Privacy Notices

How we use your information

Introduction

This Notice is to help you understand how and why we collect personal information about you and what we do with it. It also explains the decisions that you can make about your own information. If you have any questions about this Notice please see contact details in the last paragraph.

What is Personal Information?

Personal information is that which identifies you as an individual and relates to you. This includes your contact details, next of kin and financial information. We may also need to hold information such as your religion or ethnic group.  CCTV, photos, and video recordings of you are also personal information.

How and Why Does the College Collect and Use Personal Information?

This Notice supports other information we may provide about a particular use of Personal Data e.g. when collecting data via an online or paper form. It also applies in addition to our terms and conditions and policies.

Below are examples of different ways in which we use personal information and its source. Our primary reason for using your personal information is to provide educational services to your child.

• We obtain information about you from admissions forms and your child’s previous school.  Sometimes when appropriate, we may obtain information from professionals such as doctors or local authorities.
• We may have information about any family circumstances which might affect your child’s welfare or happiness.
• We may need information about any court orders which relate to you. This is so that we can safeguard the welfare and wellbeing of your child and other pupils.
• We use CCTV to make the campus safe. It is not used in private areas such as toilets.
• We may use your information in the unlikely circumstance you make a complaint about us e.g. if you make a complaint or if another parent complains about an issue which involves you.
• We may take photographs or videos of you and pupils at events to use on social media, on our website, in printed or digital adverts (including social media adverts) or in other marketing communications. This helps us show prospective parents and pupils what we provide and to promote the College. We may seek specific consent before using a photograph or video recording of parents and pupils where we consider that the use is more privacy intrusive. We may continue to use these photographs and videos after your child has left the College.
• We may send you information to keep you up-to-date with what is happening at the College. For example, by sending you information about events and activities taking place (including fundraising events) and newsletters.
• We may keep details of your address when your child leaves us so we can find out how your child is progressing. We may also pass your details onto the alumni organisation which is called the Old Stortfordian Society (OS).  Further information on the alumni association can be found on our website.
• We may use information about you if we need it for historical research purposes or for statistical purposes.

Financial information

• We need to process your financial information in relation fee payments. In some cases we get information about you from third parties such as credit reference agencies or from your child’s previous school(s).
• We may receive and hold information about any bankruptcy petitions and statutory demands.
• We may search the files of any licensed credit reference agency in order to verify your identity.  This also allows us to assess your application for the award of a bursary or for credit in contemplation of an agreement for the deferment of fees. The credit reference agency will keep a record of that search and details about your application.  This record will be seen by other organisations which make searches about you.
• Regretfully, failure to supply information may result in a refusal of an award or credit.
• We may obtain information about you from publicly available sources such as Companies House and Zoopla to assess Bursary applications.

Sharing personal information with third parties

• In accordance with our legal obligations, we may share information with local authorities, the Independent Schools Inspectorate and the Department for Education e.g. where we have a safeguarding concern or to comply with our legal obligations.
• On occasion, we may need to share information with the police.
• We may need to share information with our legal advisors for the purpose of obtaining legal advice.
• Occasionally we may use consultants, experts and other advisors to assist us in fulfilling our obligations and to help run the College. We might need to share your information with them if this is relevant to their work.
• If your child is not of British nationality we have to make sure they have the right to study in the UK. We might have to provide information about you to UK Visas and Immigration to comply with our duties as a Tier 4 sponsor.
• We may need to share some information with our insurance company e.g. if there is a serious incident.
• If you have unpaid fees while your child is with us we may share information about this with other schools or educational establishments to which you intend to send your child.
• If your child leaves us to attend another school we may need to provide that school with information about you e.g. details of family circumstances for safeguarding reasons.
• We may share information about you with others in your family, such as another parent or step-parent e.g. where this is part of our obligation to take care of your child, as part of our wider legal and regulatory obligations, or in connection with school fees.
• We may need to share information if there is an emergency e.g. if you are hurt whilst on College premises.
• We sometimes use contractors to handle personal information on our behalf:
  • • IT consultants who might access information about you when checking the security of our IT network.
    • We use third party “cloud computing” services to store some information rather than the information being stored on hard drives located on site.

Your Personal Data collected by us will mostly remain within the College and will be handled only by staff in accordance with access protocols (i.e. on a ‘need to know’ basis). Particular strict rules apply in the context of;

• medical records accessed only by the College Medical Centre and our doctor; and
• pastoral or safeguarding files.

A certain amount of any learning support data will need to be provided to staff more widely in the context of providing the care and education that the pupil needs.

Our Legal Grounds for Using Your Information

This section contains information about the legal basis that we are relying on when handling your information as described above.

Legitimate interests

This means we are using your information when this is necessary for our legitimate interests except when this would be unfair to you.  The College relies on legitimate interests for many of the ways in which it uses your information. Specifically, the College has a legitimate interest in;

• providing educational services to your child and to other children;
• performing pupil selection;
• safeguarding and promoting the welfare of your child (and other children);
• providing and receiving information and references about past, current and prospective pupils and to provide references to potential employers of past pupils;
• promoting the objects and interests of the College. This includes fundraising and using photographs of you and your child at our school events in promotional materials. It also includes making sure that we are able to enforce our rights e.g. so that we can contact you if unpaid school fees are due;
• monitoring the appropriate use of College IT and communications systems;
• facilitating the efficient operation of the College; and
• ensuring that all our relevant legal obligations are complied with (for example in relation to inspections).

