Privacy Policy
How we use your information
Privacy notice for parents
Key information
This notice contains the key information about how and why we collect your personal information and what we do with that information. Personal information is information that identifies you and relates to you. For example, information about your family circumstances, your financial information and photographs of you.
We strongly recommend reading the full version of our parent privacy notice which can be found here and on the School’s website. You can also obtain a copy of the full privacy notice by contacting the Bursar at the School. The full version includes additional points, such as, the rights you have in your information including what decisions you can make about your information, for how long the School retains your personal information and our legal grounds for using your personal information.
The School's primary reason for using your personal information is to provide educational services to your child.
We set out below examples of the different ways in which we use your personal information and where that personal information comes from.
- We obtain information about you from admissions forms and from your child's previous school. We may also get information from professionals such as doctors and from local authorities.
- We may have information about any family circumstances which might affect your child's welfare or happiness.
- We will process financial information about you in relation to the payment of fees. In some cases we get information about you from third parties such as credit reference agencies or from your child's previous school(s).
- We may take photographs or videos of you at School events to use on social media and on the School website. This is to show prospective parents and pupils what we do here and to advertise the School. We may continue to use these photographs and videos after your child has left the School.
- We may send you information to keep you up to date with what is happening at the School. For example, by sending you information about events and activities taking place (including fundraising events) and the School newsletter.
- We may keep details of your address when your child leaves the School so we can send you details of the former pupils’ organisation, the Charltonians, and find out how your child is progressing. We may also pass your details onto the Charltonians.
In some situations we may need to share your information with third parties. For example:
- In accordance with our legal obligations, we may share information with local authorities, the Independent Schools Inspectorate and the Department for Education, for example, where we have any safeguarding concerns.
- If you have unpaid fees while your child is at the School we may share information about this with other schools or educational establishments to which you intend to send your child.
- On occasion, we may need to share information with the police, our legal advisors and our insurers.
The Bursar is the person responsible at our school for managing how we look after personal information. The Bursar will answer questions which you may have about how we use your personal information.
Parent privacy notice
Pembroke Education is committed to child protection and safeguarding children and young people across all its schools, and expects all staff, visitors, and volunteers to share this commitment.
1. Who we are
We are Pembroke Education, a charitable company registered in England and Wales with company number 00011701 and charity number 311736.
Pembroke Education incorporates Clifton High School, The Downs Preparatory School, Downs School Enterprises Limited (Bertie’s Nursery School), together with Pembroke Education Trading Limited, a company registered in England and Wales with company number 15391308. For the purposes of this policy, Pembroke Education also includes the community relationship, fundraising and alumni activities of The Clifton High School Foundation (the Foundation), registered with charity number 1201516, and the Charltonians, an unincorporated organisation.
The registered office for all our entities is College Road, Bristol BS8 3JD. In this policy we refer to Pembroke Education as ‘We’ where the syntax requires it. For ease of reference, this Policy may also refer to ‘each School’, ‘Schools’ or ‘School’ interchangeably as the context requires.
2. Who this Privacy Notice applies to
This Privacy Notice applies to all pupils at our schools (referred to in this policy as ‘pupils’ or ‘you’) and to all parents, carers and guardians (referred to in this policy as ‘parents’ or ‘you’).
Older pupils (i.e. pupils who reach their 13th birthday in the current academic year) are considered mature enough to understand this notice and to exercise their own data rights. Younger pupils are likely to require parental support to understand their data rights; therefore, parents may exercise those rights on their child's behalf until the academic year in which their child turns 13.
For parents of younger pupils exercising data rights on their child’s behalf, references in this notice to “you”, “your personal data” and “your rights” (and similar terms) refer to the child, their personal data and their rights.
A simplified guide explaining this Privacy Notice to pupils can be found in Appendix A, but we encourage all parents and pupils to read this notice in full to understand their rights and our obligations. For younger pupils, we ask parents to explain those rights to their child in an age-appropriate way.
3. Child Protection and Safeguarding
Child protection and safeguarding requirements always supersede data protection legislation. If information needs to be shared in the interests of child protection and safeguarding, this Privacy Notice can never be used as a reason not to do so.
4. About this Privacy Notice
Pembroke Education collects, uses and holds (“processes”) your personal data and is the data controller of your personal data. This Privacy Notice is intended to provide information about how and why we collect personal information about you, and what we do with that information. It also explains what your rights are in relation to your personal data.
