Parents Privacy Notice (Full Version)

Privacy Notice for Parents

how we use your information


This Notice is to help you understand how and why we collect personal information about you and what we do with it.  It also explains the decisions that you can make about your own information. If you have any questions about this Notice please see contact details in the last paragraph.

What is Personal Information?

Personal information is that which identifies you as an individual and relates to you. This includes your contact details, next of kin and financial information.  We may also need to hold information such as your religion or ethnic group.  CCTV, photos and video recordings of you are also personal information.

How and Why Does the College Collect and Use Personal Information?

This Notice supports other information we may provide about a particular use of Personal Data e.g. when collecting data via an online or paper form. It also applies in addition to our terms and conditions and policies.

Below are examples of different ways in which we use personal information and its source.  Our primary reason for using your personal information is to provide educational services to your child.

  • We obtain information about you from admissions forms and your child's previous school.  Sometimes when appropriate, we may obtain information from professionals such as doctors or local authorities.
  • We may have information about any family circumstances which might affect your child's welfare or happiness.
  • We may need information about any court orders which relate to you.  This is so that we can safeguard the welfare and wellbeing of your child and other pupils.
  • We use CCTV to make the campus safe. It is not used in private areas such as toilets. 
  • We may use your information in the unlikely circumstance you make a complaint about us e.g. if you make a complaint or if another parent complains about an issue which involves you.
  • We may take photographs or videos of you and pupils at events to use on social media, on our website, in printed or digital adverts (including social media adverts) or in other marketing communications.  This helps us show prospective parents and pupils what we provide and to promote the College.  We may seek specific consent before using a photograph or video recording of parents and pupils where we consider that the use is more privacy intrusive. We may continue to use these photographs and videos after your child has left the College.
  • We may send you information to keep you up-to-date with what is happening at the College.  For example, by sending you information about events and activities taking place (including fundraising events) and newsletters. 
  • We may keep details of your address when your child leaves us so we can find out how your child is progressing.  We may also pass your details onto the alumni organisation which is called the Old Stortfordian Society (OS).  Further information on the alumni association can be found on our website.
  • We may use information about you if we need it for historical research purposes or for statistical purposes.

Financial information

  • We need to process your financial information in relation fee payments.  In some cases we get information about you from third parties such as credit reference agencies or from your child's previous school(s).
  • We may receive and hold information about any bankruptcy petitions and statutory demands.
  • We may search the files of any licensed credit reference agency in order to verify your identity.  This also allows us to assess your application for the award of a bursary or for credit in contemplation of an agreement for the deferment of fees.   The credit reference agency will keep a record of that search and details about your application.  This record will be seen by other organisations which make searches about you.
  • Regretfully, failure to supply information may result in a refusal of an award or credit.
  • We may obtain information about you from publicly available sources such as Companies House and Zoopla to assess Bursary applications.

Sharing personal information with third parties

  • In accordance with our legal obligations, we may share information with local authorities, the Independent Schools Inspectorate and the Department for Education e.g. where we have a safeguarding concern or to comply with our legal obligations.
  • On occasion, we may need to share information with the police.
  • We may need to share information with our legal advisors for the purpose of obtaining legal advice.
  • Occasionally we may use consultants, experts and other advisors to assist us in fulfilling our obligations and to help run the College.  We might need to share your information with them if this is relevant to their work.
  • If your child is not of British nationality we have to make sure they have the right to study in the UK.  We might have to provide information about you to UK Visas and Immigration to comply with our duties as a Tier 4 sponsor.
  • We may need to share some information with our insurance company e.g. if there is a serious incident.
  • If you have unpaid fees while your child is with us we may share information about this with other schools or educational establishments to which you intend to send your child.
  • If your child leaves us to attend another school we may need to provide that school with information about you e.g. details of family circumstances for safeguarding reasons.
  • We may share information about you with others in your family, such as another parent or step-parent e.g. where this is part of our obligation to take care of your child, as part of our wider legal and regulatory obligations, or in connection with school fees.
  • We may need to share information if there is an emergency e.g. if you are hurt whilst on College premises.
  • We sometimes use contractors to handle personal information on our behalf: 
    • IT consultants who might access information about you when checking the security of our IT network.
    • We use third party "cloud computing" services to store some information rather than the information being stored on hard drives located on site.

Your Personal Data collected by us will mostly remain within the College and will be handled only by staff in accordance with access protocols (i.e. on a ‘need to know’ basis). Particular strict rules apply in the context of;

  • medical records accessed only by the College Medical Centre and our doctor; and
  • pastoral or safeguarding files.

A certain amount of any learning support data will need to be provided to staff more widely in the context of providing the care and education that the pupil needs.

Our Legal Grounds for Using Your Information

This section contains information about the legal basis that we are relying on when handling your information as described above. 