In addition, your personal information may be processed for the legitimate interests of others e.g. another school will have a legitimate interest in knowing if you have not paid our fees.

If you object to us using your information where we rely on our legitimate interests as explained please contact us.

Necessary for a contract

We will need to use your information in order to perform our obligations under our contract with you e.g. we need your name and contact details so that we can update you on your child’s progress and so that we can contact you if there is a concern.

Legal obligation

Where we need to use your information in order to comply with our legal obligations e.g. report a concern to Children’s Services. We may have to disclose your information to third parties such as the courts, the local authority or police where legally obliged to do so.

Vital interests

In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt).

Public interest

We also rely on the use of your information where it is necessary in the public interest e.g. to provide your child with an education, to look after your child and their classmates, or when the College is inspected.

We must also comply with an additional condition where we process special categories of personal information. These special categories are:  personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation.

Substantial public interest

We are also allowed to use special categories of personal information where doing so is necessary in the substantial public interest. This is similar to “public interest” in the table above e.g. we may use special categories of information about you to provide your child with an education, to look after your child and their classmates or when the College is inspected.

Employment and social protection law

There may be times when we need to use your information because we are an employer. Also we may use your information to comply with social protection law (e.g. to look after your child) and social security laws e.g. to provide your child with free school lunches if applicable.

Vital interests

In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt).

Legal claims

We are allowed to use your information if it is necessary in relation to legal claims e.g. this allows us to share information with our legal advisors and insurers.

Medical and Learning purposes

This includes the management of medical and healthcare services.

We may ask for your consent to use your information in certain ways. If we ask for your consent to use your personal information you can take back this consent at any time. Any use of your information before you withdraw your consent remains valid. Please contact us if you would like to withdraw any consent given.

In some cases we will rely on more than one of the grounds above for a particular use of your information.  For example, we may rely on legitimate interests and public interest grounds when using your information for safeguarding reasons.

Sending information to other countries.

We may send your information to countries which do not have the same level of protection for personal information as the UK e.g. we may communicate with you by email when you are overseas (for example, when you are on holiday).

The EU has produced a list of countries which have adequate data protection rules. Further information can be accessed at Data protection adequacy for non-EU countries.

If the country that we are sending your information to is not on the list or is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland), then it might not have the same level of protection for personal information as the UK.  We will provide you with details about the safeguards which we have in place outside of this Privacy Notice. If you have any questions about the safeguards we have in place please email the Data Manager.

For how long do we keep your information?

We will keep your information for as long as we need to in order to educate and look after your child.  We will keep some information after your child has left the College, for example, so that we can find out what happened if you make a complaint.

In exceptional circumstances we may keep your information for a longer time than usual but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.

We are allowed to keep some information about you for a long time or even indefinitely if we need this for historical, research or statistical purposes e.g. if we consider the information might be useful if someone wanted to write a book about the College. This list shows for how long we keep different types of information about your child.

• Accidental and medical treatment records – date of birth plus 25 years.
• Attendance records – 10 years from last entry and then 25 years from DOB.
• Exam results – 25 years from student leaving.
• Student files e.g. reports, performance – 25 years from date of birth.
• Safeguarding issues – Indefinitely.
• Educational Learning Needs records – Date of birth plus up to 35 years.
• UK Visa records – 25 years from date of birth.
• Complaints – 25 years and then reviewed.

What decisions can you make about your information?

From May 2018 data protection legislation gives you a number of rights. Some of these are new whilst others build on your existing ones. Your rights are as follows:

• If information is incorrect you can ask us to correct it.
• You can also ask what information we hold about you and be provided with a copy. We will also give you extra information, such as why we use this information, where it came from and what types of people we have sent it to.
• You can ask us to delete the information that we hold about you in certain circumstances e.g. where we no longer need the information.
• You can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer.
• Our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.

Like other organisations we need to keep your information safe, up-to-date, only use it for what we said we would, destroy it when we no longer need it and most importantly, treat the information we get fairly.

Further information and guidance

We can answer any questions which you may have. Please speak to us if;

• you object to us using your information for fundraising purposes e.g. to send you information about a fundraising initiative. We will stop using your information for fundraising purposes if you tell us not to;
• you would like us to update the information we hold about you; or
• you would prefer that certain information is kept confidential.

The Data Manager is the Data Protection Lead at the College for managing how we look after personal information and can answer any questions which you may have about how we use your personal information.

If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner’s Office.

How we use your child’s information

Introduction

This Notice is to help you understand how and why we collect your child’s personal information and what we do with it. Also explained are the decisions that you can make about your child’s information. We are giving you this Notice because you are able to exercise your child’s data protection rights on their behalf. When your child is older (usually when they reach the age of 13) they will be considered mature enough to exercise their own data protection rights.

If you have any questions about this Notice, please contact us.