This Privacy Notice applies alongside any other information Pembroke Education, or its individual schools, may provide you about a particular use of personal data, and applies in addition to the Pembroke Education’s other relevant terms and conditions and policies, including:
- School Terms and Conditions;
- The Data Protection Policy and the Data Retention and Disposal Policy;
- School Child Protection and Safeguarding policies, and pastoral and health and safety policies;
- School CCTV policies;
- School Staff Taking, Storing and Using Images Policies; and
- IT policies, including the Acceptable Use of ICT Policies and the Online Filtering and Monitoring Policies.
5. What is personal data?
Personal data is information that Pembroke Education holds about you that identifies you as an individual and includes information such as your name, date of birth and address, and in the case of pupils, information like examination results, medical details and behaviour records.
Pembroke Education’s primary reason for using your personal information is to provide pupils with an education.
6. Responsibility for data protection
Pembroke Education has appointed the Finance Director as the Data Protection Lead, whose role is to monitor that all personal data is processed in compliance with this Privacy Notice and the principles of the applicable data protection legislation.
Any questions about the operation of this Privacy Notice or any concerns that the Privacy Notice has not been followed should be referred in the first instance to the Data Protection Lead (finance@cliftonhigh.co.uk/0117 973 0201/Extension 227). Information relating to our complaint’s procedure is set out in section 16 below.
7. How we collect your information
We will usually receive personal data relating to you either from you directly, or if you are a pupil, from your parents or a person who has parental responsibility for you. However, in some cases your personal data will be supplied by third parties, for example by another school, or other professionals or authorities working with you, or collected from publicly available sources. The School will also collect information by way of our systems and processes, such as the CCTV and IT systems in place, including our online filtering and monitoring systems.
8. The types of data we collect and process
8.1 Personal data
Examples of the types of personal data that we may collect and process about pupils and parents are set out in Appendix B of this notice.
8.2 Special category personal data
Special category data is personal data that needs more protection because it is sensitive. The type of special category personal data we collect will depend on whether you are a pupil or a parent.
Pupils
We will collect and process special category personal data concerning your ethnicity and medical and health information (including information about any special educational needs and/or disabilities you may have). We may also, on occasion, collect and process special category personal data concerning your race religion, sexual orientation and biometrics.
Parents
We may on occasion, if you share it with us, collect and process your special category personal data concerning your health, special educational needs and disabilities, racial and ethnic origin, religion and sexual orientation.
We will only collect information about criminal convictions where we are legally required to do so and will only use that information where the law allows us to do so. This will usually be where it is necessary to perform our legal obligations.
Examples of the reasons why we collect special category personal data are set out in section 10.2 below.
9. The legal justification for processing your personal data
We need to process your personal data as part of our daily operations, but we will only process your personal data where it is lawful for us to do so. There are a number of grounds on which we are lawfully allowed to process your data, and they are the following:
9.1 Legitimate interests
We will process your personal data where it is necessary for Pembroke Education’s (or sometimes a third party's) legitimate interests. This is the most common ground on which we process personal data.
When we process data because it is necessary for our legitimate interests, it must not involve special or sensitive types of data (unless you give consent), and we must balance our legitimate interests with your privacy, interests, rights and freedoms.
Examples of purposes for processing personal data which are justified under legitimate interests, as recognised in law or determined by Pembroke Education, are set out in Appendix C of this notice.
9.2 Consent
We may ask for your consent to process your personal data as an alternative to relying on legitimate interests or one of the bases below. For example, we may ask for your consent before taking or using photographs and videos of you if the photograph or video is more intrusive than would usually be expected and we cannot rely on legitimate interests for that use, and we will usually ask for your consent before processing personal data in relation to our bursary application process.
If we ask for your consent to use your personal data, you can withdraw this consent at any time.
To enhance the security of our IT systems, our schools may offer a fingerprint sign in option for pupils as an alternative to using a PIN. We use Windows Hello for Business on laptops and desktops, and TouchID on Apple iPads. We do not store an image of your fingerprint on a central server. Instead, a digital "template" is created, encrypted, and stored locally on the device – and is not accessible to anyone else, including any of our schools, or Apple. You consent to using TouchID by choosing it as your sign-in option, but it is optional and you can revert to using a PIN and remove the Touch data that has been recorded on your school device at any time. Further information on TouchID can be found here: AppleSecurity and Legal - Touch ID & Privacy- Apple.
