Your privacy is important to us and we want to keep your personal information safe. This Privacy Notice tells you how we do that and sets out your rights when it comes to the personal information that we hold about you.

The school only holds the personal information it is allowed to hold about you, and only uses it for purposes related to your education at the school.

What kind of information do we collect about you?

• Your personal information (such as your name, title, date of birth, nationality, religion, addresses, telephone numbers, email addresses)
• Biometric information, if you or your parents have given consent for this
• Your academic, admissions and attendance records (including information about any special needs), examination scripts and marks, reports, and other assessment information
• Where appropriate, information about your health and welfare, and contact details for someone in case of an emergency
• Information about your educational progress and emotional wellbeing
• References we give or receive about you, and information provided by your previous schools and professionals and organisations that have worked with you
• Copies of your official documents (such as passport, birth certificate, UKVI visa and CAS)
• Medical information (such as medication you are required to take and food allergies)
• Images and video footage of you taking part in school activities, and images captured by the school’s CCTV system (in accordance with the school’s policies: please see Images and Recordings of Pupils Policy and CCTV Policy)
• Recordings of online lessons and meetings in which you take part
• Any court order relating to you (if relevant).

How do we collect your personal information?

We collect personal information from you and your parents or guardians directly. This may be through a form, or simply in our day-to-day contact with you (such as emails or verbal conversations).

From time to time we may also collect information about you supplied by others. For example, we may receive information from:

• another school
• professionals or authorities that have worked with you
• your UK guardian
• an agent that helped you get a place at the school.

The majority of the personal information you give us is mandatory, which means that you must provide it to us. Other personal information you give us is optional, which means that you may decide not to provide it to us. We will let you know when the personal information we request is optional.

Why do we collect your personal information?

We use your personal information:

1. to decide whether you can join the school (and consider whether bursaries or scholarships will apply)
2. to support your learning, education and development
3. to monitor and report on your progress
4. to make sure your health and wellbeing are looked after
5. to make sure we provide you with a high quality of education, including the full range of activities we provide
6. to ensure the school complies with the law and meets its legal obligations
7. in school publications, recordings and live streams, and to maintain the school’s archive.

For full details about how we use photograph and video images of you, please see the Images and Recordings of Pupils Policy.

We will only use your personal information for the reasons set out above. You can find more information about these reasons below.

The lawful basis for using your personal information

1. We have promised to your parents, under a contract with them, that we will support your education and welfare at the school. Most of the personal information we collect about you, and our communications about you with your parents, are needed to make sure we are able to provide this support to you under that contract.
2. We also use your personal information to make sure that the school is acting within the law and meets its legal obligations. For example, we need your personal information to ensure you are kept healthy and safe.
3. There are some situations where we use your personal information for other reasons (these are known as the ‘legitimate interests’ of the school). For example, we will use your personal information when publishing the school magazine, to celebrate the school community.
4. If we want to use information about you that does not fall into any of these categories, such as photographs for the school website or biometric information, we will ask you or your parent/s for permission to use it.
5. It is important for you to know that some of the information that we hold about you is sensitive, for example your medical and health records, religion and biometric information.

Who do we share your information with?

We share your personal information with:

1. education institutions that you attend after leaving us
2. our local authority
3. the Department for Education
4. companies who organise trips and other activities
5. companies who provide educational services, such as exam boards
6. organisations which provide us with IT services that help us to run the school
7. your parents and/or guardian.

We also share your information, or ask you to share it, with organisations that provide other services, such as UCAS or eDofE.
We may share your information with others where we are required or permitted to do so by law, or where we have a legitimate interest in sharing your personal information. This might include the Independent School’s Inspectorate, the Charity Commission, Ofsted, professional advisers, or other regulators.

Does your personal information go abroad?

We may use your information outside the UK, but we will only do this in certain situations. For example, we may do this when you or your parents contact us from outside the UK, when the school makes arrangements for trips and travel abroad, when we contact previous schools you attended abroad, or when you access our portal abroad. We will take steps to protect your personal information when this happens and may also let you know about this when it takes place.

How secure is your personal information?