What Is Personal Information?

Personal information is what identifies your child and is held by us. This includes information such as their date of birth and address as well as things like exam results, medical details and behaviour records. The College may also record your child’s religion, nationality or ethnic group. CCTV, photos and video recordings of your child are also personal information.

How and why does the College collect and use personal information?

Below are examples of the different ways in which we use personal information and where this comes from. Our primary reason for using your child’s information is to provide them with an education.

The admissions forms which you complete provide us with personal information. We also get information from your child, their teachers and other pupils. In the Prep and Senior School, your child’s old school also gives us information about them as we need this to teach and care for them. Likewise in the Pre-Prep, if we know of any nursery school your child is attending, we may ask them for a report.

• Sometimes we get information from your child’s doctor and other professionals where we need this to look after your child. We collect this information to:
• We need to tell appropriate members of staff if your child is allergic to something or has a health issue.
• We might tell your child’s teachers if he or she has educational learning needs or requires extra help with some tasks.
• We may need to share information about your child’s health and wellbeing with the College Medical Centre or counsellor.
• We use CCTV to make sure the College is safe. CCTV is not used in private areas such as changing rooms.
• We record your child’s attendance and if they have time away from the College we record the reason(s) why.
• We may need to report some of your child’s information to the government (e.g. the Department for Education). For example, we may need to tell the local authority that your child attends the College or let them know if we have any concerns about your child’s welfare.
• When we are inspected by the Independent Schools Inspectorate we may have to share your child’s information with them to assist with the inspection.
• If the College receives a complaint or grievance which involves your child we may need to use their information to deal with this appropriately e.g. if you make a complaint or if another parent complains about an issue which involves your child.
• We may need information about any court orders or criminal petitions which relate to your child. This is so that we can safeguard your child’s welfare and the wellbeing of other pupils.
• If your child is from another country we have to make sure that they have the right to study in the UK. We might have to provide their information to UK Visas and Immigration.
• Depending on where your child will go when they leave us, we may need to provide their information to other schools and colleges e.g. we may share information about their exam results and provide references. We may need to pass on information which they need to look after your child.
• We may need to share information with the police or our legal advisors if something goes wrong or to help with an inquiry e.g. if one of your child’s classmates is injured at the College or if there is a burglary.
• Occasionally we may use consultants, experts and other advisors to assist the College in fulfilling its obligations and to help run the College properly. We might need to share your child’s information with them if this is relevant to their work.
• If your child has misbehaved in a serious way, and the police have become involved, we may need to use information about the action taken by the police.
• We may share some information with our insurance company to make sure that we have the insurance cover that we need.
• We may share your child’s academic and (where fair) their behaviour records with you or their education guardian so you can support their schooling.
• We will only share your child’s information with other people and organisations when we have a good reason to do so. In exceptional circumstances we may need to share it more widely than we would normally.
• We will monitor your child’s use of email, the Internet and mobile electronic devices e.g. iPads. This is to check that your child is not misbehaving when using this technology or putting themselves at risk of harm. If you would like more information about this you can read the Acceptable Use of IT and Email Policy.
• We may take photographs or videos of your child at events to use on social media, on our website, in printed or digital adverts (including social media adverts) or in other marketing communications. This helps us show prospective parents and pupils what we provide and to promote the College. We may seek specific consent before using a photograph or video recording of parents and pupils where we consider that the use is more privacy intrusive. We may continue to use these photographs and videos after your child has left the College.
• Sometimes we use photographs and videos for teaching purposes, for example, to record a drama lesson.
• If you have any concerns about us using photographs or videos of your child, please speak to staff in your child’s School Office.
• We publish sports fixtures and other news on the website and put articles and photographs in the local news to tell people about what we have been doing.
• We may keep details of your child’s address when they leave so we can send them Old Stortfordian News and find out how they are getting on. Further information on the alumni association can be found on the College website.
• We sometimes use contractors to handle personal information on our behalf. The following are examples:
  • • IT consultants who might access information about your child when checking the security of our IT network.
    • We use third party “cloud computing” services to store some information rather than the information being stored on hard drives located on the College site.
      If you have any concerns about any of the above, please ask us.

Our legal grounds for using your information

This section contains information about the legal basis that we are relying on when handling your child’s information as described above.

Legitimate interests

This means that we are using your child’s information when this is necessary for our legitimate interests except where the processing is unfair to your child. We rely on legitimate interests for many of the ways in which it uses your child’s information. Specifically, the College has a legitimate interest in:

• Providing your child (and other children) with an education.
• Safeguarding and promoting your child’s welfare and the welfare of other children.
• Promoting the objects and interests of the College. This includes fundraising e.g. if we want to raise money to build new buildings and using photographs of your child in promotional material such as on our website and in the prospectus.
• Facilitating the efficient operation of the College.
• Helping the College comply with its obligations (for example, when it is inspected). Additionally, your child’s personal information may be processed for the legitimate interests of others e.g. we may use information about your child when investigating a complaint made by another pupil.

If you object to us using your child’s information where we are relying on our legitimate interests as explained above please speak to us.

