Introduction
This notice is to help you understand how and why Orchard House School (the School, ‘we’) collect personal data about you and what we do with that information. It also explains the decisions that you can make about your information.
If you have any questions about this notice, please contact the Data Protection Lead.
What is “Personal Data”?
Personal data is information that is about you and from which you can be identified.
This includes your contact details, next of kin and financial information. CCTV images, photos and video recordings of you are also personal data.
Where We Get Your Personal Data From and Who We Share It With
We obtain your personal data from a number of different sources. We get a lot of information from you (eg, when you complete the application form). We also get information from other sources such as our teachers, your child, your child’s previous school, other members of your family, other pupils and their parents, as well as from people outside of the School such as the local authority.
We will also share information with these people and organisations where appropriate. For example, if you tell us about something that has happened at home, we will share this with your child’s teachers if relevant.
The sections below contain further information about where we get your personal data from and with whom it is shared.
The Purposes For Which We Use Your Information and the Lawful Bases
We use your information in order to:
- Carry out our obligations and enforce our rights under our contract with you;
- Teach your child and our other pupils;
- Look after your child and others such as other pupils;
- Enable the School to comply with its legal obligations, to assist the School regarding the management and operation of the School and to advance and protect the School’s interests, objects and reputation; and
- Fundraise, market and promote the School. For example, by using photographs in the School prospectus, on the School’s website or in social media.
Our lawful bases for using your personal data are as follows:
- Contract: We will need to use your information in order to perform our obligations under our contract with you and for you to perform your obligations as well. For example, we need your name and contact details so that we can update you on your child’s progress and so that we can contact you if there is a concern. We may also rely on this basis where you have asked us to do something before entering into a contract with us.
- Legitimate interests: This means that the School is using your personal data where this is necessary for the School’s legitimate interests or someone else’s legitimate interests. Specifically, the School has a legitimate interest in educating and looking after its pupils, complying with its agreement with you for your child to be at the School, making sure that we are able to enforce our rights against you, for example, so that we can contact you if unpaid school fees are due, investigating if something has gone wrong and protecting promoting and improving the School. This basis applies to all of the 5 purposes listed above.
- Public task: This allows the School to use personal data where doing so is necessary in order to perform a task in the public interest. This basis applies to purposes 2, 3 and 4 above. For example, we are performing a task in the public interest when we teach and look after your child.
- Legal obligation: The School might need to use your information in order to comply with a legal obligation, for example, to report a concern about your child’s wellbeing to Children’s Services or in relation to inspections. Occasionally we may have a legal obligation to share your personal data with third parties such as the courts, local authorities or the police. More detail of when we will do so is set out below.
- Vital interests: In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else. For example, to prevent someone from being seriously harmed.
The section below contains more information about our purposes for using your personal data and the lawful bases.
Our Purposes and Lawful Bases in More Detail
This section contains more detail about the purposes for which your personal data is used, the applicable lawful bases as well as further information about sources and recipients. It does not say anything different to what’s set out above but goes into a lot more detail.
