Privacy Notice (South AFRICA)
Reddam House takes data protection and our responsibilities to correctly and lawfully treat personal data as a data controller seriously. We are committed to complying with legal obligations and practicing industry standards when collecting, processing and storing personal data.
This privacy notice provides detailed information about how we treat information that you provide to us. Our Data Protection Officer can be contacted by email on firstname.lastname@example.org if you have any queries regarding your personal data.
2. TYPES OF PERSONAL DATA WE PROCESS
We process personal data about prospective, current and past: pupils and their parents; staff, suppliers and contractors; donors, friends and supporters; and other individuals connected to or visiting Reddam House.
The personal data we collect, process and store will be personally identifiable information related to pupils and their parents, staff, suppliers and contractors, donors, friends and supporters. The personal data processed includes recorded information that is true and correct and/or video and photographic images about an individual. Information such as;
- names, addresses, telephone numbers, e-mail addresses and other contact details;
- family details;
- admissions, academic, disciplinary and other education related records, information about special educational needs, references, examination scripts and marks;
- education and employment data;
- images, audio and video recordings;
- financial information;
- schools previously attended.
Other types of data we collect, process and store is protected health information, criminal record information and other sensitive information related to an individual. Information such as;
- information about health status or provision of health care linked to a specific individual;
- information about criminal records linked to a specific individual;
- biometric information;
- race and/or ethnicity;
3. HOW WE COLLECT AND PROCESS PERSONAL DATA
Reddam House collects information in several ways, including:
- in person and over the phone: from students and their family, staff, volunteers, visitors, job applicants and others;
- from electronic and paper documentation: including job applications, emails, invoices, enrolment forms, letters to our school, consent forms, our school’s website or school-controlled social media;
- through online tools: such as apps and other software used by our school;
- through any CCTV cameras located at our school;
- through third parties, such as referees, previous schools, professionals or authorities working with the individual
- through publicly available resources
As a school, it is lawfully required to share personal information with relevant authorities: such as the Department of Education or government services such as Visa and Immigration, Revenue and Customs. Our members of staff collect, process and store personal information only for the purpose for which it is intended.
Personal data resides within the Republic of South Africa, however some of the school’s processing activity is carried out on its behalf by third parties, such as IT systems, web developers or cloud storage providers. In accordance with Data Protection Law, this is always subject to contractual assurances that personal data will be kept securely and only in accordance with the school’s specific directions. We do not transfer personal data outside of the Republic of South Africa, unless we are satisfied that the personal data will be afforded an equivalent level of protection.
Our school has a Data Protection Standard in place to oversee the effective and secure processing of your personal data. We have policies around the use of technology and devices, and access to school systems. We try to ensure that all personal data held in relation to an individual is as up to date and accurate as possible.
4. PURPOSES FOR WHICH WE PROCESS PERSONAL DATA
Reddam House processes personal data to lawfully and legitimately support the school’s operation as an independent school. Our school collects information about students and their families when necessary to:
- select and admit students;
- educate students;
- administer pupils’ entries to public examinations;
- provide academic reporting upon each student and publishing of results;
- provide references for current and past pupils;
- support students’ social and emotional wellbeing, and health;
- support operational management of the school including administration of pupil records; the administration of invoices, fees and accounts; the management of the school’s property; the management of security and safety arrangements (including the use of CCTV in accordance with our CCTV Policies and monitoring of the school’s IT and communications systems in accordance with our Acceptable Use Policy); management planning and forecasting; research and statistical analysis; the administration and implementation of the school’s rules and policies for pupils and staff; the maintenance of historic archives and other operational purposes;
- fulfil legal requirements;
- take reasonable steps to reduce the risk of reasonably foreseeable harm to students, staff and visitors (duty of care);
- make reasonable adjustments and support for students with special needs;
- provide a safe and secure working and school environment;
- communicate with parents about students’ schooling matters and celebrate the efforts and achievements of students;
- maintain the good order and management of our school
- promote the school on our school’s website or school-controlled social media, the school prospectus and other publications and communications conducted by the school
Our school collects information about staff, prospective staff and contractors when necessary for:
- the administration of staff records;
- the recruitment of staff;
- the engagement of contractors;
- administration of payroll, pensions and sick leave;
- staff appraisal;
- disciplinary procedures;
- administration of human resources records;
- providing references
5. HOW LONG DO WE KEEP PERSONAL DATA
We retain personal data only for a legitimate and lawful reason and only for so long as necessary or required by law. Our Data Protection Officer can be contacted by email on email@example.com if you have any queries regarding the retention of your personal data.
6. YOUR RIGHTS
Under Data Protection Law you have rights regarding the collection, processing and storage of your personal data. These rights are, however, subject to certain exemptions and limitations.
