1. WHAT THIS PRIVACY NOTICE IS FOR
In order to fulfil the contract between you and the school, d’Overbroeck’s will collect, use and hold (“process”) personal data relating to you as a parent or guardian. This makes d’Overbroeck’s a “data controller” of your personal information under data protection law. This Privacy Notice sets out how and why we use personal information about you, and what your rights are concerning the information we hold. Your privacy is important to us and we want to keep your personal information safe. The school holds only the personal information we are permitted to hold about you, and uses it only for limited purposes relating to your child’s education, health and wellbeing at the school.

2. ABOUT THIS NOTICE
This Privacy Notice applies equally to current, past or prospective parents and guardians. It does not form part of any contract to provide services and we may update it at any time. This Privacy Notice applies to you in addition to the school’s other relevant terms and conditions and policies, including:
• any contract between the school and you;
• the school’s CCTV policy;
• the school’s Taking, Storing and Using Images of Students policy;
• the school’s Data Retention policy;
• the school’s Safeguarding policy;
• the school’s Health & Safety policy;
• the school’s e-Safety policy;
All the above policies are available from the policies page of our website.

3. THE KIND OF INFORMATION WE HOLD ABOUT YOU
Personal information is information that identifies you as an individual and relates to you.
This includes the following:
• your name, title, addresses, telephone numbers, email addresses, marital status, profession;
• your personal information as it relates to any concerns or complaints you have raised with the school;
• where asked by the school, your consent (or objection) for your child to participate in school trips or for us to use certain personal information about your child;
• where appropriate, information about your health and welfare, and the health and welfare history of your family; • where appropriate, criminal records information if you volunteer for school outings or activities where a DBS check is required;
• bank and financial information, particularly with regard to the payment of school fees;
• financial and personal information in support of an application for a means-tested bursary;
• other financial information in connection with fees-in-advance payments in accordance with antimoney laundering law;
• information from CCTV cameras when you visit the school site;
• information relating to your presence at virtual Open Days, Parents Evening and other online events;
• information about your education, qualifications, professional experience, hobbies and interests, where you have provided this to us voluntarily for use in school publications or at school events.

4. HOW WE COLLECT YOUR PERSONAL INFORMATION
We generally collect personal information from you directly. This may be through a form or meeting, or simply in our day-to-day contact with you (such as emails, conversations and via an online portal). From time to time we may collect information about you and your child from third parties. For example, from your child’s previous school or from doctors, professionals or authorities. Some of the personal information you provide to us is mandatory, which means that you must provide it to us so that we can provide our services to you and your child. Other personal information you provide to us is optional, which means that you may decide not to provide it to us. We will let you know when the personal information we request is optional. Your duty to inform us of changes If you move house, change your email address, telephone number or other personal details, it is important that you let us know so that the information we hold is accurate.

5. WHY WE COLLECT YOUR PERSONAL INFORMATION
We use your personal information:
a) to decide whether your child can be admitted to the school
b) to decide whether your child is eligible for a bursary or scholarship
c) to facilitate the payment of school fees
d) to support your child’s learning and education
e) to monitor and report on your child’s progress
f) to make sure your child’s health and wellbeing is looked after
g) to make sure we provide your child with a high quality of education
h) to ensure the school complies with the law and meets its legal obligations.
Further details are in section 6 below.

