Privacy

Twyford School Privacy Notice

Pupils, Parents, Alumni, Suppliers & Job Applicants
 

Introduction

This notice is provided by Twyford School and is intended to meet the requirement, under the UK General Data Protection Regulation (UK GDPR), to provide information on who we are, what personal data we collect and use, how and why we collect it, your rights in relation to your personal data and how to contact us and supervisory authorities in the event you have a complaint.  Personal data is information that identifies you as an individual and relates to you, for example, your contact details, financial information, exam results and photos and images captured by CCTV.

References in this notice to 'we', 'our', 'us' or 'The School' are to Twyford School.

This notice applies to

Current, past and prospective pupils.
Their parents, carers, or guardians (referred to in this policy as "parents").
Donors, and other supporters.
Visitors and other individuals connected to The School (including students enrolled on our holiday camps).
Suppliers and job applicants.

The personal data we collect, and the use we make of it, varies depending on our relationship with you.  For that reason, this privacy notice contains separate sections for different types of individuals.  Please be sure to read the sections of the privacy notice which relate to you.

Details of the Controller.

When we process your personal data (which includes any use we make of it such as collecting, storing and sharing it), we are regulated under UK data protection laws and we are responsible as ‘controller’ of that personal data for any processing undertaken by us, our staff or other organisations that process your personal data entirely on our instructions (known as processors).  Where we use processors, they are subject to specifical contractual obligations to keep your personal data secure and to process it only on our express instructions.

The School may be contacted by post at Twyford School, Twyford, Hampshire, SO211NW, by telephone on 01962 712269, and by email at  privacy@twyfordschool.com.

This notice applies in addition to any contract between you and The School and any other information The School may provide.

Legal Reasons for Processing

The School processes personal data to support the provision of education within its charitable objects.  This processing is lawful because, for each purpose, at least one of the following will apply.
 

You have consented to the processing for one or more specific purposes.

The processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract

The processing is necessary for compliance with a legal obligation to which The School is subject
The processing is necessary in order to protect your vital interests
The processing is necessary for the purposes of the legitimate interests pursued by The School and those interests are not outweighed by your privacy interests.  Our legitimate interests are reflected in the purposes of our processing listed below
The processing is necessary for the performance of a task carried out in the public interest.
Personal data we collect about you

The School processes a wide range of personal information which varies according to who you are.  This includes:

For Parents

Names, addresses, telephone numbers, e-mail addresses and other contact details for parents and next of kin
Information about members of your family, your family relationships and family circumstances;
Information about court orders or criminal matters which relate to you
Information relevant to any complaint made to The School which involves you
CCTV images of you taken on The School's premises
Photographs or videos of you taken at School events
Bank details and other financial information
Information verifying your identity

Information about your financial background.  Some of this information may come from third parties such as credit reference agencies or your child's previous schools or publicly available sources such as Companies House;
Other information provided by you on registration and admissions forms or by your child's previous schools or the local authority
Health information that you give us or that we receive from third parties such as the local authority or health professionals.
Car details including registration plate for security purposes.
Communications with you.

For Pupils

Name, contact details and date of birth
Biographical information including hobbies and interests, achievements, challenges, health and medical information and family circumstances
Pupil references given or received by The School about you and information provided by other educational establishments and/or other professionals or organisations working with you or the local authority;
Gender, ethnicity, religion, country of birth and languages spoken
Academic, pastoral and safeguarding information including your special educational needs
Information about disciplinary, admissions and attendance records
Assessment and exam results, scripts and marks
Information about you which is relevant to any complaint made to The School which involves you
Information about court orders or criminal matters which relate to you
Information relating to your use of electronic devices (including where appropriate their content)
Images (both photographic and content captured by The School’s CCTV system in accordance with School policy)
Communications with your parents and others about you.

For alumni, donors and supporters

Name and contact details including email address, telephone number, home address and employer/company name
Donation and support details
Tax status
Contact preferences for communications from us
Payment information
Biographical information
Information about your attendance at School events.

For visitors

Name and car details including registration plate for security purposes.

For suppliers

Name and contact details including email address, telephone number, address, employer/company name and your role
Billing, transaction and payment information
Information to enable us to check and verify your identity
Information to enable us to undertake credit or other financial checks on you
Your supplier history.
For job applicants
Your qualifications, employment history and other information contained in your curriculum vitae
References
Other personal data provided by you.

How The School collects personal data

Generally, The School will receive personal data from you directly (including, in the case of pupils, from their parents). This may be via a form, either written or electronic, or simply in the ordinary course of an interaction or communication (such as email or written assessments).

However, in some cases personal data may be supplied by third parties (for example, another school, other professionals or authorities working with that individual or the Disclosure and Barring Service) or collected from publicly available resources.

Why The School processes personal data.

The School processes your personal data primarily for the purposes of identifying, caring for, educating and recording the progress of its pupils, maintaining its contractual relationship with parents and suppliers and meeting our statutory obligations.  This includes processing for the following more specific purposes which also reflect the School's legitimate interests.

