Oxford Sixth Form College Privacy Policy

 

Privacy notice for Students, Parents and Guardians

This privacy notice explains how Oxford Sixth Form College collect, store and use personal data about students. Oxford Tutorial College Ltd trading as Oxford Sixth Form College is the data controller, and for the purposes of data protection law, this privacy notice applies to Oxford Tutorial College Ltd trading as Oxford Sixth Form College.

The table below shows the data that we process about students, the reasons for processing this data and the lawful bases for processing this data. Cells marked with an asterisk (*) indicate that parent or guardian data may also be processed in the same way, where a student requires parental consent.

The data or type of data we process	The purpose of processing that data	The lawful bases for processing this data
Your name, date of birth, gender, addresses, email addresses and phone numbers. Your relationship to the student.*	To identify you to communicate with you	Fulfilment of a contract with you
	For marketing purposes	Where you have given us consent
		Necessary for our legitimate interest (to promote our schools and our educational activities
Your nationality, ethnic background, any special educational needs, special requirements or disabilities	To provide appropriate information and assistance for you	Fulfilment of a contract with you
		Compliance with a legal obligation
		Where you have given us consent
Next of kin and emergency contact numbers	To contact your family or close friends in the event of an emergency	To protect your vital interests
Your passport, BRP and visa details	To meet government immigration regulations	Compliance with a legal obligation
Bank account details*	To manage payments and refunds	Fulfilment of a contract with you
		Your educational records and test or exam results from previous schools
Your medical information, including medications you take, allergies and dietary requirements	To help you manage your health while you are with us	Fulfilment of a contract with you
		Compliance with a legal obligation
		Where you have given us consent
Your educational records and test or exam results from Oxford Sixth Form College	To manage your progress while studying with us	Fulfilment of a contract with you
Your attendance records and booking in/out records for school and residence	To meet government immigration and safeguarding regulations	Fulfilment of a contract with you
		Compliance with a legal obligation
Details of your welfare such as how you are getting on at Oxford International, safeguarding or child protection records and any problems or issues you may have had	To look after your wellbeing and meet government safeguarding regulations	Fulfilment of a contract with you
		Compliance with a legal obligation
Details of any behaviour issues or exclusions	To manage discipline in the schools	Necessary for our legitimate interests (to manage school discipline)
Images	For maintaining security	Necessary for our legitimate interest (for keeping our students and staff safe)
Images	For marketing our services	Where you have given us consent
		Necessary for our legitimate interest (to promote our educational activities and show prospective students/parents what we do here)
CCTV footage*	For security management	Necessary for our legitimate interests (to maintain building and personal security)
		Data about your use of information and communications systems, including Internet use
		Necessary for our legitimate interests (to secure our buildings)

Where we have obtained consent to use student data, this consent may be withdrawn at any time. We will make this clear when we ask for consent and explain how consent can be withdrawn.

When do we share Student, Parent or Guardian data?

When it is legally necessary, or allowed under data protection law, we may need to share information about you with the organisations listed in the table below, for the listed reasons.

Organisation Name	The Reason for Sharing
The Department for Education	To provide data on international students
The Local Education Authority	To provide data on international students
Regulatory bodies, such as Ofsted or the British Council	To comply with regulatory inspections
Service providers	For running surveys, providing taxi or excursion services, providing security services
Financial organisations*	For processing payments
Our auditors	For carrying out legal audits of company accounts
Health and social welfare organisations	To manage student wellbeing
Professional advisers and consultants	To assist us in developing our business
Police forces, courts, tribunals*	For dealing with legal issues
Your family and representatives	To share details of your academic progress or to tell them about attendance or behaviour issues or for debt collection
Exam Boards	To enter you for exams
UCAS	To enable you to apply to universities in the UK
Marketing services, such as those offered by Facebook	To identify other students who may be interested in studying with Oxford International. No decisions will be taken about you based on this profiling.

 

Transferring Student, Parent and Guardian data internationally

Your personal information may be stored and processed outside of the country where it is collected, including outside of the European Economic Area.

We will only transfer personal data to a country or territory outside the European Economic Area:

• where the transfer is to a place that is regarded by the European Commission as providing adequate protection for your Personal Information; or
• where we have put in place appropriate safeguards to ensure that your Personal Information is protected (for example where both parties involved in the transfer have signed standard data protection clauses adopted by the European Commission);or
• the above does not apply but we are still legally permitted to do so, for example if the transfer is necessary for the establishment, exercise or defence of legal claims.