6. THE BASIS FOR USING YOUR PERSONAL INFORMATION
We will only use your personal information when the law allows us to. We are likely to use your personal information for the following purposes:
a) Entering into, or fulfilling, our contract with you Most of the personal information we collect about you is needed to make sure we are able to fulfil our obligations to you under the parent contract. For example: 
• to keep you informed of your child’s health, wellbeing and educational development. • to arrange educational and extra-curricular trips and activities.
• to arrange for payment of fees. b) Compliance with legal rights, duties or obligations, for example:
• relating to child welfare, social protection, equality monitoring, immigration/visa sponsorship compliance and health & safety.
• submitting data as part of the annual school census collection by the Department for Education and Independent Schools Council, using anonymised data and statistics.
• for the prevention and detection of crime, such as money laundering, and to assist with investigations (including criminal investigations) carried out by the police and other competent authorities. 
c) Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. For example: • when the parent contract we have with you does not apply (or is not yet in place) or when there is no specific law which requires us to use your personal information, such as when deciding whether your child can be admitted to the school.
• monitoring students’ progress and educational needs.
• asking for professional advice or information from someone outside the school, such as professionals or a previous school.
• safeguarding a student’s welfare, and providing appropriate education services, such as physical or spiritual development.
• for site security purposes, such as CCTV in accordance with our CCTV policy, or to carry out any school or external complaints or investigations processes. or to record the presence and activity of visitors to virtual events such as Open Days and Parents Evenings. • to record the presence and activity of visitors to virtual events such as Open Days and Parent Evenings.
• when you have given your informed and freely given consent to use your personal information, for instance when you agree to us using your personal information when giving pupils career guidance (including at career events).

7. HOW WE USE PARTICULARLY SENSITIVE PERSONAL INFORMATION
It is important to be aware that, where appropriate, we may also use sensitive personal information about you, such as your medical and health information, ethnicity or religion. This information is used to safeguard your child’s welfare and provide us with the information we require to meet your child’s specific needs, and to fulfil the school’s legal and regulatory responsibilities regarding child protection and monitoring. Particularly strict rules apply when processing medical, pastoral or safeguarding records.

8. SHARING YOUR DATA WITH OTHERS 
Personal data collected by the school usually remains within the school and will be processed by appropriate individuals only in accordance with access protocols, ie on a ‘need to know’ basis. However, we routinely share your data with third parties, including third-party service providers where it is necessary to administer our contract with you, where required by law, or where we have a legitimate interest in doing so, as outlined above. Third-party service providers who may process your personal information We may disclose limited personal data (including in limited cases special category or criminal data) to a variety of recipients including:
• schools that your child attends after leaving us.
• other service providers for administration and IT services, such as web developers, virtual event facilitators or cloud storage providers, although this is not sharing your data in a legal sense, as these are considered data processors on our behalf.
• our parent company, Nord Anglia Education. For example, so that we may make efficient use of our resources. NAE may also receive information that you have consented to providing us for the purposes of giving career guidance to pupils.
• where we are required or permitted to do so by law, or where we have a legitimate interest in sharing your personal information. This might include the Department for Education, the Independent Schools Inspectorate, relevant public health/NHS agencies, the Information Commissioner’s Office, the Charity Commission, the local authority, Ofsted, professional advisers, auditors, or other regulators. It may also include companies who carry out research to help us with our future planning for the school, for example RSAcademics Ltd. • when the school is legally required to do so (by a court order, government body, law enforcement agency or other authority of competent jurisdiction), for example HM Revenue and Customs or police.

9. TRANSFERRING STUDENT, PARENT AND GUARDIAN DATA INTERNATIONALLY
Your personal information may be stored and processed outside of the country where it is collected, including outside of the European Economic Area. We will only transfer personal data to a country or territory outside the European Economic Area:
• where the transfer is to a place that is regarded by the European Commission as providing adequate protection for your Personal Information; or
• where we have put in place appropriate safeguards to ensure that your Personal Information is protected (for example where both parties involved in the transfer have signed standard data protection clauses adopted by the European Commission); or • the above does not apply but we are still legally permitted to do so, for example if the transfer is necessary for the establishment, exercise or defence of legal claims. We have put in place measures to protect the security of your information. Details of these measures are available from Tracy Roslyn, Data Compliance Administrator, tracy.roslyn@doverbroecks.com. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

10. HOW WE SECURE YOUR INFORMATION WHEN OTHERS USE IT 
All our service providers have to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only allow them to use your personal data for specified purposes and in accordance with our instructions and in accordance with the law. Arrangements with third party IT processors are always subject to contractual assurances that personal data will be kept securely.