| # | Purpose | Bases |
|---|---|---|
| 1 | The School’s primary reason for using your personal data is to provide educational and pastoral services to your child. | LICTPI |
| 2 | We will use information about you in order to process your application for your child’s admission to the School. We obtain information about you from the admissions forms and from your child’s previous schools. We also may get information from professionals such as doctors and local authorities. | LICTPI |
| 3 | We will have information about any family circumstances which might affect your child’s welfare or happiness. This is to help us provide appropriate care and support to your child. | LICTPI |
| 4 | We will need information about any court orders or criminal petitions which relate to you. This is so that we can safeguard the welfare and wellbeing of your child and the other pupils at the School. | LICTPI |
| 5 | We use CCTV to make sure the school site is safe. Images captured of you via CCTV will be your personal data. CCTV is not used in private areas such as toilets or changing rooms. | LICTPI |
| 6 | We will use your personal data to take other steps to make sure the school site and buildings are safe; for example, we keep a record of visitors to the school at any given time. | LIPILO |
| 7 | If there is a complaint or grievance made to the School that involves you, then we will use your information in connection with that complaint or grievance. | LIPI |
| 8 | The School may share information about you with the local authority for the purpose of the preparation, implementation and/or review of your child’s Statement of Special Educational Needs or Education, Health and Care Plan. | LIPILO |
| 9 | Where appropriate, the School will have information about your religious or other beliefs and practices. For example, if you do not eat certain foods. | LIPI |
| 10 | We may take photographs or videos of you at School events to use on social media and on the School website. This is to show prospective parents and pupils what we do here and to advertise the School. We may continue to use these photographs and videos after your child has left the School. | LI |
| 11 | We will send you information to keep you up to date with what is happening at the School or the wider group of school’s and companies to which the school belongs (the Dukes Education Group). For example, by sending you information about events and activities taking place across the school or the wider Dukes Education Group and the School newsletter. | LI |
| 12 | We will keep details of your address when your child leaves the School so we can find out how your child is progressing. | LI |
| 13 | Where required, appropriate or necessary, we will pass on your details to our parent companies and/or other education establishments who are members of the Dukes Education Group (see www.dukeseducation.com). | LI |
| 14 | We may use your information when ensuring network and information security, for example, our anti-virus software might scan files containing information about you. | LI |
| 15 | We also keep some information indefinitely for archiving purposes (this is known as “archiving in the public interest” under data protection law) and for historical research purposes. This includes the School’s legitimate interest in research; supporting long-term accountability; enabling the discovery and availability of the School and the wider school community’s identity, memory, culture and history; enabling the establishment and maintenance of rights and obligations and of precedent decisions; educational purposes; and commercial and non-commercial re-use. For example, we keep some old photographs so that we have a record of what the School was like in the past. Information held in our archive may be made publicly available, but this would only be done in compliance with data protection laws. | LIPI |
| 16 | We may use your information in connection with legal disputes. | LIPILO |
Financial Information
| # | Purpose | Bases |
|---|---|---|
| 17 | We will process financial information about you in relation to the payment of fees. In some cases we get information about you from third parties such as credit reference agencies or from your child’s previous school(s). | LICT |
| 18 | We will hold information about bankruptcy petitions and statutory demands, where relevant. | LICT |
| 19 | We may search the files of any licensed credit reference agency in order to verify your identity. This also allows us to assess your application for the award of a bursary or for credit in contemplation of an agreement for the deferment of fees. The credit reference agency will keep a record of that search and details about your application. This record will be seen by other organisations which make searches about you. | LICT |
| 20 | We may share your information with debt recovery suppliers if you do not pay any school fees owed to the School. | LICT |
| 21 | We will obtain information about you from publicly available sources, such as (by way of example only) Companies House, Experian (or other credit reference agencies) and Zoopla, to assess your ability to pay School fees. | LICT |
Failure to supply information may result in a refusal of an award or credit.