Legal Obligation

Where we need to use your child’s information in order to comply with a legal obligation e.g. to report a concern about their wellbeing to Children’s Services. We may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so.

Vital Interests

In limited circumstances we may use your child’s information to protect their vital interests or the vital interests of someone else (e.g. if your child or they are seriously hurt).

Performance of a task carried out in the public interest

The following are examples of when we use your information to perform tasks in the public interest:

• Providing your child with an education.
• Safeguarding and promoting your child’s welfare and those of other children.
• Facilitating the efficient operation of the College.
• Ensuring that we comply with all of our legal obligations. If you object to us using your information when we are relying on this ground, please speak to us.

The College must also comply with an additional condition where it processes special categories of personal information. These special categories include; personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic information, biometric information, health information, and information about sex life or orientation.

Substantial public interest

We are allowed to use special categories of personal information where doing so is necessary in the substantial public interest. This is similar to “public interest” above e.g. we may use special categories of information about your child to provide them with an education, to look after them and their classmates or when the College is inspected.

Employment and social protection law

There may be times when we need to use your child’s information because we are an employer. Also the College may use their information to comply with social protection law (e.g. to look after your child).

Legal claims

The processing is necessary for the establishment, exercise or defence of legal claims. This allows us to share information with our legal advisors and insurers.

Medical purposes

This includes medical treatment and the management of healthcare services.

We may ask for your consent to use your child’s information in certain ways. If we ask for your consent to use your child’s personal information you can take it back at any time. Any use of your child’s information before you withdraw your consent remains valid. Please speak to us if you would like to withdraw any consent given.

In some cases we will rely on more than one of the grounds above for a particular use of your child’s information e.g. we may rely on legitimate interests and public interest grounds when using your child’s information for safeguarding purposes.

Sending information to other countries

We may send your child’s information to countries which do not have the same level of protection for personal information as in the UK. For example, we may;

• store your child’s information on cloud computer storage based overseas; or
• communicate with you about your child by email when you are overseas (for example, when you are on holiday).

The EU has produced a list of countries which have adequate data protection rules. The list can be found here.

If the country that we are sending your child’s information to is not on the list, or is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland), then it might not have the same level of protection for personal information as the UK.

We will provide you with details about the safeguards which we have in place outside of this Privacy Notice. If you have any questions about the safeguards that are in place please ask us.

For how long do we keep your child’s information?

We keep your child’s information for as long as we need to in order to educate and look after them. We will keep certain information after your child has left the College e.g. so that we can find out what happened if you make a complaint.

In exceptional circumstances we may keep your child’s information for a longer time than usual, but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.

We can keep information about your child for a long time or even indefinitely if we need this for historical, research or statistical purposes e.g. if we consider the information might be useful if someone wanted to write a book about the College. This list shows for how long we keep different types of information about your child.

• Accidental and medical treatment records – Date of birth plus 25 years.
• Attendance records – 10 years from last entry and then 25 years from date of birth.
• Exam results – 25 years from pupil leaving.
• Student files e.g. reports, performance – 25 years from date of birth.
• Safeguarding issues – Indefinitely.
• Educational Learning Needs records – Date of birth plus up to 35 years.
• UK Visa records – 25 years from date of birth.
• Complaints – 25 years and then reviewed.

What decisions can you make about your child’s information?

From May 2018 you will be able to make various decisions about your child’s information. Some of these are new whilst others build on existing rights. Your child’s rights are as follows:

• If information is incorrect you can ask us to correct it.
• You can also ask what information we hold about your child and be provided with a copy. We will also give you extra information, such as why we use this information about your child, where it came from and what types of people we have sent it to.
• You can ask us to delete the information that we hold in certain circumstances e.g. where we no longer need the information.
• You can ask us to send you, or another organisation, certain types of information about your child in a format that can be read by computer.
• Our use of information about your child may be restricted in some cases. For example, if you tell us that the information is inaccurate, we can only use it for limited purposes while we check its accuracy.

This Notice is to explain how we look after your child’s personal information.

Further information and guidance

Please speak to us if;

• you object to us using your child’s information for marketing purposes e.g. to send your child information about school events. We will stop using their information for marketing purposes if you tell us not to;
• you would like us to update the information we hold about your child; or
• you would prefer that certain information is kept confidential.

The Data Manager is the Data Protection Lead at the College for managing how we look after personal information and can answer any questions which you may have about how we use your personal information.

If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner’s Office – ico.org.uk.

How we use your information

Introduction

This Notice helps you understand how and why we collect your personal information and what we do with it. It also explains the decisions you can make about your own information. We are giving you this Notice because you are mature enough to make decisions about your personal information. If you have any questions about this, please ask your tutor to arrange a meeting with the Data Manager.

What is “Personal Information”?

Personal information is that which identifies you as an individual. We hold information about you which includes information such as your name, date of birth and address as well as things like exam results, any medical details and your unique pupil number. We may also record your religion or ethnic group.  CCTV, photos and video recordings of you are also personal information as well as vehicle details for those authorised to use our car parks.

How and Why do we Collect and Use Personal Information?

Our main reason for using your personal information is to provide you with an education. Below are examples of the different ways in which we use it and where it comes from.