11. DATA SECURITY
We protect the security of your information. If you want to know how we do this, please contact Tracy Roslyn, Data Compliance Administrator, tracy.roslyn@doverbroecks.com.  We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those individuals who have a need to know it. They will only use your personal information on our instructions and they will be required to treat it as confidential.  We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

12. DATA RETENTION
The school will keep your personal information securely and only for as long as it is necessary for a legitimate and lawful reason. When we do not have a lawful reason to hold it, we will delete or destroy your personal information securely. In some circumstances we may anonymise your personal information, so that it can no longer be linked to you. If we do this, we may use such information without telling you.  Typically, we will hold your personal information until your child reaches the age of 25. Some will be kept for a much shorter period, eg, CCTV images, recorded virtual events, and bank account details. However, any of your personal information which relates to incident reports and safeguarding must be kept much longer, as required by the law. For further information, please see our Data Retention Policy, available from our website or on request from the school office.

13. YOUR RIGHTS
• ask to see your personal information;
• ask for a correction of your personal information to ensure it is accurate; • ask for your personal information to be deleted (the ‘right to be forgotten’);
• object to processing of your personal information;
• ask for us to limit the processing of your personal information;
• request the transfer of your personal information to another party.
If you want to do any of the above, please contact Tracy Roslyn, Data Compliance Administrator, tracy.roslyn@doverbroecks.com in writing. The school will endeavour to respond to any such requests as quickly as reasonably practicable, and in any event within statutory time-limits, which is one month in the case of requests for access to information. Requests that cannot be fulfilled  The right of access is limited to your own personal data. The school therefore cannot disclose: 
• information which is subject to legal privilege, such as legal advice given or sought by the school, or documents prepared in connection with legal action;
• information which discloses student examination scripts or other information consisting solely of student test answers or test marks ahead of any ordinary publication;
• any confidential reference given by the school for the purposes of the education of any individual;
• information which identifies other individuals, and this may include your own children. Although a person with parental responsibility will generally be entitled to make a subject access request on behalf of younger students, the law still considers the information in question to be the child’s. For older students, generally aged 12 and above, the parents making the request may need to provide the child’s written permission for that specific request to be carried out. The school may have compelling reasons to refuse specific requests to amend, delete or stop processing you or your child’s personal data, for example, a legal requirement, or where it falls within a legitimate interest in this Privacy Notice. All such requests will be considered on their own merits.  Your right to withdraw consent  Where you have voluntarily supplied optional personal information, you can withdraw this consent at any time. Examples may include certain types of images or helping to promote and run a careers event. Parental rights The school usually relies on parental authority for the necessary ways it processes personal data relating to students, for example under the parent contract. Parents will generally receive educational and pastoral updates about their children. Where parents are separated, the school will, in most cases, aim to provide the same information to each person with parental responsibility, but may need to factor in all the circumstances including the wishes of the child. Student rights In general, the school will assume that student’s consent is not required for ordinary disclosure of their personal data to their parents, such as keeping parents informed about the student’s activities, progress and behaviour, and in the interests of the student’s welfare. However, where a student seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, the school may be under an obligation to maintain confidentiality unless, in the school’s opinion, there is a good reason to do otherwise, for example where the school believes disclosure will be in the best interests of the student or other students, or if required by law. 

14. CHANGES TO THIS PRIVACY NOTICE 
We may update this notice from time to time and publish a new version on the Privacy Notices page of our website. We may also notify you in other ways from time to time about the processing of your personal information.

15. CONTACTS AND COMPLAINTS
If you have any questions about this privacy notice or how we handle your personal information, or if you wish to exercise any of your rights under applicable law, please contact Tracy Roslyn, Data Compliance Administrator, at tracy.roslyn@doverbroecks.com. Application Form - Cecile Bolton Family If you are not satisfied with how we are processing your personal data, or how we deal with your complaint, you can make a complaint to the Information Commissioner’s Office (ICO) www.ico.org.uk, the UK supervisory authority for data protection issues. The ICO recommends that you take steps to resolve the matter with the school before involving them