You can request further detail about the safeguards that we have in place in respect of transfers of Personal Information outside of the EEA and where applicable a copy of the standard data protection clauses that we have in place, by contacting us at carole.nyssen@oxfordsixthformcollege.com

Storing Student, Parent and Guardian data

We will keep personal information about you while you are an active student. We create and maintain records for each individual student. The information contained in these records is kept secure and is only used for purposes directly relevant to your position as a student with Oxford International. Once your time as a student with us has ended, we will retain these records and delete them in accordance with our Data Retention Policy.

EU Representative

In compliance with the EU GDPR, as we are continuing to process personal data of EU nationals, we have appointed Rickert Law as our representative in the EU. They can be contacted as follows:

Rickert Law, Oxford Tutorial College Ltd

Colmantstral1e 15

53115 Bonn

Germany

Email: art-27-rep-ois@rickert.law

Your rights

Under certain circumstances, you may have certain rights regarding how your personal data is used and kept safe, including the right to:

Right of Access: You have the right to a copy of the information we hold about you.

Right to Object: You may object to the use of personal data if it would cause, or is causing, damage or distress. You have the right to object to any decisions taken using automated processes. You also you have the right to object to certain types of processing such as direct marketing.

Right to be Forgotten: Under certain circumstances, you can ask for the data we hold about you to be deleted from our systems.

Right to Rectification: If data we hold about you is inaccurate or incomplete, you have the right to correct or complete that data.

Right to Restriction of Processing: Where certain conditions apply you have a right to restrict the processing of data.

Right of Portability: You have the right to have the data we hold about you transferred to another organisation.

Some of these rights may not apply where we are legally obliged to keep or share your personal data. If you wish to exercise any of these rights, please contact our Data Protection Officer (see below).

Complaints

We take any complaints about our collection and use of personal information very seriously. If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance. To make a complaint, please email our Data Protection Officer, Marc Lewis at marc.lewis@oxfordsixthformcollege.com

Alternatively, you can make a complaint to the Information Commissioner’s Office in the UK via the options listed below, although we would be grateful for the opportunity to address your concerns before you contact the ICO.

How to contact the ICO:

• Report a concern online at https://ico.org.uk/make-a-complaint/
• Call +44 303 123 1113
• Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, UK

Contact Us

If you have any questions, concerns or would like more information about anything mentioned in this privacy policy, please contact our data protection officer Marc Lewis at marc.lewis@oxfordsixthformcollege.com

1. WHAT THIS PRIVACY NOTICE IS FOR
In order to fulfil the contract between you and the school, d’Overbroeck’s will collect, use and hold (“process”) personal data relating to you as a parent or guardian. This makes d’Overbroeck’s a “data controller” of your personal information under data protection law. This Privacy Notice sets out how and why we use personal information about you, and what your rights are concerning the information we hold. Your privacy is important to us and we want to keep your personal information safe. The school holds only the personal information we are permitted to hold about you, and uses it only for limited purposes relating to your child’s education, health and wellbeing at the school.

2. ABOUT THIS NOTICE
This Privacy Notice applies equally to current, past or prospective parents and guardians. It does not form part of any contract to provide services and we may update it at any time. This Privacy Notice applies to you in addition to the school’s other relevant terms and conditions and policies, including:
• any contract between the school and you;
• the school’s CCTV policy;
• the school’s Taking, Storing and Using Images of Students policy;
• the school’s Data Retention policy;
• the school’s Safeguarding policy;
• the school’s Health & Safety policy;
• the school’s e-Safety policy;
All the above policies are available from the policies page of our website.

3. THE KIND OF INFORMATION WE HOLD ABOUT YOU
Personal information is information that identifies you as an individual and relates to you.
This includes the following:
• your name, title, addresses, telephone numbers, email addresses, marital status, profession;
• your personal information as it relates to any concerns or complaints you have raised with the school;
• where asked by the school, your consent (or objection) for your child to participate in school trips or for us to use certain personal information about your child;
• where appropriate, information about your health and welfare, and the health and welfare history of your family; • where appropriate, criminal records information if you volunteer for school outings or activities where a DBS check is required;
• bank and financial information, particularly with regard to the payment of school fees;
• financial and personal information in support of an application for a means-tested bursary;
• other financial information in connection with fees-in-advance payments in accordance with antimoney laundering law;
• information from CCTV cameras when you visit the school site;
• information relating to your presence at virtual Open Days, Parents Evening and other online events;
• information about your education, qualifications, professional experience, hobbies and interests, where you have provided this to us voluntarily for use in school publications or at school events.

4. HOW WE COLLECT YOUR PERSONAL INFORMATION
We generally collect personal information from you directly. This may be through a form or meeting, or simply in our day-to-day contact with you (such as emails, conversations and via an online portal). From time to time we may collect information about you and your child from third parties. For example, from your child’s previous school or from doctors, professionals or authorities. Some of the personal information you provide to us is mandatory, which means that you must provide it to us so that we can provide our services to you and your child. Other personal information you provide to us is optional, which means that you may decide not to provide it to us. We will let you know when the personal information we request is optional. Your duty to inform us of changes If you move house, change your email address, telephone number or other personal details, it is important that you let us know so that the information we hold is accurate.