• Admissions forms give us lots of personal information. We also get information from you, your parents, your teachers and sometimes other pupils. Your old school also gave us information about you so that we can teach and care for you.
• Where needed, we sometimes we get information from your doctors and other professionals so we can look after you.

We collect this information to help the College run properly, safely and to let others know what we do here. Here are some examples:

• We need to tell the appropriate teachers if you are allergic to something or have a health issue.
• We might need to tell your teachers if you have learning needs or need extra help with some tasks.
• We may need to share information about your health and wellbeing with the Medical Centre, College Doctor or counsellor.
• We use CCTV to make sure the College is safe. We do not use CCTV in private areas such as changing rooms.
• We record your attendance and if you have time away from the College, we record the reason(s) why.
• We may need to give some of your information to the Government (e.g. the Department for Education).  Another example could be that we may need to tell the local authority that you attend the College or let them know if we have any concerns about your welfare.
• We are legally required to provide the Department for Education with certain information about you and your classmates.
• We may need information about any legal matter which relates to you. This is so we can safeguard your welfare and wellbeing and the other pupils at the College.
• If you are from another country we have to make sure you have the right to study in the UK.  We might have to provide information to UK Visas and Immigration who are part of the Government.
• Depending on where you go when you leave us, we may need to provide your information to other schools, colleges and universities or potential employers e.g. we may share information about your exam results and provide references.  We may need to pass on information which they need to look after you.
• When you take public examinations (e.g. GCSEs) we will need to share information about you with examination boards. For example, if you require extra time in your exams.
• We are sometimes inspected to make sure that we are doing everything that we should to be a good College. We may have to share your information with the inspectors to help them to carry out their job.
• If someone makes a complaint about how the College has behaved we may need to use your information to deal with this appropriately e.g. if your parents complain that we have not looked after you properly.
• We may need to share information with the police or our legal advisors if something goes wrong or to help with an inquiry e.g. if one of your classmates is injured at the College or if there is a burglary.
• Occasionally we may use consultants, experts and other advisors to assist us in fulfilling our obligations and to help us run the College properly. We might need to share your information with them if this is relevant to their work.
• If you have misbehaved in a serious way and the police have become involved, we may need to use information about the action taken by them.
• We may share some information with our insurance company to make sure we have the insurance cover that we need.
• We may share your academic and (where fair) your behaviour records with your parents or education guardian so they can support your schooling.
• We will only share your information with other people and organisations when we have a good reason to do so.  In exceptional circumstances, we may need to share it more widely than we would normally.
• We will monitor your use of email, the Internet and mobile electronic devices. This monitoring is sometimes carried out using computer software.  In certain circumstances we may look at the content of your communications (e.g. emails and text messages). We monitor and look at your use of technology to check that you and your classmates are not misbehaving, at risk of harm or for other good reasons. More information about this is in the Acceptable Use of IT Policy.
• We may take photographs or videos of you at events to use on social media, on our website, in printed or digital adverts (including social media adverts) or in other marketing communications. This helps us show prospective parents and pupils what we provide and to promote the College. We may seek specific consent before using a photograph or video recording of parents and pupils, where we consider that the use is more privacy intrusive. We may continue to use these photographs and videos after you have left.
• Sometimes we use photographs and videos for teaching purposes, for example, to record a drama lesson.
• We publish our public examination results, sports fixtures and other news on the website and put articles and photographs in the local news to tell people about what we have been doing. If you have concerns about us using photographs or videos of you, please ask your tutor to arrange a meeting with the Data Manager.

• We may keep details of your address when you leave so we can send you OS News (the Old Stortfordian alumni) and find out how you are getting on. Further information on the OS can be found on the College website.
• We sometimes use contractors to handle personal information on our behalf for example:
  • • • IT consultants who might access information about you when checking the security of our IT network.
      • We do use third party “cloud computing” services to store some information rather than the information being stored on hard drives located on the College site.

The majority of your Personal Data collected by us will mostly remain within the College and in all cases it will be handled only by people who need to know the information. Again, if you have any concerns about any of the above, just ask us.

Our Legal Grounds for Using Your Information

This section contains legal and technical information about the legal grounds we are relying on when handling your information as described above.

Our legitimate interests

This means that we are using your information when this is necessary for our legitimate interests except when this would be unfair to you.  We rely on this ground for many of the ways in which it uses your information.

Specifically, the College has a legitimate interest in;

• providing you with an education;
• looking after you and your classmates;
• providing references for you;
• telling people about the College and what we do e.g. we may use photographs of you in our prospectus, on our website or in our social media;
• monitoring the proper use of our IT and communications systems; and
• improving the College e.g. if we want to raise money to build new buildings or to make sure that we are providing you and your classmates with a good schooling experience.

Additionally, your personal information may be processed for the legitimate interests of others e.g. we may use information about you when investigating a complaint made by one of your fellow pupils. If you object to us using your information where we are relying on our legitimate interests as explained above, please let us know.

Our legal obligation

We might need to use your information in order to comply with a legal obligation e.g. to report a concern about your wellbeing to Children’s Services.  We may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so.