You have the right to:
- access and understand the personal data we hold about you;
- access and understand the personal data we hold about your child;
- ask for the personal data we hold about you and/or your child to be erased (this is with limitations and exceptions as we may have lawful reason to hold such data);
- ask for the personal data we hold about you and/or your child to be amended;
- ask us to stop processing such data (this is with limitations and exceptions as we may have lawful reason to process such data);
- withdraw consent to process your personal data or your child’s personal data (this is with limitations and exceptions as we may have lawful reason to process such data regardless of consent)
Our Data Protection Officer can be contacted by email on firstname.lastname@example.org if you have any queries regarding your rights. Any request for data we store and process about you must be completed in writing.
7. SUBJECT ACCESS REQUESTS
Under Data Protection Law you have the right to request information or request to delete information we store about you and/or your child without incurring costs. We are only obligated to provide information that is related to you and your child (depending on legal custody). Parents can request data on behalf of their child, however, depending on their age, a student can also submit a Subject Access Request form to obtain their own data. Access to personal data belonging to your child may require the child’s consent if the child is old enough to understand the implications of such a request. Any data access request is, however, subject to certain exemptions, limitations or contractual obligations. Data belonging to or identifying other individuals is exempt from right of access and will be subject to legal privilege. We cannot disclose confidential information related to the purpose of providing education, examinations or supplying examination scripts to external bodies. We cannot disclose confidential information on any of our staff.
Any request for data we store and process about you or your child must be completed in writing. The Subject Access Request form can be obtained from our Data Protection Officer by email on email@example.com. Data Protection Law allows us to respond to any such written requests within one calendar month. Excessive requests or simultaneous requests for the same information may incur an administration fee or be refused where Data Protection Law allows us to do so.
Under Data Protection Law we are required to obtain consent to process an individual’s personal data. This is with limitations and exceptions as we may have lawful and legitimate reasons to process such data to support the school’s operation as an independent school or fulfil contractual or legal obligations, regardless of consent. When our school collects information about you, our school takes reasonable steps to advise you of certain matters. This includes the purpose of the collection, and how to access, update and correct information held about you. For information about students and their families, a consent form is provided to parents (or mature students) upon enrolment. In some cases, we may send out separate consent requests using:
- paper based consent forms;
- electronic consent forms;
- digital applications to obtain consent
9. PRIVACY NOTICE UPDATES
Reddam House will update this Privacy Notice from time to time. Any substantial changes that affect how we process your personal data will be notified on our website. If required we will also notify you directly. This Privacy Notice should be read in conjunction with other school policies and any contract terms and conditions.
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Regulator. We recommend that you contact our Data Protection Officer by email on firstname.lastname@example.org to take necessary steps to resolve the matter before contacting the Information Regulator.
11. COOKIES POLICY
PRIVACY NOTICE (EUROPE)
Reddam House Berkshire is committed to safeguarding and promoting the welfare of children and young people and expects all staff, volunteers, students and visitors to share this commitment.
All outcomes generated by this document must take account of and contribute to safeguarding and promoting the welfare of children and young people at Reddam House Berkshire.
In the course of your employment, engagement or other basis of work undertaken for Reddam house Berkshire (‘the school’), we will collect, use and hold (“process”) personal data relating to you as a member of our staff. This makes the school a data controller of your personal information, and this Privacy Notice sets out how we will use that information and what your rights are.
WHO THIS DOCUMENT APPLIES TO
Academic and other staff, contractors, itinerant teachers, casual workers, temps and volunteers who may be employed or engaged by the school to work for it in any capacity, as well as prospective applicants for roles. It also applies to governors and directors.
ABOUT THIS DOCUMENT
This Staff Privacy Notice explains how the school collects, uses and shares (or "processes") personal data of staff, and your rights in relation to the personal data we hold.
This Privacy Notice also applies in addition to the school's other relevant terms and conditions and policies, including:
- any contract between the school and its staff, such as the terms and conditions of employment, and any applicable staff handbook.
- the school’s CCTV policy;
- the school’s retention of records policy;
- the school's safeguarding, pastoral, anti-bullying, or health and safety policies, including as to how concerns or incidents are reported or recorded (both by and about staff); and
- the school's IT policies, including its Acceptable Use and eSafety policies.
Please note that your contract with the school, including any document or policy forming a part of your contractual obligations to the school, may in particular be relevant to and supplement the information in this Staff Privacy Notice, to the extent that it will contain details of obligations or rights of the school under contract with you which may require the use of your personal data. However, this Staff Privacy Notice is the primary document applicable to the use of your personal data by the school.
This Staff Privacy Notice also applies alongside any other information the school may provide about particular uses of personal data, for example when collecting data via an online or paper form.