9.3 Performance of our contract with parents
We will process your personal data in order to fulfil our legal rights, duties and/or obligations to provide your/your child with an education.
9.4 Legal obligation
We will process your personal data to comply with our legal obligations, for example, in order to comply with child protection and safeguarding legislation, Keeping Children Safe in Education statutory guidance, and the School’s Child Protection and Safeguarding policies.
9.5 We have a vital interest
The School will process your personal data if it is necessary to protect your life. For example, information you have provided to us relating to a medical condition you have.
9.6 Public interest
The following are examples of when we use your information to perform tasks in the public interest:
- providing you/your child with an education;
- safeguarding and promoting your welfare/your child’s welfare and the welfare of other pupils at the school;
- facilitating the efficient operation of the schools;
- creating and preserving materials for permanent deposit in each School’s archive;
- preventing and detecting crime; and
- ensuring that we comply with all of our legal obligations.
10. Special category personal data
10.1 Additional conditions required for processing
We will process special category personal data in a lawful, fair and transparent way and will process it under one of the grounds set out in section 9 of this Privacy Notice. In addition, we will only process special category personal data where one of the following conditions applies:
- you have given us your explicit consent to do so, but only in circumstances where seeking consent is appropriate;
- you have already made the data publicly available; or
- it is necessary:
- for the purposes of carrying out obligations under social protection law;
- to protect your vital interests (if you are not legally able to give consent);
- for the establishment, exercise or defence of legal claims, such as where any person has brought a claim or serious complaint against us or you;
- to comply with public health requirements;
- in connection with some function in the substantial public interest; and/or
- for archiving, which is in the public interest or is for historical research purposes.
10.2 Reasons for processing special category personal data
The reasons for collecting special category personal data include:
- to provide education services;
- to safeguard you/your child’s welfare;
- to provide appropriate pastoral and medical care, and to take appropriate action in the event of an emergency, incident or accident;
- to ensure that your dietary and medical needs are met;
- to comply with public health requirements;
- to facilitate participation in the Fee Early Education Entitlement scheme (for pupils in the EYFS);
- as part of any school or external complaints, disciplinary or investigation process that involves such data, for example if there are SEND, health or safeguarding elements;
- to allow us to make insurance claims.
- for legal and regulatory purposes (for example child protection, diversity monitoring, health and safety and immigration/visa sponsorship compliance) and to comply with our legal obligations and duties of care; or
- to enhance the security of our IT systems.
10.3 Access to and sharing special category personal data
Pembroke Education is under statutory duties to record and report incidents and concerns involving our pupils that arise or are reported to us, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness. For example, we may be required to share special category personal data relating to safeguarding concerns with the Local Authority Designated Officer, Children’s Services, CAMHS and/or the police.
We are also required to share a pupil’s child protection file, along with any other information which each School’s Designated Safeguarding Lead considers material to the ongoing care needs of the pupil, if a pupil leaves one of our schools to join another school or college. This could include special category personal data relating to you.
In addition to the above, we may be required to share special category personal data with, for example, our insurers, our lawyers and the Home Office.
11. Who has access to personal data and who we share it with
Personal data collected by Pembroke Education will usually remain within the organisation, and will be processed by appropriate members of staff in accordance with access protocols (i.e. on a ‘need to know’ basis). However, we may share personal data within the group of organisations comprising Pembroke Education, such as between schools, or with Pembroke Education Trading Limited and the Foundation, and vice versa, where required.
There are some functions which are outsourced, including certain IT, cloud storage, records management and monitoring activities. We use a range of cloud-based learning environments and platforms to support the delivery of education. In accordance with data protection law this type of third-party data processing is subject to contractual assurances by the third party that personal data will be kept securely and processed and used in accordance with the law.
Examples of third parties which Pembroke Education may share your personal data with from time to time are set out in Appendix D to this Privacy Notice.
12. The Clifton High School Foundation (the “Foundation”)
If you are a parent with a child at Clifton High School, we may share some of your personal data (including your contact details) with the Foundation, so that the Foundation can keep you updated about activities or events of interest, and its marketing and fundraising activities. The Foundation may also collect information from publicly available sources about your background, occupation and activities. On occasions, it may analyse that data alongside the personal data we already hold about you in order to understand our alumni and who our potential donors might be. This process is often known as wealth screening and allows us to engage with our community more effectively.