Your vital interests

In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt).

The public interest

The following are examples of when we use your information to perform tasks in the public interest:

• Providing you with an education.
• Safeguarding and promoting your welfare and the welfare of other children.
• Facilitating the efficient operation of the College.
• Ensuring that we comply with all of our legal obligations.

If you object to us using your information when we are relying on this ground please ask your tutor to arrange a meeting with the Data Manager.

We must also comply with an additional condition where we process special categories of personal information. These special categories include personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic information, biometric information, health information and information about sex life or orientation.

We believe there is a substantial public interest.

We are allowed to use special categories of personal information where we believe it is needed and there is a substantial public interest. This is similar to “public interest” in the table above e.g. we may use special categories of information about you to provide you with an education to look after you and your classmates or when the College is inspected.

Our responsibilities with employment and social protection law

There may be times when we need to use your information because we are an employer (e.g. we employ your teachers). Also, the College may use your information to comply with social protection law e.g. to look after you.

Your vital interests

In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt).

Legal claims

We are allowed to use your information if this is necessary in relation to legal claims. For example, this allows us to share information with our legal advisors and insurers.

Medical purposes

This includes medical treatment and the management of healthcare services and providing Learning Support.

We may ask for your consent to use your information in certain ways. If we ask for your consent to use your personal information, you can take it back at any time. Any use we have made of your information before you withdraw your consent will still remain valid.

There are some limited circumstances where your request to withdraw consent can’t always be accepted. For example, where we have to comply with legal obligations to keep certain data to give to official authorities e.g. Department for Education, County Council. Please let us know if you would like to withdraw any consent that you have given. In some cases we will rely on more than one of the grounds above for a particular use of your information e.g. we may rely on legitimate interests and public interest grounds when using your information to look after you and your classmates.

Sending information to other countries

We may send your information to countries which do not have the same level of protection for personal information as the UK.  For example, we may communicate with you by email when you are overseas (for example, when you are on holiday).

The EU has produced a list of countries which have adequate data protection rules. Further Information can be accessed here. If the country that we are sending your information to is not on the list or, is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland) then, it might not have the same level of protection for personal information as the UK.

We will provide you with details about the safeguards which we have in place outside of this Privacy Notice. If you have any questions about the safeguards that are in place please ask your tutor to arrange a meeting with the Data Manager.

For How Long do we Keep Your Information?

We keep your information for as long as we need to in order to educate and look after you. We will keep some information after you have left us e.g. so that we can find out what happened if you make a complaint.

In exceptional circumstances we may keep your information for a longer time than usual, but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.

We can keep information about you for a long time or even indefinitely if we need this for historical, research or statistical purposes.  For example, if we consider the information might be useful if someone wanted to write a book about the College. This list shows for how long we keep different types of information about you.

• Accidental and medical treatment records – Date of birth plus 25 years.
• Attendance records – 10 years from last entry and then 25 years from date of birth.
• Exam results – 25 years from pupil leaving.
• Pupil files e.g. reports, performance – 25 years from date of birth.
• Safeguarding issues – Indefinitely.
• Educational Learning Needs records – Date of birth plus up to 35 years.
• UK Visa records – 25 years from date of birth.
• Complaints – 25 years and then reviewed.

What decisions can you make about your information?

From May 2018 you will be able to make various decisions about your information. Some of these are new rights whilst others build on existing ones. Your rights are as follows:

• If information is incorrect you can ask us to correct it.
• You can also ask what information we hold about you and be provided with a copy. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.
• You can ask us to delete the information that we hold about you in certain circumstances.  For example, where we no longer need the information.
• You can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer.
• Our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.

Further information and guidance

This Notice is to explain how we look after your personal information. If you have any questions of concerns, just ask your tutor to arrange a meeting with the Data Manager. Alternatively, you can ask your parents to speak to us on your behalf if you prefer.

Please ask if you;

• object to us using your information for marketing purposes e.g. to send you information about school events. We will stop using your information for marketing purposes if you tell us not to;
• would like us to update the information we hold about you; or
• you would prefer that certain information is kept confidential.

If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner’s Office.

How we use your information

Introduction

This notice explains how and why our Development Office collects personal information about you for our fundraising and development activities. It also outlines what we do with your information and what decisions you can make about your information in relation to fundraising and development. If you have any questions about this, please contact the Development Director whose contact details are at the end of this notice.

Our relationship with our parents, alumni, friends and supporters is of great importance to the College, especially with regard to respecting their privacy and data security. As a Registered Charity No. 311057 we also value the philanthropy and generous support of those who support our academic mission.

This notice specifically relates to Personal Data processed by the Development Office as part of its objective to engage with the College community. It is the department of the College that has responsibility for alumni relations, fundraising and charitable giving. We consider the College has a strong and legitimate interest in maintaining relationships with parents, former parents, alumni, friends and supporters for the benefit of its fundraising and development activity and to help safeguard a sustainable future. We will always seek to balance communicating this important and positive work, with your own reasonable expectations being respectful of your personal privacy choices.

Development is the careful relationship building between the College and its supporters, with the long-term aim of securing financial support for its work. Development offers a range of communications and events to help facilitate the engagement process.