Sharing Personal Data With Others
| # | Purpose | Bases |
|---|---|---|
| 22 | In accordance with our legal obligations, we will share information with local authorities, the Independent Schools Inspectorate / Ofsted and the Department for Education, for example, where we have any safeguarding concerns or to comply with our legal obligations. These organisations may also provide information to us for these purposes. | LILOPI |
| 23 | On occasion, we may need to share your information with the police for the prevention and investigation of crime or the apprehension or prosecution of offenders. We will only do this in specific circumstances to assist the police with their investigations. | LICTLOPI |
| 24 | We may need to share information about you with the Health and Safety Executive (a government organisation) if there is a health and safety issue at the School. | LILOPI |
| 25 | In certain circumstances, we may also need to share information with our legal advisers for the purpose of obtaining legal advice. | LILOPI |
| 26 | Occasionally we may use consultants, experts and other advisors to assist the School in fulfilling its obligations and to help run the School properly (e.g. our accountants). We will share your information with them if this is relevant to their work. | LICTPI |
| 27 | If your child is not a British or Irish citizen, we have to make sure that your child has the right to study in the UK. Sometimes the government will ask us to provide information as part of our reporting requirements. In addition to this, we have a duty to provide information about you to UK Visas and Immigration to comply with our duties as a Child Student / Student sponsor under the Points Based Immigration System. | LICTLOPI |
| 28 | We may share some information with our insurance company to make sure that we have the insurance cover that we need or in connection with an actual or possible claim. | LIPI |
| 29 | If the School is dealing with a request for information, query, complaint or grievance (e.g. from another parent), we may need to share your information with other parties if it is relevant and appropriate to do so. For example, with the appropriate staff, pupil or parent involved and governors. | LIPI |
| 30 | If you have unpaid fees, we may share information about this with other schools or educational establishments to which you intend to send your child. | LI |
| 31 | If your child leaves us to attend another school, we may provide that school with information about you. For example, details of family circumstances if there have been any safeguarding incidents. | LILOPI |
| 32 | We may share information about you with others in your family, such as another parent or step-parent. For example, where this is part of our obligation to take care of your child, as part of our wider legal and regulatory obligations, or in connection with school fees. | LIPI |
| 33 | We may need to share information if there is an emergency, for example, if you are hurt whilst on School premises. | LIVI |
| 34 | We will share information about you with the other schools or companies in the Dukes Education Group. For example, financial information or details of family circumstances. | LIPI |
| 35 | If you have appointed an agent to act on your behalf, we may share information with them. For example, we may send letters to them so that they can pass these on to you. | LI |
| 36 | If you have appointed an educational guardian (and/or there are homestay arrangements) for your child, we may share information with them. For example, academic, medical and behavioural information regarding your child. | LI |
| 37 | We may send you information about the School before you accept a place for your child. For example, we may send you a copy of the school prospectus. | LI |
| 38 | If your child has a Statement of Special Educational Needs or an Education and Health Care Plan (EHCP), we will share information with and obtain information from the local authority about you. | LOPI |
| 39 | If ever in the future, we are considering restructuring or selling our business, we may share your information with the other parties involved and with the relevant professional advisors. Some of the records the School keeps and which contain your personal data may be used by the School (or by someone else such as the government) to check that the School has been a good school. | LIPI |
| 40 | The School must make sure that our computer systems are working well and are secure. This may involve information about your child, for example, our anti-virus software might scan files containing information about your child. | LI |
| 41 | We will share your personal data with Governors and the owners of the School if it concerns something that the School needs to tell them about for the purposes set out in this notice, including to enable them to exercise their functions and fulfil their duties as School Governors. For example, if there is a concern involving you or your child or something which affects the running of the School. | LIPI |
As you will see from the above, in some cases we will rely on more than one lawful basis above for a particular use of your information. In addition, we may move from one of the lawful bases listed above to another as circumstances change. For example, as a safeguarding matter becomes more serious, we may start to rely on legal obligation to share personal data with the local authority in addition to the other lawful bases which are noted for safeguarding purposes.
We use contractors to handle personal data on our behalf for the following purposes:
- IT consultants who might access information about you when checking the security of our IT network;
- we use software, apps and websites to help us with teaching, and to help us provide pastoral support to our pupils. For example, we use an app which allows pupils to access homework which has been set by their teachers; and
- we use third party “cloud computing” services to store some information rather than the information being stored on hard drives located on the School site.
If you have any questions about any of the above, please speak to the Data Protection Lead.
More Sensitive Types of Personal Data
The School has extra obligations in relation to some types of more sensitive personal data. This applies to the following categories of information: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation and information about criminal convictions or offences. When the School handles these types of information, it will usually be doing so because:
- It is in the substantial public interest to do so, for example, to assist the School comply with its safeguarding obligations.
