This Privacy Notice applies to personal data processed in connection with our educational services, students, parents, and related activities.
For information about how we process personal data through our website, including cookies and analytics, please refer to our Website Privacy and Cookie Notice.
Privacy Notice (General)
Outline
This Privacy Notice applies to all personal data and information processing activities performed by St. Andrew’s College Language Schools and subsidiary organisations, societies, and clubs. For this policy all these organisations will be termed “St. Andrew’s College Language Schools”.
St. Andrew’s College Language Schools reserves the right to modify this Privacy Notice at any time. Please review it occasionally. If St. Andrew’s College Language Schools makes changes to its Privacy Policy, the updated Privacy Notice will be published in a timely manner and if it makes material changes, it will provide a prominent notice or communicate any changes to draw attention to such changes.
Introduction
St. Andrew’s College Language Schools is a data controller for the purposes of data protection.
St. Andrew’s College Language Schools processes data in accordance with current data protection legislation and this notice is designed to give you information about how and why we process personal data as well as what types of personal data is involved.
St. Andrew’s College Language Schools acts as the Data Controller for the personal data it processes. The Managing Director has overall responsibility for data protection compliance.
The organisation has appointed Data Protection Officers (DPOs) from within the organisation to oversee compliance with data protection legislation, policies, and procedures. The DPOs operate with appropriate independence and report to senior management.
This privacy notice applies in addition to the other documents that provide information about data protection, such as our Data Protection Policy, ICT Policy, or other specific contracts.
Why do we process personal data?
St. Andrew’s College Language Schools processes relevant personal data regarding members of staff, applicants for vacancies, volunteers, visitors, students, parents, families, customers, and suppliers as part of its day-to-day operations, objectives, statutory obligations and interests as follows:
- The selection and admission of students.
- The provision of education and related service to students and parents, including students’ records, results and reports, trips, activities, sports, matches, exams, curriculum, timetable, student and teacher exchanges and guidance.
- Operation, administration and support of the St Andrew’s College Language Schools mobile application, including user accounts, communication, safeguarding, educational delivery, and system security.
- The safeguarding of students, provision of pastoral and medical care and services.
- Compliance with legislation, regulation, inspection, and audit including Subject Access Requests under data protection legislation.
- Operational Management, including visitors, general administration, procurement of goods and services, management of property and assets, rentals, catering, campus security, health and safety, fire risk management and building maintenance.
- Selection and employment of staff including volunteers, temporary staff, and contract staff, including Disclosure and Barring Service (DBS) checks and PVG Scheme memberships.
- Ongoing management of staff, including vacations, absences, performance reviews, salaries, disciplinary records, and statutory reporting.
- Alumni management, networking, and communication.
- Fundraising activities.
- Management of clubs and societies.
- Promotion of St. Andrew’s College Language Schools.
- Financial management, including debtors, creditors, fees, invoices, accounts, fiscal management, and bursary applications.
- Commercial activities, including marketing, managing customers, events, insurance.
Types of Personal Data processed
St. Andrew’s College Language Schools processes personal data about:
- Prospective, current, and past students and their parents, guardians, or fee payers.
- Staff including full time staff, job applicants, volunteers, and contract staff.
- Customers and visitors, including adults and children attending Summer School courses, sports club members, events.
- Suppliers, contractors, and service providers.
- The personal data we process may be factual, opinion, images, video, or other recorded information and may be held in a variety of forms, digital, paper, film etc.
- Examples of the type of data we process are:
- Titles and names.
- Addresses, telephone numbers, email addresses and other contact details.
- Password and Visa details.
- Admissions related information, references, academic, co-curricular activities, interests, and achievements.
- Mobile application data including account details, login activity, usage data, device identifiers, communications, and uploaded content.
- Pastoral, health and special needs, attendance, and disciplinary records.
- Exam scripts, marks, and reports.
- Education and employment information including references and referees, performance reviews, disciplinary records.
- Security photographs and access information or access logs.
- Visitor logs.
- Financial information.
- Training records, including courses, conferences, activities, and meetings attended.
- Personal vehicle details, including vehicle registrations, proof of licence entitlements, proof of insurance.
- Correspondence between staff, students, parents, and other individuals.
- Contracts.
- Login credentials, email addresses and other system identifiers.
- Digital access and other logs, including web logs, system audit logs, firewall logs.
- The legal basis for processing this data is typically fulfilment of contract or legitimate interest. In some exceptional cases St. Andrew’s College Language Schools relies on consent to process this data.