For Parents and Pupils

To administer the registration and admissions process for new pupils and to confirm the identity of prospective pupils and parents and retain a record if appropriate for the purposes of future applications or openings. This may include any necessary credit checks, whether with previous schools or other third-party sources.
To provide pupils with an education and monitor pupils' progress and educational needs
To maintain relationships with alumni and The School community, including direct marketing of fundraising activity
To inform of any change to our website, services or goods and products
For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as tax, diversity or gender pay gap analysis).
To enable the relevant authorities to monitor The School's performance and to intervene or assist with incidents as appropriate
To give and receive information and references about past, current and prospective pupils, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend; and to provide references to potential employers of past pupils
To enable pupils to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils of The School
To safeguard pupils' health and welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency or accident, including by disclosing details of an individual's medical condition where it is in the individual's interests to do so, for example for medical advice, insurance purposes or to organisers of School trips
To monitor (as appropriate) use of The School's IT (Information Technology) and communications systems in accordance with The School's IT Acceptable Use Policy
To make use of photographic images and video of pupils in School publications, on The Schools website and other communication channels
For security purposes, and for regulatory and legal purposes (for example Child Protection and Health & Safety) and to comply with our legal obligations
For regulatory record keeping / compliance purposes in respect of immigration requirements, as a visa sponsor.
To carry out or cooperate with any School or external complaints, or disciplinary or investigation processes.
To obtain appropriate professional advice and insurance for The School
To contact you regarding your child's education and events and activities
To ensure The School site is safe
To maintain relationships with alumni and The School community, including direct marketing or fundraising activity.
For alumni, donors and supporters
To keep you informed about The School
To administer events and other fundraising and marketing activities
For the purposes of donor due diligence and to confirm the identity of prospective donors and their background
To administer donations and support
To reclaim tax on donations (gift aid)
To carry out prospect research when seeking support for a specific fundraising campaign e.g.  transformational bursaries and capital projects.
To provide information relating to other products or services, subject to your consent, and inform of any change to our website, services or goods and products

For visitors

To ensure the School site is safe.

For suppliers

To enable us to communicate with you for business purposes
To ensure the School site is safe if you visit
To order, pay for and receive products and services from you or your employer

For job applicants

To assess your suitability for a job and to contract you in relation to that job.
Who do we share your personal data with
The third parties with whom we will or may share your personal information are:
Local authorities and the Department for Education in accordance with our legal obligations, for example regarding registration, attendance, safeguarding or educational and health needs
Law enforcement bodies for safeguarding purposes, the prevention and investigation of crime and the prosecution of offenders
Other emergency services and/or the Health and Safety Executive if there is an emergency or incident at The School
Suppliers of healthcare and social care
Professional advisers, insurers and suppliers including online educational platforms, IT consultants, third party cloud computing services and debt recovery agents

Central and local government as part of our reporting requirements including regarding a pupil's right to study in the UK
Appropriate regulatory bodies (e.g. the Teaching Regulation Agency, the Independent Schools Inspectorate, the Charity Commission or the Information Commissioner)
Former or prospective schools or educational establishments, for example, in relation to the offer of a place, exam results, academic and behavioural records, any safeguarding issues and references
Examination boards in relation to public examinations
Other family members, such as a parent or step-parent and, for overseas pupils whose parents live overseas, any appointed guardian or agent subject to their being entitled to such information.
We will only share personal information when we have a good reason to do so. 
On occasion the processing of personal data by The School may be achieved by using third-party data processors (such as the core management information system) or by sharing information with other data controllers (such as allergen data with caterers). Where third-party processing and/or data sharing is required, suitable agreements are in place.

Data retention

The School will retain data in line with its Retention of Records Policy. Further information is available on request.  We will keep information only for as long as is necessary for the purposes for which it is processed.

Staying connected and supporting The School

The School may use the contact details it has been given by parents, alumni and other members of The School community to keep them updated about the activities of The School, including by sending updates and newsletters by email and by post, and by making contact by telephone and on social media.

Unless the relevant individual objects and informs The School of this in writing, The School may also:

Share personal data about parents and/or alumni, as appropriate, with organisations set up to help establish and maintain relationships with The School community.
Contact parents and/or alumni (including via the organisations above) by post and e-mail and telephone in order to promote and raise funds for The School.

Collect information from publicly available sources about parents' and former pupils' occupations and activities, in order to maximise The School's fundraising potential. We do this carefully and do not use solely automated processing or profiling, in order to respect individuals’ rights under data protection law.
You can update your contact preferences via the link in emails from the Twyford Society, or on our Alumni website, or by emailing The school directly.

Your Rights

You have the following rights which you can exercise free of charge.  Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of our processing based on consent before its withdrawal.

Access – to obtain access to, and copies of, the personal data that we hold about you.
Rectification – to require us to correct the personal data we hold about you if it is incorrect
Erasure – to require us to erase your personal data in certain circumstances.
Restriction – to request that we restrict our data processing activities in certain circumstances.
Portability – to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller.

Object

At any time to your personal data being processed for direct marketing purposes
On grounds relating to your particular situation, to our  processing activities based on the public task and legitimate interest lawful.

Data accuracy and security

The School tries to keep all personal data as up to date and accurate as possible. Please tell The School of any changes to important information about you, such as contact details, as soon as possible.

The School will take appropriate technical and organisational steps to endeavour to ensure the security of personal data it holds about individuals. All staff will be made aware of this notice and their duties under Data Protection Law.

Personal Data will be processed by appropriate individuals only in accordance with access protocols (i.e. on a ‘need to know’ basis). Particularly strict rules of access apply in the context of:

•             Medical records, held and accessed only by the appropriate medical staff.

•             Pastoral or safeguarding files. In the case of pastoral and safeguarding files, The School uses CPOMS, which is monitored, maintained and processed by appropriate individuals only in accordance with strict access protocols (i.e. on a ‘need to know’ basis).

Complaints

If you have any queries or comments, or you believe that The School has not complied with this policy or data protection law, please contact the Bursar by emailing bursar@twyfordschool.com.

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO encourages potential complainants to attempt to resolve issues with the controller before submitting complaints.

Statutory or Contractual Provision

Certain personal data is necessary for the performance of any contract between parents or suppliers and The School in order to meet its statutory obligations. Where such data is withheld, a breach (by any parent or supplier) then the termination of the contract may result.

This Privacy Notice will be updated from time to time so please check it periodically.