| Pupil dietary and allergen data (special category) | Deleted at the end of each programme engagement. |
| School kitchen staff HR data | 1 year after our HR support to that school concludes, or earlier if the individual requests deletion. |
| Photography, video and media | 3-5 years from the date of capture, subject to review. Deleted promptly following withdrawal of consent by the individual concerned. |
| Research and evaluation data (recordings, transcripts, session logs) | 5 years from project completion or publication of findings, in line with standard research retention practice. |
| Future payment and transaction data | 6 years from the date of the transaction (statutory requirement for accounting and tax purposes). |
In some circumstances we may retain your personal data for longer than the periods shown above, for example if we are involved in legal proceedings or are required to keep records by law. When personal data is no longer needed, we delete or anonymise it securely.
You have the right to ask us to delete your personal data in certain circumstances. See Section 20 for more details.
20. Your rights
Under UK data protection law, you have the following rights in relation to your personal data. There is no charge for exercising any of these rights. We aim to respond to all requests within one month; if your request is complex, we may take up to three months, and we will let you know if this is the case.
You have the right:
- to request a copy of the personal data we hold about you (commonly called a ‘subject access request’) and to check that we are using it lawfully.
- to ask us to correct any inaccurate or incomplete personal data we hold about you.
- to ask us to delete your personal data in certain circumstances, for example where we no longer need it for the purpose for which it was collected, or where you have withdrawn your consent and we have no other lawful basis for continuing to use it. This right is not absolute; we may be required to retain certain data to comply with a legal obligation.
- to object to our use of your personal data where we are relying on legitimate interests as our lawful basis. If you object, we will stop using your data for that purpose unless we have compelling legitimate grounds that override your interests, rights and freedoms.
- to object at any time to the use of your personal data for direct marketing. If you object, we will stop immediately. This is an absolute right.
- in certain circumstances, to ask us to suspend our use of your personal data, for example while we verify its accuracy or consider an objection.
- where we are using your personal data on the basis of your consent or to perform a contract with you, to receive a copy of that data in a structured, commonly used, machine-readable format.
- where we rely on your consent as the lawful basis for processing your personal data, to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it. To withdraw consent, please contact us at [email protected] or, for newsletter unsubscribers, use the unsubscribe link in any of our emails.
We do not currently make any decisions about you using solely automated processing (including profiling) that produce significant effects. If this changes, we will update this policy and comply with all applicable requirements.
To exercise any of your rights, please contact us using the details in Section 4. We may need to verify your identity before we can process your request.
21. Right to complain
If you have a concern about how we handle your personal data, we ask that you contact us in the first instance so we have the opportunity to resolve it. Please use the contact details in Section 4.
You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection. The ICO can be contacted at: www.ico.org.uk, Helpline: 0303 123 1113. The ICO will usually expect you to have raised the matter with us directly before it considers your complaint.
22. Links to other websites
Our website may contain links to other websites. This privacy policy applies only to our website. When you follow a link to another site, we encourage you to read that site’s privacy policy. We are not responsible for the privacy practices of any third-party sites.
23. Changes to this policy
We review this privacy policy regularly and will update it when necessary, including when we add new features to the website (such as the Members area) or when legal requirements change. We will post the revised policy on our website and update the ‘Last reviewed’ date at the top. Please check this page from time to time for any updates.
Last updated: 28th May 2026 | Version: 1.0
The School Food Project is a coalition initiative operated by Chefs in Schools (charity no. 1178964). Website operated by Chefs in Schools on behalf of the coalition.