The Foundation may contact you by post and/or email for marketing purposes or in order to promote and raise funds for the Foundation and, where appropriate, other worthy causes.
You have the right to withdraw consent, where given, or otherwise object to direct marketing or fundraising, including wealth screening. Should you wish to limit or object to any such use, or would like further information, please contact the Director of Development by email. If you withdraw consent or object to direct marketing or fundraising, the Foundation will retain some of your details to ensure that no more communications are sent to that particular address, email address or telephone number.
For further information, please see the Privacy Notice for Rosarians and Friends of Clifton High School.
13. How long is your information kept
We will retain personal data securely, and will retain it for as long as it is needed for the purposes set out in this Privacy Notice or for as long as the law requires us to. The specific periods of time are set out in the Data Retention and Disposal policy.
If you have any specific queries about how our retention policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact the Data Protection Lead using the contact details set out above. However, please bear in mind that the School will often have lawful and necessary reasons to retain some personal data following such request.
A limited and reasonable amount of information will be kept for archiving purposes in the public interest, for example; and even where you have requested we no longer keep in touch with you, we will need to keep a record of that fact in order to fulfil your wishes (called a "suppression record").
14. Rights
14.1 Your rights
You have the following rights:
|
You can find out more about your rights under applicable data protection legislation from the Information Commissioner’s Office website available at www.ico.org.uk.
14.2 The provision of information
14.2.1 Subject access requests
You can request access to your personal data (a Subject Access Request) by sending an email to our Data Protection Lead using the contact details above. All information requests, whether made under subject access or simply as an incidental request will be considered on a case-by-case basis, and requests not considered in pupils’ best interests may sometimes be refused.
Pupils can make subject access requests for their own personal data provided that, in the reasonable opinion of Pembroke Education, they have sufficient maturity to understand the request they are making. Older Pupils are generally assumed to have this level of maturity, although this will depend on their maturity, their personal circumstances at home and the personal data requested. We will generally assume that younger pupils do not have the requisite level of maturity, however, this is not an absolute rule, and older pupils at The Downs Preparatory School, or at Clifton High School in the Junior School, and pupils in Year 7 may be sufficiently mature to have a say in this decision, depending on the child and the circumstances.
A pupil of any age may ask a parent or other representative to make a subject access request on their behalf, however:
- the person will need to evidence the pupil’s authority to make the subject access request; and
- although a parent will generally be entitled to make a subject access request on behalf of younger pupils, the law still considers the information in question to be the child’s.
14.2.2 Educational information supplied to parents
Parents may not always have a statutory right to information under a subject access request, for example where the request is manifestly unfounded or excessive, but they will often have a legitimate interest or expectation in receiving certain information about pupils without their consent. We may consider there are lawful grounds for sharing with or without reference to that pupil.
Parents will in general receive educational and pastoral updates about their children, in accordance with School Terms and Conditions. Where parents are separated, we will in most cases aim to provide the same information to each person with parental responsibility, but may need to factor in all the circumstances including the express wishes of the child, court orders, or pastoral issues.
14.3 Limits to your rights
14.3.1 Lawful grounds for processing and exempt data
The rights set out in section 14.1 are not absolute, and the availability of the rights will depend on the lawful grounds on which we are processing your personal data (as set out in section 9).
In addition, the rights listed in 14.1 are limited to your own personal data, and certain data is exempt. This will include information which identifies other individuals, or information which is subject to legal privilege (for example legal advice given to or sought by the School, or documents prepared in connection with legal action, or where a duty of confidence is owed by a legal adviser).
14.3.2 Examination scripts
Pembroke Education is not required to disclose pupil examination scripts (or other information consisting solely of pupil test answers, which potentially includes mock exam scripts or other types of exams/tests used to assess performance, although markers’ comments may still be disclosable if they constitute pupil personal data). We are also not required to provide examination or other test marks ahead of their ordinary publication date, nor share any confidential reference held that was (or will be) given for the purposes of the education, training, appointment or employment of any individual.
14.4 Responding to the exercise of your rights
Pembroke Education will aim to respond to any requests as soon as is reasonably possible and in any event within statutory time-limits, which is generally one month, but fulfilling more complex or multiple requests, for example those involving third party information, may take two to three months longer.
15. Security
Pembroke Education will take appropriate technical and organisational steps to ensure the security of personal data, including policies around the use of technology and devices, and access to school systems.
