Finchley Tamil Koodamதமிழ் · community · creativity Make an enquiry

Privacy notice

Last updated: 24 October 2026

Finchley Tamil Koodam is an informal, volunteer-run Tamil school. Its volunteer committee decides how the school uses personal information and is the data controller. Email info@finchleytamilkoodam.co.uk for privacy questions, corrections, consent withdrawal or a copy of information we hold. Gordon Hall is our teaching venue, not our privacy correspondence address; ask us by email if you need to write to us. This notice covers the school website and lessons portal; a separate Learning mode app is outside its scope.

For children

We keep the information needed to give you a place in class, help you learn and keep you safe. Your teachers can see your class work and progress. Other children may see your display name and game score when a class leaderboard is on, but they cannot see your private registration or allergy details. You or your parent can ask us what we keep and ask us to correct it.

What we collect and where it comes from

  • Contact and place enquiries: the sender's name, email, optional phone number, selected topic and message; for a place enquiry, the child's name, age, Tamil experience and optional non-sensitive learning notes. Someone other than a parent may contact us, so we may receive information about another person from the sender. Where practicable, we give that person this notice when we first contact them.
  • Accepted-place registration: the child's full name and date of birth; the parent or carer's name, address, phone numbers and email; their confirmation that they are completing the form for their child; a choice about whether to provide allergy information (including “none”); and separate choices about using the child's photo on our website and social media.
  • Lessons and school records: a child's display name, avatar, class, picture-password verifier, game results and learning progress; class plans and assignments; photos of class work with dates and captions; class match teams and results; and records of teacher and admin actions, including when a login card is issued or emailed. Teachers and admins create these records. School admins create a classroom login when placing a registered child in a class. The site generates an ordered three-picture password and stores a verifier, not the readable pictures, in the school database. The lessons portal does not ask children for their home address or date of birth; the separate accepted-place form does.
  • Accounts and teacher material: a teacher's name, email and role; a parent's or optional game player's Google account reference, linked child and game totals as applicable; and private teacher audio drafts and review records. A classroom singing activity may also make a recording that stays on that device and is not uploaded.
  • Technical data: the site and its providers process IP address, browser and security information to deliver pages, prevent abuse and keep people signed in. A school sign-in cookie may last up to 30 days. Games also store class-code, language and score preferences on the device. We do not set advertising or analytics cookies; embedded Google Forms and Cloudflare Turnstile may use their own browser storage while they are in use.

Why we use information and our legal bases

  • Answer questions, consider places and organise teaching: our legitimate interests under UK GDPR Article 6(1)(f) in running a small community school and replying to people who contact us. This includes class administration, progress records and photos of children's work.
  • Register an accepted child and provide classes: our legitimate interests under Article 6(1)(f) in organising teaching, creating a classroom login, staying in touch with families and keeping accurate pupil records. We limit access to volunteers who need the information and take children's interests into account.
  • Handle allergy information: separate, explicit consent from the parent or carer under Article 6(1)(a) and Article 9(2)(a). We use it only to help volunteers support safety at school. The online registration form records the choice and its time. You can complete registration without giving allergy information online; if you choose this, we will contact you about any safety arrangements before the child attends. The person who gave consent may withdraw it by emailing us; we will discuss safe arrangements and remove the information unless another lawful reason requires us to keep it.
  • Use a child's photo on our website or social media: separate yes/no choices from the parent or carer under Article 6(1)(a). Saying no does not affect a place. The person who gave consent can change either choice by emailing us. A published photo can be seen or copied by others; we can remove our copy after withdrawal but may not be able to remove copies others have made. Photos of completed schoolwork used privately in the lessons portal are different from a public portrait.
  • Protect accounts and the site: our legitimate interests in access control, fraud prevention and service security under Article 6(1)(f).

We do not make admission or other similarly significant decisions solely by computer. School volunteers review enquiries and registrations. Contact and place-enquiry fields marked required are needed to respond or assess the request; the accepted-place form needs the marked details to register a child. You are not legally required to use the forms, and you can contact us to discuss another way to provide necessary information.

Each September, for children currently attending, a school admin may check the registration record and manually email the stored parent or carer address a private, one-use link to confirm and correct the family's details. The link expires after 14 days. The form asks for fresh, separate choices about providing allergy information online, using the child's photo on our website, and using it on social media; earlier choices are not preselected, and existing allergy text is not shown. If you decline online allergy consent, we remove the old allergy text and contact you about any safety arrangements separately. If you enter a different contact email, we hold it pending while an admin verifies it through an existing trusted contact; until then, login-card emails continue to use the existing verified address. An admin checks the returned record before marking the yearly update complete. You can also tell us about a change at any time by email.