We may use your information outside the UK, but we will only do this in certain situations. For example, we may do this when you or your parents contact us from outside the UK, when the school makes arrangements for trips and travel abroad, when we contact previous schools you attended abroad, or when you access our portal abroad. We will take steps to protect your personal information when this happens and may also let you know about this when it takes place.

How long will we keep your information for?

The school will keep your personal information only for as long as we have a lawful reason to do so. When we no longer have a lawful reason to hold it, we will delete or destroy your personal information securely. Typically, we will hold your personal information for a period of seven years after you leave the school. If we have information about events that concern your safety and health, the law requires us to keep this for much longer. Recordings of online lessons and meetings are typically deleted after seven days, unless a safeguarding concern has been raised. We may keep some information about you as part of the school’s historical archive.

In some circumstances we may anonymise your personal information. This means that your information can no longer be linked to you and you will not be identified. If we do this, we may use this information without telling you.

What about changing the information that we hold about you?

If any of your personal information changes, it is important that you let us know so that we can update our records to keep them accurate.

What can you do with the personal information that we hold?

You can:

• ask to see the personal information we hold about you
• ask for your personal information to be corrected to keep it accurate
• ask for your personal information to be deleted
• object to our use of your personal information
• ask us to limit the way we use your personal information
• request the transfer of your personal information to another person.

If you want to do any of the above, please contact Mr Ellott, the school’s Data Protection Lead, at the email address below.

When you do not want us to use your personal information

Most of your personal information has to be used by us for the reasons we have given in this notice. There are certain times when we do not have to use your personal information but we think that there are good reasons why we might want to use it. For example, we ask for permission to use biometric information in order to make registration easier and more accurate. If you give us permission to use personal information, you can always ask us to stop using it. If you want to do this, please contact Mr Ellott, the school’s Data Protection Lead, at the email address below.

Point of contact

Mr Ellott, the school’s Data Protection Lead, is responsible for this privacy notice. If you have any questions about it, or about how we handle your personal information, please contact him at the address below.

If you are unhappy with how we are using your personal information, you can make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We recommend that you discuss any concerns with us first before going to the ICO.

Changes to this privacy notice

We may update this privacy notice at any time and we will provide you with a new privacy notice when we make any big changes. We may also let you know in other ways about how we use your personal information.

If you have any questions about this privacy notice, please contact Mr Ellott, the school’s Data Protection Lead, at dpl@st-marys-ascot.co.uk.

Appendix: How we use images of pupils

This notice explains how we use images of pupils. It is hoped that pupils and parents will feel able to support the school in its use of pupil images to celebrate the girls’ achievements and to promote the work of the school. If you have any questions about this, please contact the school’s Data Protection Lead, Christopher Ellott, on dpl@st-marys-ascot.co.uk.

Situations in which we will ask for consent:

The school will seek the consent of parents before using pupil images (including film):

• on the school’s website;
• in the school magazine, the alumnae magazine or the school newsletter;
• in any new school prospectus or marketing materials that the school may publish in the future.

The school will not seek consent for these three uses where the pupil’s image is entirely incidental to the focus of the photograph or film, or is not readily identifiable. In such cases, the school will rely on its legitimate interest to use the image.

Where a pupil is the dominant focus of an image that is intended for use on the school website, or in marketing material, the school will normally also ask for the pupil’s consent for its use.

Situations in which we will not normally ask for consent:

The school may use pupil images (including film):

• on internal noticeboards and screens within the school premises, and on the school intranet;
• on the password-protected parent portal;
• on the password-protected alumnae website;
• in the existing school prospectus.

We believe it is important for us to be able to use these images to keep the school community updated about its activities, to celebrate the pupils’ achievements, and to promote the school, provided that their use does not compromise the rights or privacy of the pupils. The legal basis for this is called ‘legitimate interest’. If you wish to object to any of these uses, please contact the school’s Data Protection Lead, Christopher Ellott, at dpl@st-marys-ascot.co.uk.

Use of names alongside images:

Pupil names will not be published alongside photographs except with the express consent of the parent or pupil, as appropriate.