Legal
Privacy Policy
Last updated: 14 June 2026
1. Who we are
Avenlight is a trading name of Denton Search Limited. Denton Search Limited (“Avenlight”, “we”, “us”, “our”) is a company registered in England and Wales (Company No. 06747105). We are an independent SEND advocacy and consultancy service operating across England. Denton Search Limited is the data controller for all personal information collected through this website, ehcp-help.co.uk.
Contact for data queries:
Email: hello@ehcp-help.co.uk
2. What personal data we collect
We collect the following categories of personal data:
- Identity data: your full name.
- Contact data: email address, phone number, postal address.
- Child data: age of your child and information you voluntarily provide about their educational, health and care needs.
- Special category data: information about your child's special educational needs, disabilities, diagnoses, and related health or wellbeing information. This is special category data under UK GDPR Article 9 and is processed only with your explicit consent.
- Case data: EHCP documents, school reports, professional assessments, local authority correspondence, and any other documents you upload or share with us.
- Payment data: payment confirmation details. We do not store full card numbers; payment processing is handled by our payment provider.
- Usage data: anonymised analytics data about how you interact with our website (see Section 8).
- Communications data: the content of any enquiries, messages, or correspondence you send us.
3. How we collect personal data
- Directly from you when you submit a contact form, booking form, or make a payment.
- When you upload documents through our secure document portal.
- When you create an account with us.
- Automatically through cookies and analytics tools when you browse our website (see Section 8).
4. Why we use your personal data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry | Legitimate interests (responding to contact requests) |
| Providing consultancy services you have engaged us for | Performance of a contract |
| Processing your payment | Performance of a contract |
| Processing your child's SEN information | Explicit consent (Article 9(2)(a)) |
| Maintaining records of work carried out | Legitimate interests / legal obligation |
| Sending service-related communications | Performance of a contract |
| Improving our services and website | Legitimate interests |
| Complying with legal or regulatory obligations | Legal obligation |
We do not use your personal data for automated decision-making or profiling in a way that produces legal or similarly significant effects.
5. Special category data (children's SEN information)
Information about your child's special educational needs, disabilities, health conditions, and related matters is special category data under UK GDPR Article 9. We process this information only on the basis of your explicit consent, which you provide when you submit our contact or booking forms.
You may withdraw consent at any time by emailing hello@ehcp-help.co.uk. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, but may mean we are unable to continue providing services to you.
6. Who we share your data with
We do not sell your personal data. We share it only in the following circumstances:
- Clerk (authentication): manages secure account creation and login. Privacy policy.
- Supabase (data storage): stores case data and uploaded documents securely. Data is stored within the EU. Privacy policy.
- OpenAI (AI-assisted review): where you consent to AI-assisted document analysis, document content may be processed by OpenAI. No personal data is used to train OpenAI models. Privacy policy.
- PostHog (analytics): anonymised usage analytics. No personal identifiers are shared. Data stored in the EU. Privacy policy.
- Sentry (error monitoring): captures technical errors to help us maintain service quality. May capture metadata about requests. Privacy policy.
- Payment provider: payment transactions are processed by our payment provider. We do not receive or store full card details.
- Legal obligation: we may disclose data to comply with a court order, legal obligation, or regulatory requirement.
All third-party processors are subject to data processing agreements that require them to handle your data securely and in accordance with UK GDPR.
7. How long we keep your data
- Active clients: for the duration of our engagement plus 6 years, to comply with our contractual record-keeping obligations and in case of legal claims.
- Enquiry data (not converted to client): 12 months from initial contact, then deleted.
- Payment records: 7 years for tax and accounting purposes.
- Analytics data: aggregated and anonymised; no personal retention limit applies.
We review our retention schedule annually and delete or anonymise data that is no longer required.
8. Cookies and analytics
Our website uses the following types of cookies:
- Strictly necessary cookies: required for authentication and secure session management (via Clerk). These cannot be disabled without breaking the site.
- Analytics cookies: PostHog analytics helps us understand how visitors use our site. These cookies are only set with your consent. They collect anonymised information and do not identify you personally.
You can manage your cookie preferences at any time by clicking “Cookie Settings” in the footer, or by adjusting your browser settings to refuse cookies. Refusing analytics cookies will not affect your ability to use the site.
9. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: ask us to correct inaccurate or incomplete data.
- Right to erasure: ask us to delete your data where there is no legitimate reason for us to continue holding it.
- Right to restriction: ask us to suspend processing of your data in certain circumstances.
- Right to data portability: receive your data in a structured, machine-readable format.
- Right to object: object to processing based on legitimate interests.
- Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, email hello@ehcp-help.co.uk. We will respond within one month. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).
10. International transfers
Where your data is processed by third-party suppliers outside the UK, we ensure that appropriate safeguards are in place, including UK adequacy decisions or standard contractual clauses, in accordance with UK GDPR Chapter V.
11. Security
We take the security of your personal data seriously. Our technical and organisational measures include encrypted data storage, access controls, secure authentication, and regular security reviews. However, no transmission over the internet is completely secure, and we cannot guarantee the absolute security of data transmitted to our site.
12. Changes to this policy
We may update this policy from time to time. The date at the top of this page will reflect when it was last revised. Material changes will be communicated to active clients by email. Continued use of our services after a policy update constitutes acceptance of the revised terms.
13. Contact
For any questions about this Privacy Policy or how we handle your data, contact us at hello@ehcp-help.co.uk.