This notice also covers how the personal information of College alumni is used. The College controls all Personal Data of alumni as the Data Controller. Names of alumni may occasionally appear in the OS Newsletter and their contact details used for communications, provided their permission has been sought in advance. Personal Data is also shared with the Development Office in line with data protection regulations in accordance with the School’s Data Protection Policy.

Individuals can ask for all or part of their details not to be used, by contacting the Development Office. For more information about how the College uses your information more widely (for example, in relation to the provision of education to pupils), please ask the Data Protection Lead for a copy of the appropriate Privacy Notice. Their contact details are

What personal information does the College hold about you and how is this obtained?

Personal information is that which identifies you as an individual and specifically relates to you. This includes your contact details, your relationship with the College and financial information.

The College receives information about you from other teams within the College but only where this is relevant to our work. The Development Office holds a specific database with information about alumni, parents, staff, former parents, former staff, and other supporters.

You provide us with information about yourself during the course of our relationship with you e.g. when you fill in a survey or sign up to attend an event.

All personal data is held and processed in accordance with the General Data Protection Regulation, the Data Protection Act, our Data Protection Policy and other relevant legislation. Our staff receive data protection training, and all data is held securely within our Customer Relationship Management system.

We will hold information such as:

• the dates when you or your child attended the College (if applicable).
• if you are a former staff member the dates when you worked with us.
• your contact details.
• information about your achievements and interests e.g. the sports teams you were part of as a pupil.
• where you attended university and your occupation (if applicable).
• career details
• records of meetings we hold with you
• events attended
• your communications preferences based on information you provide to us
• records of any donations both monetary and in kind (including use of premises and sponsorships).
• your relationships with other alumni or supporters of the College.
• memberships such as the 1868 Society.
• copies of acknowledgements of gifts, events etc.
• copies of correspondence with the Development Office.
• your interests and extra-curricular activities provided for the Old Stortfordian magazine or digital newsletter and from conversations and press coverage.
• your Gift Aid status if applicable.
• information from articles in the media.
• any dietary requirements for catering purposes that you have provided.
• any disability you may have so that we may make reasonable adjustments for you.

On occasion, we augment the data we hold from publicly available data. We use targeted internet searches and we may search the following websites (either directly or by using search engines) in order to maintain the accuracy of the data listed above.

Public sources for companies (in order to find personal data of those companies’ employees, etc):

• Companies House and other business-related resources for UK companies
• Company websites
• US Securities and Exchange Commission for US companies
• Charity Commission and other internet sources for UK non-profits

Public sources for individuals:

• Sunday Times Rich List
• Other Rich lists eg Forbes Magazine’s international rich lists
• The King’s Honours Lists
• LinkedIn, to check business details
• US White Pages
• LinkedIn
• Zoopla
• Twitter
• Facebook

Why do we use your personal information?

We use your information in the following ways to support engagement and fundraising:

• Keep you informed of events and activities.
• Help communications between the College and alumni, through an online portal.
• Keep you informed about what is happening at the College e.g. sending you a copy of College magazines.
• Sending appeals and requests for donations.
• Promotion of the 1868 Society.
• Conducting surveys following events and publications.
• Suggest other ways you might wish to support the College (such as when you volunteer).
• Sometimes contact alumni to find out how their careers are progressing so we can refine our careers and university advice to pupils.
• Research ahead of face to face meetings.
• Managing personal preference, feedback and complaints.
• Administrative purposes (eg processing event attendance requests or donations).

We will contact you for the above purposes by email, telephone, post or by text message but we will only do this where we are allowed to do so under data protection law. If you tell us that you do not want to be contacted for any of these purposes, then we will respect that decision.

If you wish to make a donation, we may carry out financial due diligence on you using sources as described above, this is to comply with our legal obligations.

We may use photographs or videos of you in our publicity or on our social media platforms and website unless you would prefer us not to.

We will carry out a targeted fundraising activity to ensure we are contacting you with the most appropriate communication and will provide an improved experience for you. In doing so, we may use profiling techniques or use third party wealth screening companies such as Prospecting for Gold and insight companies to provide us with information about you.

Such information is compiled using publicly available data about you such as on Companies House, the Electoral Register, company websites, social networks such as LinkedIn, political and property registers and those already described. This assists us in understanding the financial means and background of those who could support us. It also helps us make appropriate requests to supporters who may have the means and who may want to give more. You can opt out of your data being used for profiling and wealth screening techniques by contacting the Development Office.

How and why does the College share your information with third parties?

• We have a website that collects credit card and direct debit gifts and a legacy system for historic direct debit gifts.
• If you attend a College event, we may share your information with event booking platforms.
• In accordance with our legal obligations, we will share information with local authorities, the Independent Schools Inspectorate, and the Department for Education.
• On occasion, we may need to share information with the police for the prevention and investigation of crime and the prosecution of offenders.
• We may also need to share information with our legal advisors for the purpose of obtaining legal advice.
• We will need to share information if there is an emergency, for example, if you are hurt whilst on College premises or at one of our events.
• We may use contractors to help us with our work (e.g. a company will be used to process Personal Data so that we can post hard copy communications) or where we store our database in the cloud.
• On occasion, we will work with our trusted third-parties to help with our fundraising efforts by telephone (such as Buffalo Fundraising Consultants) and by mail with our approved mailing houses.