HOW WE COLLECT YOUR INFORMATION
We may collect your personal data in several ways, for example:
- from the information you provide to us before making a job application, for example when you come for an interview;
- when you submit a formal application to work for us, and provide your personal data in application forms and covering letters, etc.; and
- from third parties, for example the Disclosure and Barring Service (DBS) and referees (including your previous or current employers or school) to verify details about you and/or your application to work for us.
More generally, during your employment with us, as a member of staff, we will collect data from or about you, including:
- when you provide or update your contact details;
- when you or another member of staff completes paperwork regarding your performance appraisals;
- while fulfilling your employment (or equivalent) duties more generally, including by filling reports, note taking, or sending emails on school systems;
- in various other ways as you interact with us during your time as a member of staff, and afterwards, where relevant, for the various purposes set out below.
THE TYPES OF INFORMATION WE COLLECT
We may collect the following types of personal data about you (and your family members and 'next of kin', where relevant):
- contact and communications information, including:
- biographical, educational and social information, including:
- financial information, including:
- work related information, including:
- and any other information relevant to your employment or other engagement to work for the school.
- your contact details (including email address(es), telephone numbers and postal address(es);
- contact details (through various means, as above) for your family members and 'next of kin', in which case you confirm that you have the right to pass this information to us for use by us in accordance with this Privacy Notice;
- records of communications and interactions we have had with you;
- your name, title, gender, nationality and date of birth;
- your image and likeness, including as captured in photographs taken for work purposes;
- details of your education and references from your institutions of study;
- lifestyle information and social circumstances;
- your interests and extra-curricular activities;
- your bank account number(s), name(s) and sort code(s) (used for paying your salary and processing other payments);
- your tax status (including residence status);
- information related to pensions, national insurance, or employee benefit schemes;
- details of your work history and references from your previous employer(s);
- your personal data captured in the work product(s), notes and correspondence you create while employed by or otherwise engaged to work for the school;
- details of your professional activities and interests;
- your involvement with and membership of sector bodies and professional associations;
- information about your employment and professional life after leaving the school, where relevant (for example, where you have asked us to keep in touch with you);
Where this is necessary for your employment or other engagement to work for us, we may also collect special categories of data, and information about criminal convictions and offences, including:
- information revealing your racial or ethnic origin;
- information concerning your health and medical conditions (for example, where required to monitor and record sickness absences, dietary needs, or to make reasonable adjustments to your working conditions or environment);
- information concerning your sexual life or orientation (for example, while investigating complaints made by you or others, for example concerning discrimination); and
- information about certain criminal convictions (for example, where this is necessary for due diligence purposes, or compliance with our legal and regulatory obligations);
However, this will only be undertaken where and to the extent it is necessary for a lawful purpose in connection with your employment or other engagement to work for the school.
THE BASES FOR PROCESSING YOUR PERSONAL DATA, HOW THAT DATA IS USED AND WHOM IT IS SHARED WITH
(I) ENTERING INTO, OR FULFILLING, OUR CONTRACT WITH YOU
We process your personal data because it is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract, such as a contract of employment or other engagement with us. In this respect, we use your personal data for the following:
- administering job applications and, where relevant, offering you a role with us;
- carrying out due diligence checks on you, whether during the application process for a role with us or during your engagement with us, including by checking references in relation to your education and your employment history;
- once you are employed or engaged by us in any capacity, for the performance of the contract of employment (or other agreement) between you and us;
- to pay you and to administer benefits (including pensions) in connection with your employment or other engagement with us;
- monitoring your attendance and your performance in your work, including in performance appraisals;
- promoting the school to prospective parents and others, including by publishing the work product(s) you create while employed by or otherwise engaged to work for the school;
- for disciplinary purposes, including conducting investigations where required;
- for other administrative purposes, for example to update you about changes to your terms and conditions of employment or engagement, or changes to your pension arrangements;
- for internal record-keeping, including the management of any staff feedback or complaints and incident reporting; and
- for any other reason or purpose set out in your employment or other contract with us.
(II) LEGITIMATE INTERESTS
We process your personal data because it is necessary for our (or sometimes a third party's) legitimate interests. Our "legitimate interests" include our interests in running the school in a professional, sustainable manner, in accordance with all relevant ethical, educational, legal and regulatory duties and requirements (whether or not connected directly to data protection law). In this respect, we use your personal data for the following:
- providing you with information about us and what it is like to work for us (where you have asked for this, most obviously before you have made a formal application to work for us);
- for security purposes, including by operating security cameras in various locations on the school's premises;
- to enable relevant authorities to monitor the school's performance and to intervene or assist with incidents as appropriate;
- to provide education services to students;
- to safeguard students' welfare and provide appropriate pastoral care;
- to carry out or cooperate with any school or external complaints, disciplinary or investigatory process;
- for the purposes of management planning and forecasting, research and statistical analysis;
- in connection with organising events and social engagements for staff;
- making travel arrangements on your behalf, where required;
- contacting you or your family members and 'next of kin' for business continuity purposes, to confirm your absence from work, etc.;
- publishing your image and likeness in connection with your employment or engagement with us;
- to monitor (as appropriate) use of the school's IT and communications systems in accordance with the school's Acceptable Use Policy and government guidance such as KCSIE.