All staff are made aware of this policy and their duties under data protection legislation and receive relevant training.
16. Complaints
If you believe Pembroke Education has not complied with this Privacy Notice, or acted otherwise than in accordance with data protection law, you should email the Clerk to Governors at ncridland@cliftonhigh.co.uk with details of your complaint. Pembroke Education will acknowledge your complaint within 30 days of receipt and will investigate and inform you of the outcome of your complaint without undue delay (keeping you informed of progress as necessary).
If you are not satisfied with the outcome of your complaint, or if you feel we have not handled it appropriately, you have the right to complain to the Information Commissioner’s Office (ICO).
Appendix A
|
Appendix B
Types of personal data the School collects and processes
Pupils’ and parents’ personal data
The personal data that we may collect and process about pupils and parents includes:
- contact and communications information, such as your name, address and other contact details;
- records of communications and interactions with you;
- information about family circumstances and living arrangements;
- nationality and other immigration status information in relation to student visa sponsorship (if applicable);
- images and videos of you engaging in school activities and recorded as part of filming, recording or streaming school events (in the case of pupils, in accordance with each School’s Staff Taking, Using and Storing Images Policy[MS3] ); and
- images and videos of you captured by CCTV systems.
Pupils’ personal data
The personal data that we may collect and process about pupils includes:
- references given or received about you and other relevant information provided by your previous nursery/school and/or any other professionals or organisations supporting you;
- a copy of your passport or birth certificate;
- your academic, disciplinary, admissions and attendance records;
- examination scripts and marks; and
- your pupil file, including information regarding your education and academic performance.
Parents’ personal data
The personal data that we may collect and process about parents includes:
- your telephone numbers and e-mail addresses;
- your bank details and other financial information (e.g. relating to bursary applications, payment of school fees and any anti-money laundering information we are required to collect by law); and
- information provided by your child’s previous educational establishments and/or any other professionals or organisations supporting your child.
Appendix C
Uses that fall within legitimate interests
The School expects that the following purposes for processing personal data will fall within Pembroke Education’s “legitimate interests”, as recognised in law or determined by us:
Pupils and parents personal data
- for pupil selection, to assess suitability for bursaries, to confirm your identity, and to retain a record if appropriate for the purposes of future applications;
- to provide education services;
- to make use of photographic images and video content of you in school publications, on Pembroke Education’s website, the websites of each School, or relevant social media channels, in accordance with the Staff Taking, Storing and Using Images Policy [MS4] (in the case of pupils);
- to promote Pembroke Education, or our schools, to prospective parents and pupils;
- to maintain relationships with the school community and to promote the objects of Pembroke Education. This includes fundraising and using photographs of you at school/at school events;
- to monitor each school's performance;
- to monitor use of IT and communications systems in accordance with applicable policies relating to the acceptable use of ICT;
- for security purposes, and CCTV in accordance with CCTV policies;
- for the prevention and detection of crime, and in order to assist with investigations carried out by the police and other competent authorities;
- for the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law;
- for regulatory record keeping/compliance purposes in respect of immigration requirements, as a visa sponsor;
- to carry out or cooperate with any School or external complaints, disciplinary or investigation process; and
- where otherwise reasonably necessary for each School's purposes, including to obtain appropriate professional advice and insurance.
Pupils’ personal data
- to share academic records and references with your past, current, or future schools; and
Parents’ personal data
- to share contact details and financial history (such as outstanding fees) with your child’s past, current, or future schools;
- to report to and liaise with you about your child’s progress, welfare and development;
- to organise and manage meetings, events and social events;
- to maintain relationships with the school community, including by using direct marketing;
- for the purposes of donor and potential donor due diligence (wealth screening).
Appendix D
Third parties that we may share your personal data with
From time to time, we may need to share personal information relating to you with third parties. These include sharing personal data with the following:
Pupils’ and parents’ personal data
- third parties involved in the delivery of your/your child’s education, including visiting music teachers, external sports coaches and those delivering the French and English curriculum programme;
- organisations involved in educational visits;
- online learning platform providers;
- exam boards and the Joint Council for Qualifications;
- local safeguarding teams and/or social services;
- appropriate contractors and professional advisers, for example lawyers, insurers, accountants and consultants;
- Stage 3 complaints panels, which will include independent panel members;
- third parties and their advisers in the event of a possible or actual merger or other restructuring of Pembroke Education, or individual schools;
- Government authorities, for example the local authority, the Department for Education (including National Pupil Database), the Learning Records Service, Information Commissioner’s Office, Charity Commission, Independent Schools Inspectorate and UKVI; and
- when Pembroke Education is legally required to do so by a Court Order, Government body, Law enforcement agency or other authority of competent jurisdiction, for example, HM Revenue and Customs, the Home Office or the Police.