- Andrew’s College Language Schools also processes sensitive personal data when necessary for legal requirements where it is in the best interest of the data subject. Sensitive data may include:
- Pastoral, physical, or mental health.
- Medical
- Ethnicity and religion.
The lawful bases we rely on include:
- Performance of a contract
- Compliance with a legal obligation
- Legitimate interests
- Consent (where specifically required)
- Vital interests (in safeguarding or emergency situations)
In very specific cases we process ‘special category’ data; Enhanced DBS checks or PVG Scheme memberships are required for all staff and unsupervised contractors. Where convictions or adverse findings are present that data is used as part of a risk assessment.
Collection of personal data
The collection points for this most of this personal data are paper or digital forms.
Some data is provided by third parties, such as references for staff, exam boards or the disclosure and barring service for DBS checks and PVG scheme memberships.
Other personal data is collected during the course of normal operations of running St. Andrew’s College Language Schools.
Personal data collection has been reviewed and St. Andrew’s College Language Schools does not process personal data that is not required for a specific purpose and in most cases provides specific privacy notice detail on individual forms, especially those where consent is the legal basis.
Mobile Application Use
St. Andrew’s College Language Schools provides a mobile application for students and group leaders.
The app is owned and controlled by the organisation. Personal data processed via the app may include account details, communications, usage data, and educational information.
This processing is carried out for the purposes of delivering educational services, safeguarding students, communication, and operational management.
Where required, appropriate consent (including parental consent for children) is obtained prior to use.
Access to and sharing personal data
Personal data processed by St. Andrew’s College Language Schools remains within St. Andrew’s College Language Schools and is processed by appropriate members of staff for the purpose for which it was collected. Technical and procedural steps, processes and procedures are in place to protect access to physical and digital personal data.
St. Andrew’s College Language Schools does not sell personal data. In some cases, we may be required to disclose personal data, for example statuary reporting of health and safety incidents, safeguarding incidents where external organisations are involved, and the emergency services and in other lawful and legitimate cases.
St. Andrew’s College Language Schools may rely on external data processors for some systems and services and ensures that compliant contracts are in place.
St. Andrew’s College Language Schools shares data where necessary for third parties, including:
Other schools to facilitate trips, events and sport events and matches.
Examination boards.
Commercial organisations such as campuses, hotels, travel companies etc.
Safeguarding hubs, emergency services.
UK Visas and Immigration.
In some circumstances we may publish, in a restricted way, personal data or sensitive personal data, allergy or other medical conditions for example, where having that information freely available to relevant staff is clearly in the best interest of the data subject.
Retention periods for personal data
St. Andrew’s College Language Schools retains personal data for differing periods of time for different purposes as required by statute or best practice. Individual departments incorporate retention times into the processes and manuals. Other statutory obligations, legal processes and enquiries may also necessitate the retention or extended retention of certain data.
In general, we keep personal data for no longer than is required for the purpose for which it was collected, some exceptions are:
St. Andrew’s College Language Schools Archive, some personal data of historic value, including photographs, school photographs, historical student lists and may be archived in perpetuity.
Rights in respect of personal data
GDPR expands the rights of data subjects over previous legislation, specifically data subjects have the right:
Of Access – the right to be informed of and request access to the personal data we process about you.
To Rectification – the right to request that we amend or update your personal data where it is inaccurate or incomplete.
To Erasure – the right to request that we delete your personal data.
To Restrict – the right to request that we temporarily or permanently stop processing all or some of your personal data.
To Object –
the right, at any time, to object to us processing your personal data on grounds relating to your situation.
the right to object to your personal data being processed for direct marketing purposes.
To Data Portability – the right to request a copy of your personal data in electronic format and the right to transmit that personal data for use in another party’s service.
To be subject to Automated Decision making – the right to not be subject to a decision based solely on automated decision making, including profiling, where the decision would have a legal effect on you or produce a similarly significant effect.
This Privacy Notice is published as part of these rights. If you wish to exercise any of these rights, except for the right to access, please contact St. Andrew’s College Language Schools department processing that information in the first case. Information on the right of access and how to exercise that are specifically detailed in St. Andrew’s College Language Schools’ Data Protection Policy.
Please note that not all rights are applicable to all processing of personal data, depending on the lawful basis that personal data is being processed under.
Contacts
If you have any issues relating to data protection relating to St. Andrew’s College Language Schools, or you feel like St. Andrew’s College Language Schools has not respected your rights or wishes in respect of data protection, please contact the Data Controller or the Data Protection Officer in writing at [email protected].