Legitimate interests

This means we are using your information when this is necessary for our legitimate interests except when this would be unfair to you.  The College relies on legitimate interests for many of the ways in which it uses your information. Specifically, the College has a legitimate interest in;

  • providing educational services to your child and to other children;
  • performing pupil selection;
  • safeguarding and promoting the welfare of your child (and other children);
  • providing and receiving information and references about past, current and prospective pupils and to provide references to potential employers of past pupils;
  • promoting the objects and interests of the College.  This includes fundraising and using photographs of you and your child at our school events in promotional materials.  It also includes making sure that we are able to enforce our rights e.g. so that we can contact you if unpaid school fees are due;
  • monitoring the appropriate use of College IT and communications systems;
  • facilitating the efficient operation of the College; and
  • ensuring that all our relevant legal obligations are complied with (for example in relation to inspections).

In addition, your personal information may be processed for the legitimate interests of others e.g. another school will have a legitimate interest in knowing if you have not paid our fees.

If you object to us using your information where we rely on our legitimate interests as explained please contact us.

Necessary for a contract

We will need to use your information in order to perform our obligations under our contract with you e.g. we need your name and contact details so that we can update you on your child's progress and so that we can contact you if there is a concern.

Legal obligation

Where we need to use your information in order to comply with our legal obligations e.g. report a concern to Children's Services.  We may have to disclose your information to third parties such as the courts, the local authority or police where legally obliged to do so.

Vital interests

In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt). 

Public interest

We also rely on the use of your information where it is necessary in the public interest e.g. to provide your child with an education, to look after your child and their classmates, or when the College is inspected. 

We must also comply with an additional condition where we process special categories of personal information.   These special categories are:  personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation. 

Substantial public interest

We are also allowed to use special categories of personal information where doing so is necessary in the substantial public interest.  This is similar to "public interest" in the table above e.g. we may use special categories of information about you to provide your child with an education, to look after your child and their classmates or when the College is inspected.

Employment and social protection law

There may be times when we need to use your information because we are an employer.  Also we may use your information to comply with social protection law (e.g. to look after your child) and social security laws e.g. to provide your child with free school lunches if applicable.

Vital interests

In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt).

Legal claims

We are allowed to use your information if it is necessary in relation to legal claims e.g. this allows us to share information with our legal advisors and insurers.

Medical and Learning purposes

This includes the management of medical and healthcare services.

We may ask for your consent to use your information in certain ways.  If we ask for your consent to use your personal information you can take back this consent at any time.  Any use of your information before you withdraw your consent remains valid. Please contact us if you would like to withdraw any consent given.

In some cases we will rely on more than one of the grounds above for a particular use of your information.  For example, we may rely on legitimate interests and public interest grounds when using your information for safeguarding reasons.

Sending information to other countries.

We may send your information to countries which do not have the same level of protection for personal information as the UK e.g. we may communicate with you by email when you are overseas (for example, when you are on holiday). 

The EU has produced a list of countries which have adequate data protection rules.  The list can be found at .

If the country that we are sending your information to is not on the list or is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland), then it might not have the same level of protection for personal information as the UK.  We will provide you with details about the safeguards which we have in place outside of this Privacy Notice. If you have any questions about the safeguards we have in place please contact the Assistant Bursar.

For how long do we keep your information?

We will keep your information for as long as we need to in order to educate and look after your child.  We will keep some information after your child has left the College, for example, so that we can find out what happened if you make a complaint.

In exceptional circumstances we may keep your information for a longer time than usual but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.

We are allowed to keep some information about you for a long time or even indefinitely if we need this for historical, research or statistical purposes e.g. if we consider the information might be useful if someone wanted to write a book about the College. The table below shows for how long we keep different types of your information. This table shows for how long we keep different types of information about your child.

Type of information

Normal retention period or the criteria used to determine the retention period

Accidental and medical treatment records:

Date of birth plus 25 years.

Attendance records

10 years from last entry and then 25 years from DOB.

Exam results

25 years from student leaving.

Student files e.g. reports, performance

25 years from date of birth.

Safeguarding issues


Educational Learning Needs records

Date of birth plus up to 35 years.

UK Visa records

25 years from date of birth.


25 years and then reviewed

What decisions can you make about your information?

From May 2018 data protection legislation gives you a number of rights.  Some of these are new whilst others build on your existing ones.  Your rights are as follows:

  • If information is incorrect you can ask us to correct it.
  • You can also ask what information we hold about you and be provided with a copy. We will also give you extra information, such as why we use this information, where it came from and what types of people we have sent it to.
  • You can ask us to delete the information that we hold about you in certain circumstances e.g. where we no longer need the information.
  • You can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer.
  • Our use of information about you may be restricted in some cases.  For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.

Like other organisations we need to keep your information safe, up-to-date, only use it for what we said we would, destroy it when we no longer need it and most importantly, treat the information we get fairly.

Further information and guidance

We can answer any questions which you may have. Please speak to us if;

  • you object to us using your information for fundraising purposes e.g. to send you information about a fundraising initiative.  We will stop using your information for fundraising purposes if you tell us not to;
  • you would like us to update the information we hold about you; or
  • you would prefer that certain information is kept confidential.

The Assistant Bursar is the Data Protection Lead at the College for managing how we look after personal information and can answer any questions which you may have about how we use your personal information. You can contact us here

If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner's Office.