(III) LEGAL OBLIGATIONS
We also process your personal data for our compliance with our legal obligations, notably those in connection with employment, company law, tax law and accounting, and child welfare. In this respect, we use your personal data for the following:
- to meet our legal obligations (for example, relating to child welfare, social protection, diversity, equality, and gender pay gap monitoring, employment, and health and safety);
- for tax and accounting purposes, including transferring personal data to HM Revenue and Customs to ensure that you have paid appropriate amounts of tax, and in respect of any Gift Aid claims, where relevant;
- for the prevention and detection of crime, and to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.
(IV) SPECIAL CATEGORIES OF DATA
We process special categories of personal data (such as data concerning health, religious beliefs, racial or ethnic origin, sexual orientation or union membership) or criminal convictions and allegations for the reasons set out below.
We will process this data on the basis that such processing is necessary to carry out obligations and exercise rights (both yours and ours) in relation to your employment.
We process the following types of special category personal data for the following reasons:
- your physical or mental health or condition(s) to record sick leave and take decisions about your fitness for work, or (in emergencies) act on any medical needs you may have;
- recording your racial or ethnic origin to monitor our compliance with equal opportunities legislation;
- categories of your personal data which are relevant to investigating complaints made by you or others, for example concerning discrimination, bullying or harassment;
- data about any criminal convictions or offences committed by you, for example when conducting criminal background checks with the DBS, or where it is necessary to record or report an allegation (including to police or other authorities, with or without reference to you);
We will process special categories of personal data for lawful reasons only, including because:
- you have given us your explicit consent to do so, in circumstances where consent is appropriate;
- it is necessary to protect your or another person's vital interests, for example, where you have a life-threatening accident or illness in the workplace and we must process your personal data in order to ensure you receive appropriate medical attention;
- it is necessary for some function in the substantial public interest, including the safeguarding of children or vulnerable people, or as part of a process designed to protect others from malpractice, incompetence or unfitness in a role (or to establish the truth of any such allegations); or
- it is necessary for the establishment, exercise or defense of legal claims, such as where any person has brought a claim or serious complaint against us or you.
SHARING YOUR INFORMATION WITH OTHERS
For the purposes referred to in this privacy notice and relying on the bases for processing as set out above, we may share your personal data with certain third parties. We may disclose limited personal data (including in limited cases special category or criminal data) to a variety of recipients including:
- other employees, agents and contractors (eg third parties processing data on our behalf as part of administering payroll services, the provision of benefits including pensions, IT etc. – although this is not sharing your data in a legal sense, as these are considered data processors on our behalf);
- DBS and other relevant authorities and agencies such as the Department for Education, NCTL, the ICO, and the local authority;
- other schools in the Inspired Group];
- external auditors or inspectors;
- our advisers where it is necessary for us to obtain their advice or assistance, including insurers, lawyers, accountants, or other external consultants;
- third parties and their advisers in the unlikely event that those third parties are acquiring or considering acquiring all or part of our business, or we are reconstituting or setting up some;
- when the school is legally required to do so (by a court order, government body, law enforcement agency or other authority of competent jurisdiction), for example HM Revenue and Customs or police.
We may also share information about you with other employers in the form of a reference, where we consider it appropriate, or if we are required to do so in compliance with our legal obligations.
HOW LONG YOUR INFORMATION IS KEPT
Personal data relating to unsuccessful job applicants is deleted within 6 months of the end of the application process, except where we have notified you we intend to keep it for longer (and you have not objected).
For employees, subject to any other notices that we may provide to you, we may retain your personal data for a period of no less than 7 years after your contract of employment (or equivalent agreement) has expired or been terminated.
However, some information may be retained for longer than this, for example incident reports and safeguarding files, in accordance with specific legal requirements. Please see our Retention of Records policy.
Please see our Reddam House Berkshire Privacy Notice which has details of your rights as a 'data subject', which are the same as if you were any member for the public. You can find out more about your rights under applicable data protection legislation from the Information Commissioner’s Office website available at www.ico.org.uk.
The school will update this Staff Privacy Notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.
CONTACT AND COMPLAINTS
If you have any queries about this privacy notice or how we process your personal data, or if you wish to exercise any of your rights under applicable law, you may contact the Business Manager.
If you are not satisfied with how we are processing your personal data, or how we deal with your complaint, you can make a complaint to the Information Commissioner: www.ico.org.uk. The ICO does recommend you seek to resolve any issues with the data controller initially prior to any referral.