5. WHY WE COLLECT YOUR PERSONAL INFORMATION
We use your personal information:
a) to decide whether your child can be admitted to the school
b) to decide whether your child is eligible for a bursary or scholarship
c) to facilitate the payment of school fees
d) to support your child’s learning and education
e) to monitor and report on your child’s progress
f) to make sure your child’s health and wellbeing is looked after
g) to make sure we provide your child with a high quality of education
h) to ensure the school complies with the law and meets its legal obligations.
Further details are in section 6 below.

6. THE BASIS FOR USING YOUR PERSONAL INFORMATION
We will only use your personal information when the law allows us to. We are likely to use your personal information for the following purposes:
a) Entering into, or fulfilling, our contract with you Most of the personal information we collect about you is needed to make sure we are able to fulfil our obligations to you under the parent contract. For example: 
• to keep you informed of your child’s health, wellbeing and educational development. • to arrange educational and extra-curricular trips and activities.
• to arrange for payment of fees. b) Compliance with legal rights, duties or obligations, for example:
• relating to child welfare, social protection, equality monitoring, immigration/visa sponsorship compliance and health & safety.
• submitting data as part of the annual school census collection by the Department for Education and Independent Schools Council, using anonymised data and statistics.
• for the prevention and detection of crime, such as money laundering, and to assist with investigations (including criminal investigations) carried out by the police and other competent authorities. 
c) Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. For example: • when the parent contract we have with you does not apply (or is not yet in place) or when there is no specific law which requires us to use your personal information, such as when deciding whether your child can be admitted to the school.
• monitoring students’ progress and educational needs.
• asking for professional advice or information from someone outside the school, such as professionals or a previous school.
• safeguarding a student’s welfare, and providing appropriate education services, such as physical or spiritual development.
• for site security purposes, such as CCTV in accordance with our CCTV policy, or to carry out any school or external complaints or investigations processes. or to record the presence and activity of visitors to virtual events such as Open Days and Parents Evenings. • to record the presence and activity of visitors to virtual events such as Open Days and Parent Evenings.
• when you have given your informed and freely given consent to use your personal information, for instance when you agree to us using your personal information when giving pupils career guidance (including at career events).

7. HOW WE USE PARTICULARLY SENSITIVE PERSONAL INFORMATION
It is important to be aware that, where appropriate, we may also use sensitive personal information about you, such as your medical and health information, ethnicity or religion. This information is used to safeguard your child’s welfare and provide us with the information we require to meet your child’s specific needs, and to fulfil the school’s legal and regulatory responsibilities regarding child protection and monitoring. Particularly strict rules apply when processing medical, pastoral or safeguarding records.

8. SHARING YOUR DATA WITH OTHERS 
Personal data collected by the school usually remains within the school and will be processed by appropriate individuals only in accordance with access protocols, ie on a ‘need to know’ basis. However, we routinely share your data with third parties, including third-party service providers where it is necessary to administer our contract with you, where required by law, or where we have a legitimate interest in doing so, as outlined above. Third-party service providers who may process your personal information We may disclose limited personal data (including in limited cases special category or criminal data) to a variety of recipients including:
• schools that your child attends after leaving us.
• other service providers for administration and IT services, such as web developers, virtual event facilitators or cloud storage providers, although this is not sharing your data in a legal sense, as these are considered data processors on our behalf.
• our parent company, Nord Anglia Education. For example, so that we may make efficient use of our resources. NAE may also receive information that you have consented to providing us for the purposes of giving career guidance to pupils.
• where we are required or permitted to do so by law, or where we have a legitimate interest in sharing your personal information. This might include the Department for Education, the Independent Schools Inspectorate, relevant public health/NHS agencies, the Information Commissioner’s Office, the Charity Commission, the local authority, Ofsted, professional advisers, auditors, or other regulators. It may also include companies who carry out research to help us with our future planning for the school, for example RSAcademics Ltd. • when the school is legally required to do so (by a court order, government body, law enforcement agency or other authority of competent jurisdiction), for example HM Revenue and Customs or police.