How we protect your data

Our legal grounds for using your information

This section contains information about the legal basis that we rely upon when handling your information.

Legitimate interests

This means that we are using your information when this is necessary for our legitimate interests, except when your interests and fundamental rights override our legitimate interests. Specifically, we have a legitimate interest in:

• ensuring there are active supporters who will benefit the College, such as current and former pupils and parents.
• promoting our objects and interests. This includes fundraising e.g. if we want to raise money for new buildings.
• using your personal information to administer our events.
• safeguarding and promoting the welfare of our pupils with whom you may have contact; and
• ensuring that we comply with our legal obligations.

If you object to us using your information where we are relying on our legitimate interests as explained above, you can inform us. If we ask for your consent to use your personal information you can take back this consent at any time. Any use of your information before you withdraw your consent remains valid. You can withdraw your consent by contacting the Development Director.

Necessary for a contract

We will need to use your information in order to perform our obligations under a contract with you e.g. we may need your name and contact details to send you tickets for a concert that you are attending.

Legal obligation

Sometimes, we will need your information to comply with a legal obligation e.g. we may need to keep a record of who is attending an event so that we can comply with our health and safety obligations.

Vital interests

For example, to prevent someone from being seriously harmed.

The College must also comply with an additional condition where it processes special categories of personal information. These include personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation.

Our grounds for processing special personal information will depend on the circumstances.

To protect the vital interests of any person where that person cannot give consent, for example, if they are seriously hurt and are unconscious.

Legal claims

The processing is necessary for the establishment, exercise or defence of legal claims. This allows us to share information with our legal advisers and insurers.

These two conditions may also apply if we ever need to process information about criminal convictions and offences.

Sending your information to other countries

We may send your information to countries which do not have the same level of data protection as the UK e.g. we may:

• store your information on computer servers based overseas; or
• communicate with you when you are overseas (for example, when you are on holiday or if you live in a different country).

The EU has produced a list of countries which have adequate data protection rules. The list can be found here:

https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data- protection/adequacy-decisions_en

If the country that we are sending your information to is not on the list, or is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland), then in the absence of any other safeguards, it might not have the same level of protection for personal information as there is in the UK.

Where appropriate, we use additional safeguards e.g. if we are using a third party to process a payment then we may contact them to use a data sharing agreement. If you would like more information about this, please contact the Data Manager.

For how long do we keep your information?

We will keep your information for as long as we need, in compliance with our data protection and other legal obligations e.g. we will need to keep your contact details for as long as you want to be in communication with us.

We also need to keep a record if you tell us not to contact you anymore, so that we do not inadvertently add you to our mailing list. We will keep information about you for a long time or even indefinitely if we need this for historical or research purposes.

The College will also keep information for as needed to meet its wider legal and regulatory obligations, even if that information is no longer needed for marketing, development, or fundraising purposes. This is especially relevant to former staff, pupils and parents. Our Retention of Data & Erasure of Personal Information policy sets out how long we keep different types of information. For more information on how personal information is used by the College more widely, please contact the Data Manager.

What decisions can you make about your information?

Data protection legislation gives you several rights regarding your information. Some of these are new whilst others build on your existing rights. Your rights are as follows:

• Rectification: If information is incorrect, you can ask us to correct it.
• Access: You can also ask what information we hold about you and be provided with a copy. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.
• Deletion: You can ask us to delete the information that we hold about you in certain circumstances e.g. where we no longer need the information.
• Portability: You can request the transfer of your information to you or to a third party in a format that can be read by a computer in certain circumstances.
• Restriction: Our use of information about you may be restricted to simply storing it in some cases. For example, if you tell us that the information is inaccurate, we can only use it for limited purposes while we check its accuracy.
• Object: You may object to us using your information where:
  • we are using it for direct marketing purposes (e.g. sending you letters about fundraising opportunities);
  • we are relying on the legitimate interests’ legal ground to use it; or
  • we are using it for historical or scientific research purposes or archiving purposes. For example, we may keep photographs of your class for historical reasons.

The Data Manager can give you more information about your data protection rights.

Further information and guidance

The Development Director is the person responsible at our College for managing how we look after personal information in relation to fundraising and development.

Like other organisations, we need to keep your information safe, up-to-date, only use it for what we said we would, destroy it when we no longer need it and most importantly, treat the information we get fairly.

Please speak to the Development Director if:

• You object to us using your information for marketing purposes e.g. to send you information about fundraising; to use for profiling/wealth screening purposes. We will stop using your information for these purposes if you tell us not to; or
• You would like us to update the information we hold about you.

If you consider that we have not acted properly when using your personal information, you can contact the Information Commissioner’s Office – ico.org.uk.

Privacy online

Details of our online privacy and cookies policy can be found on https:/stortfordianfoundation.org

Contact details

Development Director for fundraising enquiries.

Data Manager for general enquiries.