Pupils’ personal data
- your parents or education guardian, to enable continued support for your schooling.
Parents’ personal data
- third parties that provide services, for example Pembroke Education’s bursary application platform provider and wealth screening service provider(s);
- third parties that provide services to parents, but which need us to verify parents’ connection to the School; and
- other schools when your child is joining or leaving the School
Introduction
This notice is to help you understand how and why we collect personal information about you and what we do with that information. It also explains the decisions that you can make about your own information.
If you have any questions about this notice please contact the Bursar.
What is personal information?
Personal information is information that identifies you as an individual and relates to you.
This includes your contact details, next of kin and financial information. We may also hold information such as your religion or ethnic group. CCTV, photos and video recordings of you are also personal information.
How and why does the School collect and use personal information?
We set out below examples of the different ways in which we use personal information and where this personal information comes from. The School's primary reason for using your personal information is to provide educational services to your child.
- We obtain information about you from admissions forms and from your child's previous school. We may also get information from professionals such as doctors and from local authorities.
- We may have information about any family circumstances which might affect your child's welfare or happiness.
- We may need information about any court orders or criminal petitions which relate to you. This is so that we can safeguard the welfare and wellbeing of your child and the other pupils at the School.
- We use CCTV to make sure the school site is safe. CCTV is not used in private areas such as toilets.
- We may use your information when dealing with complaints and grievances made to the School. For example, if you make a complaint or if another parent complains about an issue which involves you.
- We may take photographs or videos of you at School events to use on social media and on the School website. This is to show prospective parents and pupils what we do here and to advertise the School. We may continue to use these photographs and videos after your child has left the School.
- We may send you information to keep you up to date with what is happening at the School. For example, by sending you information about events and activities taking place (including fundraising events) and the School newsletter.
- We may keep details of your address when your child leaves the School so we can find out how your child is progressing. We may also pass your details onto the alumni organisation which is called the Charltonians.
- We may use information about you if we need this for historical research purposes or for statistical purposes.
Financial information
- We will process financial information about you in relation to the payment of fees. In some cases we get information about you from third parties such as credit reference agencies or from your child's previous school(s).
- We may hold information about bankruptcy petitions and statutory demands.
- We may search the files of any licensed credit reference agency in order to verify your identity. This also allows us to assess your application for the award of a bursary or for credit in contemplation of an agreement for the deferment of fees.
- The credit reference agency will keep a record of that search and details about your application. This record will be seen by other organisations which make searches about you.
- Failure to supply information may result in a refusal of an award or credit.
Sharing personal information with third parties
- In accordance with our legal obligations, we may share information with local authorities, the Independent Schools Inspectorate, Ofsted and the Department for Education, for example, where we have any safeguarding concerns or to comply with our legal obligations.
- On occasion, we may need to share information with the police for the prevention and investigation of crime and the prosecution of offenders. We will only do this in specific circumstances to assist the police with their investigations.
- We may also need to share information with our legal advisers for the purpose of obtaining legal advice.
- Occasionally we may use consultants, experts and other advisors to assist the School in fulfilling its obligations and to help run the School properly. We might need to share your information with them if this is relevant to their work.
- If your child is not of British nationality we have to make sure that your child has the right to study in the UK. We might have to provide information about you to UK Visas and Immigration to comply with our duties as a Tier 4 sponsor.
- We may share some information with our insurance company, for example, where there is a serious incident at the School.
- If you have unpaid fees while your child is at the School we may share information about this with other schools or educational establishments to which you intend to send your child.
- If your child leaves us to attend another school we may need to provide that school with information about you. For example, details of family circumstances for safeguarding reasons.
- We may share information about you with others in your family, such as another parent or step-parent. For example, where this is part of our obligation to take care of your child, as part of our wider legal and regulatory obligations, or in connection with school fees.
- The School is a registered charity which means that in exceptional circumstances we may need to share your information with the Charity Commission e.g. in the event of a serious incident.