9. TRANSFERRING STUDENT, PARENT AND GUARDIAN DATA INTERNATIONALLY
Your personal information may be stored and processed outside of the country where it is collected, including outside of the European Economic Area. We will only transfer personal data to a country or territory outside the European Economic Area:
• where the transfer is to a place that is regarded by the European Commission as providing adequate protection for your Personal Information; or
• where we have put in place appropriate safeguards to ensure that your Personal Information is protected (for example where both parties involved in the transfer have signed standard data protection clauses adopted by the European Commission); or • the above does not apply but we are still legally permitted to do so, for example if the transfer is necessary for the establishment, exercise or defence of legal claims. We have put in place measures to protect the security of your information. Details of these measures are available from Tracy Roslyn, Data Compliance Administrator, tracy.roslyn@doverbroecks.com. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

10. HOW WE SECURE YOUR INFORMATION WHEN OTHERS USE IT 
All our service providers have to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only allow them to use your personal data for specified purposes and in accordance with our instructions and in accordance with the law. Arrangements with third party IT processors are always subject to contractual assurances that personal data will be kept securely.

11. DATA SECURITY
We protect the security of your information. If you want to know how we do this, please contact Tracy Roslyn, Data Compliance Administrator, tracy.roslyn@doverbroecks.com.  We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those individuals who have a need to know it. They will only use your personal information on our instructions and they will be required to treat it as confidential.  We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

12. DATA RETENTION
The school will keep your personal information securely and only for as long as it is necessary for a legitimate and lawful reason. When we do not have a lawful reason to hold it, we will delete or destroy your personal information securely. In some circumstances we may anonymise your personal information, so that it can no longer be linked to you. If we do this, we may use such information without telling you.  Typically, we will hold your personal information until your child reaches the age of 25. Some will be kept for a much shorter period, eg, CCTV images, recorded virtual events, and bank account details. However, any of your personal information which relates to incident reports and safeguarding must be kept much longer, as required by the law. For further information, please see our Data Retention Policy, available from our website or on request from the school office.

13. YOUR RIGHTS
• ask to see your personal information;
• ask for a correction of your personal information to ensure it is accurate; • ask for your personal information to be deleted (the ‘right to be forgotten’);
• object to processing of your personal information;
• ask for us to limit the processing of your personal information;
• request the transfer of your personal information to another party.
If you want to do any of the above, please contact Tracy Roslyn, Data Compliance Administrator, tracy.roslyn@doverbroecks.com in writing. The school will endeavour to respond to any such requests as quickly as reasonably practicable, and in any event within statutory time-limits, which is one month in the case of requests for access to information. Requests that cannot be fulfilled  The right of access is limited to your own personal data. The school therefore cannot disclose: 
• information which is subject to legal privilege, such as legal advice given or sought by the school, or documents prepared in connection with legal action;
• information which discloses student examination scripts or other information consisting solely of student test answers or test marks ahead of any ordinary publication;
• any confidential reference given by the school for the purposes of the education of any individual;
• information which identifies other individuals, and this may include your own children. Although a person with parental responsibility will generally be entitled to make a subject access request on behalf of younger students, the law still considers the information in question to be the child’s. For older students, generally aged 12 and above, the parents making the request may need to provide the child’s written permission for that specific request to be carried out. The school may have compelling reasons to refuse specific requests to amend, delete or stop processing you or your child’s personal data, for example, a legal requirement, or where it falls within a legitimate interest in this Privacy Notice. All such requests will be considered on their own merits.  Your right to withdraw consent  Where you have voluntarily supplied optional personal information, you can withdraw this consent at any time. Examples may include certain types of images or helping to promote and run a careers event. Parental rights The school usually relies on parental authority for the necessary ways it processes personal data relating to students, for example under the parent contract. Parents will generally receive educational and pastoral updates about their children. Where parents are separated, the school will, in most cases, aim to provide the same information to each person with parental responsibility, but may need to factor in all the circumstances including the wishes of the child. Student rights In general, the school will assume that student’s consent is not required for ordinary disclosure of their personal data to their parents, such as keeping parents informed about the student’s activities, progress and behaviour, and in the interests of the student’s welfare. However, where a student seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, the school may be under an obligation to maintain confidentiality unless, in the school’s opinion, there is a good reason to do otherwise, for example where the school believes disclosure will be in the best interests of the student or other students, or if required by law. 

14. CHANGES TO THIS PRIVACY NOTICE 
We may update this notice from time to time and publish a new version on the Privacy Notices page of our website. We may also notify you in other ways from time to time about the processing of your personal information.

15. CONTACTS AND COMPLAINTS
If you have any questions about this privacy notice or how we handle your personal information, or if you wish to exercise any of your rights under applicable law, please contact Tracy Roslyn, Data Compliance Administrator, at tracy.roslyn@doverbroecks.com. Application Form - Cecile Bolton Family If you are not satisfied with how we are processing your personal data, or how we deal with your complaint, you can make a complaint to the Information Commissioner’s Office (ICO) www.ico.org.uk, the UK supervisory authority for data protection issues. The ICO recommends that you take steps to resolve the matter with the school before involving them