- There will be times when the School needs to use your information because we are an employer (e.g. we employ teachers). Also, the School may use your information to comply with social protection law (e.g. to look after your child) and social security laws. Social protection law is concerned with preventing, managing, and overcoming situations that adversely affect people’s wellbeing.
- To protect the vital interests of any person where that person cannot give consent, for example, if they are seriously hurt and are unconscious.
- It is necessary for the establishment, exercise or defence of legal claims. For example, this allows us to share information with our legal advisors and insurers.
Consent
We may ask for your consent to use your information in certain ways as an alternative to relying on any of the bases above. For example, we may ask for your consent before taking or using some photographs and videos if the photograph or video is more intrusive and we cannot rely on legitimate interests. If we ask for your consent to use your personal data, you can take back this consent at any time.
Any use of your information before you withdraw your consent remains valid. You can speak to the Data Protection Lead if you would like to withdraw any consent given.
Sending Information to Other Countries
When the School sends personal data outside of the UK, we have to consider if the other country has the same level of protection for personal data as there is in the UK. Some countries are considered by the UK Government to have adequate rules, including all of the European Economic Area and some other countries, such as New Zealand, Argentina and Japan.
In certain circumstances, we may send your information to countries which do not have the same level of protection for personal data as there is in the UK. For example, we may:
- store your information on cloud computer storage based in the USA.
If requested, we will provide you with details about where we are sending your personal data, whether the country has an adequacy decision, and, if not, the safeguards which we have in place outside of this privacy notice.
If you have any questions about the safeguards that are in place please contact the Data Protection Lead.
For How Long Do We Keep Your Information?
We keep your information for as long as we need to in order to educate and look after your child. We will keep a lot of information after your child has left the School, for example, so that we can find out what happened if you make a complaint.
In some cases we may keep your information for a longer time than usual but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.
Please see our Information and Records Retention Policy for more detailed information. This can be found on our website.
What Decisions Can You Make About Your Information?
Data protection legislation gives you a number of rights regarding your information. Your rights are as follows:
- Correction: if information the School holds about you is incorrect, you can ask us to correct it.
- Access: you can also ask what information we hold about you and be provided with a copy. This is commonly known as making a subject access request. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.
- Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.
- Portability: you can request the transfer of your information to you or to a third party in a format that can be read by computer. This applies where (a) the information has been provided by you; (b) the basis that we are relying on to process your information is consent or contract (please see “Our lawful bases for using your information” above); and (c) the information is being processed by us on computer.
- Restriction: you can request that we restrict how we use your personal data.
- Object: you may object to us using your information where:
- we are using it for direct marketing purposes;
- the lawful basis on which we are relying is either legitimate interests or performance of a task carried out in the public interest. Please see the section “Our lawful bases for using your information” above; and
- if we ever use your information for scientific or historical research purposes or statistical purposes.
Further Information and Guidance
The Data Protection Lead is the person responsible at our school for managing how we look after personal data and deciding how it is shared.
Like other organisations we need to keep your information safe, up to date, only use it for what we said we would, destroy it when we no longer need it and most importantly – treat the information we get fairly.
This privacy notice does not, and is not intended to, give you any rights which you did not already have. For example, it does not give you any additional contractual rights.
Please speak to the Data Protection Lead if:
- you object to us using your information for marketing purposes, e.g. to send you information about school events. We will stop using your information for marketing purposes if you tell us not to; or
- you would like us to update the information we hold about you; or
- you would prefer that certain information is kept confidential.
If you fail to provide certain information when requested, we may not be able to perform our obligations under the contract we have entered into with you. We may also be prevented from complying with our legal obligations (such as to ensure the welfare of your child and their classmates). Failing to provide information may also adversely affect the education and care we are able to provide to your child.
You have a right to lodge a complaint with a data protection supervisory authority. The supervisory authority in the UK is the Information Commissioner’s Office (ico.org.uk). If you do have any concerns about how we have handled your personal data, we would kindly ask that you contact us in the first instance before you speak to the ICO so that we have an opportunity to put things right.