Who can see it and where it is stored

Designated school admins see contact, enquiry, registration and allergy details in the school portal. Class teachers see only the pupil and learning records they need for their classes. A child and their linked parent can see that child's permitted progress and work photos. Classmates may see display names and scores when a class leaderboard is enabled. Optional Google-linked game boards may show a chosen name and score to signed-in players.

Someone with a valid private registration link can see the learner and contact names, email address and phone number supplied in the accepted enquiry, so they can check and update those details. Please keep the link private and tell us if it reaches the wrong person.

Someone with a valid annual update link can see the ordinary registration details already held for that child and family, including names, date of birth, contact details and address, so they can correct them. The existing allergy text is not shown. Please keep this link private and tell us if it reaches the wrong person.

Our website, database and private work-photo and teacher-audio storage use Cloudflare. Google provides school email, the older contact and enquiry Forms and their linked response Sheets, and some sign-in features. Previously shared links to the older Google Forms may still accept responses until the school account owner closes them. Those responses reach the school Google account and may be forwarded to designated volunteers' personal accounts; we are reviewing access to those copies. Responses to the new website forms are stored in the school portal. Resend sends a general alert to the school Gmail address when a form arrives. Place-enquiry alerts include a reference number, but no name, message, child or health details. A reference number remains personal information because school admins can use it to find the applicant's record. When an admin emails a place offer, Resend receives the recipient's email address and the edited message, which may include the parent and child's names. The portal records whether the email service accepts the offer. When an admin emails an accepted applicant a private registration link from the portal, Resend receives the recipient's email address, the edited email text and the one-use link to deliver it. The portal records when the email service accepts the invitation, and Resend sends a separate confirmation to the school Gmail account with the enquiry reference but without the applicant's name or registration link. Replies to these emails go to the school Gmail account. Cloudflare Turnstile checks public website forms for abuse. These service providers process information for us under their terms; we do not sell personal information or use it for advertising.

When an admin sends an annual update link, Resend receives the stored parent or carer email address, the edited message and the one-use link to deliver it. The portal records whether the email service accepts the invitation. Resend sends a separate, general confirmation to the school Gmail account without child or health details. Replies go to the school Gmail account.

An admin may print a newly issued classroom login card or email it to the parent address on the child's registration. For an emailed card, Resend receives that address and the card's short classroom name, class code, ordered three-picture password and sign-in link. The school database keeps the password verifier and card delivery status, not a readable copy of the pictures. The parent and email provider may retain the readable email; please keep it private. A replacement card makes the earlier pictures stop working.

Cloudflare, Google and Resend may process information outside the UK. Cloudflare's data processing terms and Resend's data processing terms describe UK transfer safeguards; Google processes the older form and email copies under its applicable account terms. Ask us for details of the safeguards applicable to your information.

How long we keep it

  • Contact messages: three years after the last contact.
  • Unsuccessful place enquiries: two years after the later of the last contact or the intended intake, once the enquiry is closed. A separate review notice precedes any automated deletion of new website enquiries.
  • Accepted registration and allergy records: while the child attends, reviewed at least every four years and sooner when a family reports a change; deleted or anonymised three years after the child leaves.
  • Identifiable learning progress and child-specific class records, including login-card issue and delivery status: three years after the child leaves, to support a possible return; then deleted or anonymised. Photos of class work are deleted two years after the child leaves. A card emailed to a parent may remain in their mailbox until they delete it, subject to their email provider's retention.
  • Teacher audio drafts: kept while needed for teaching-material review, with unused drafts reviewed at least annually.
  • Sign-in and technical records: a sign-in cookie lasts no more than 30 days. We keep security and access records only while needed to operate and protect the site, subject to the provider's normal log cycle.
  • Backups and exports: removed when the underlying record reaches its deletion date, subject to the provider's normal backup cycle. The committee reviews backup arrangements at least every five years.

The yearly family update confirms details and permissions. It is separate from the committee's review of whether to keep accepted registration and allergy records, which takes place at least every four years and sooner when a family reports a change under the schedule above.

These are the committee's agreed retention periods. We are still reviewing older Google Form, Sheet and forwarded email copies against them; some older copies may not yet have been removed. We may keep a limited record longer where a specific legal claim or obligation requires it. Signing out ends the browser session; a class code or game preference stored on a device may remain until cleared in that browser.

Your choices and rights

You may ask to see, correct or erase information, restrict or object to some uses, or receive information in a portable form where that right applies. These rights have legal limits. A child can also make a request, and we will consider their age and understanding. Email info@finchleytamilkoodam.co.uk; we may need to check identity before sharing a child's information. You can withdraw allergy or public-photo consent at any time by the same address. Withdrawal does not undo lawful use before it reached us.

If you are unhappy with our response, you can complain to the Information Commissioner's Office. Please contact us first if you can, so we can try to resolve the issue.

Changes to this notice

We will update this page when our forms or data practices change and show the new date above. The lessons privacy guide gives children and parents a shorter explanation of the teaching portal.