HY Education Solicitors (“HYE”) is the trading name of HY Education Solicitors Limited (company number 12191172). We are regulated by the Solicitors Regulation Authority (SRA ID 668949).
HYE is a specialist education law firm providing legal services to schools, multi-academy trusts and other education sector organisations. We provide a range of specialist legal products and services, details of which are available on our website.
For the purpose of UK data protection law, HYE is the data controller in relation to the personal data processed when providing legal services. In this policy, “we”, “us” and “our” refer to HYE.
Our registered address is:
Sandbrook House, Sandbrook Way, Rochdale, OL11 1RY
HYE takes its data protection obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and related information rights legislation seriously. If you wish to contact us about data protection or information rights matters, please contact our Data Protection Lead (DPL):
Dean Hulse
Director and Barrister
Contact details:
Email: info@wearehy.com
Telephone: 0161 543 8884
Address: Sandbrook House, Sandbrook Way, Rochdale, OL11 1RY
Personal data means information that identifies you as an individual.
Depending on how you interact with us, we may collect and use the following types of personal data:
Where a client instructs HYE in relation to a specific matter, or subscribes to one of our subscription services, we process personal data as part of the onboarding and relationship management process. This typically includes details of key contacts, such as names, job titles, email addresses and telephone numbers.
We are required to comply with laws and regulations relating to Anti-Money Laundering (AML) and counter-terrorist financing. To meet these obligations, we may be required to carry out identity checks and, where appropriate, source of funds or source of wealth checks. This may involve processing identification documents and related personal information.
When we act for clients, we process personal data relating to individuals connected with the legal services we provide. This applies across all of our practice areas.
Across most client files, we typically process:
This information may relate to client representatives, employees, pupils or students, parents and guardians, governors, trustees, witnesses, counterparties and other third parties.
Some of our specialist legal services necessarily involve the processing of special category personal data, as defined by data protection law. This includes personal data revealing information about an individual’s health, special educational needs or disabilities, safeguarding concerns, or other sensitive matters.
We only process special category personal data where it is relevant, necessary and lawful.
In education-related matters, we may process special category personal data, for example where information relates to:
In employment-related matters, we may process special category personal data, for example where information relates to:
When providing data protection advice, acting as a Data Protection Officer (DPO), or handling subject access requests, we may process special category personal data where it appears within records provided to us. This may include:
The examples above are not exhaustive and the specific types of special category personal
data processed will depend on the nature of the legal services provided.
Other personal data that we process may include:
We collect personal data in a number of ways, including:
We collect data through our website:
For more information, please see our Cookie Policy.
We rely on the following lawful bases under the UK GDPR:
Processing is necessary for our legitimate interests in providing legal advice and services to our clients, managing and administering legal matters, communicating with relevant individuals, and maintaining accurate legal records and marketing activities.
Processing is necessary to comply with legal and regulatory obligations, including anti- money laundering, regulatory and accounting requirements.
Where we process special category personal data, we rely on:
We use your personal data to:
We may share personal data with:
We only share personal data where this is lawful, necessary and proportionate, and only for the purposes set out in this policy.
Some service providers may be based outside the UK. Where this happens, we ensure appropriate safeguards are in place, including UK-approved contractual protections. You can request more information about these safeguards by contacting us.
We have appropriate technical and organisational measures in place to protect your personal data. Access is limited to those who need it, and all staff and partners are subject to confidentiality obligations.
We keep your personal data only for as long as necessary for the purposes it was collected, including legal, regulatory and professional obligations. In some cases, we may retain data longer if there is a complaint or a potential legal claim. You can request further details about retention periods at any time.
You have rights under data protection law, including the right to request:
These rights are not absolute and are subject to applicable laws governing information rights. If you wish to make an information rights request, please contact the Data Protection Lead using the details provided in this policy.
You have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk
We would welcome the opportunity to resolve any concerns first, so please contact us directly.
We keep this policy under review and may update it from time to time.
Last updated: February 2026.
Third-party links
Our website may include links to third-party websites. We are not responsible for their privacy policies and recommend that you review them when you leave our site.