- We may need to share information if there is an emergency, for example, if you are hurt whilst on School premises.
- We sometimes use contractors to handle personal information on our behalf. The following are examples:
• IT consultants who might access information about you when checking the security of our IT network; and
• we use third party "cloud computing" services to store some information rather than the information being stored on hard drives located on the School site.
Our legal grounds for using your information
This section contains information about the legal basis that we are relying on when handling your information as described above.
Legitimate interests This means that the School is using your information when this is necessary for the School's legitimate interests except when this would be unfair to you. The School relies on legitimate interests for many of the ways in which it uses your information. Specifically, the School has a legitimate interest in:
In addition your personal information may be processed for the legitimate interests of others. For example another school will have a legitimate interest in knowing if you have not paid School fees that are due to us. If you object to us using your information where we are relying on our legitimate interests as explained above please speak to the Bursar. Necessary for a contract We will need to use your information in order to perform our obligations under our contract with you. For example, we need your name and contact details so that we can update you on your child's progress and so that we can contact you if there is a concern. Legal obligation Where the School needs to use your information in order to comply with a legal obligation, for example to report a concern to Children's Services. We may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so. Vital interests In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt). Public interest Another ground that the School relies on to use your information is that it is necessary in the public interest. For example, to provide your child with an education, to look after your child and their classmates or when the School is inspected. |
The School must also comply with an additional condition where it processes special categories of personal information. These special categories are as follows: personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation.
Substantial public interest The School is also allowed to use special categories of personal information where doing so is necessary in the substantial public interest. This is similar to "public interest" in the table above, for example the School may use special categories of information about you to provide your child with an education, to look after your child and their classmates or when the School is inspected. Employment and social protection law There may be times when the School needs to use your information because we are an employer. Also the School may use your information to comply with social protection law (e.g. to look after your child) and social security laws (e.g. to provide your child with free school lunches if applicable). Vital interests: In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt). Legal claims: We are allowed to use your information if this is necessary in relation to legal claims. For example, this allows us to share information with our legal advisors and insurers. Medical purposes This includes medical treatment and the management of healthcare services. |
We may ask for your consent to use your information in certain ways. If we ask for your consent to use your personal information you can take back this consent at any time. Any use of your information before you withdraw your consent remains valid. Please contact to the Bursar if you would like to withdraw any consent given.
In some cases we will rely on more than one of the grounds above for a particular use of your information. For example, we may rely on legitimate interests and public interest grounds when using your information for safeguarding reasons.
Sending information to other countries
We may send your information to countries which do not have the same level of protection for personal information as there is in the UK. For example, we may:
• store your information on cloud computer storage based overseas]; or
• communicate with you by email when you are overseas (for example, when you are on holiday).
The European Commission has produced a list of countries which have adequate data protection rules. The list can be found here: http://ec.europa.eu/justice/da...
If the country that we are sending your information to is not on the list, or is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland), then it might not have the same level of protection for personal information as there is in the UK.
For how long do we keep your information?
We keep your information for as long as we need to in order to educate and look after your child. We will keep some information after your child has left the School, for example, so that we can find out what happened if you make a complaint.
In exceptional circumstances we may keep your information for a longer time than usual but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.
Details of our data and records retention policies can be obtained from the Bursar.
What decisions can you make about your information?
From May 2018 data protection legislation gives you a number of rights regarding your information. Some of these are new rights whilst others build on your existing rights. Your rights are as follows:
- if information is incorrect you can ask us to correct it;
- you can also ask what information we hold about you and be provided with a copy. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to;
- you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information;
- you can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer;
- our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy;
The Bursar can give you more information about your data protection rights.
Further information and guidance
The Bursar is the person responsible at our school for managing how we look after personal information and deciding how it is shared.
Like other organisations we need to keep your information safe, up to date, only use it for what we said we would, destroy it when we no longer need it and most importantly - treat the information we get fairly.
This notice is to explain how we use your personal information. The Bursar can answer any questions which you may have.
Please speak to the Bursar if:
- you object to us using your information for marketing purposes e.g. to send you information about school events. We will stop using your information for marketing purposes if you tell us not to; or
- you would like us to update the information we hold about you; or
- you would prefer that certain information is kept confidential.
If you fail to provide certain information when requested, we may not be able to perform our obligations under the contract we have entered into with you.
If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner's Office - ico.org.uk.