PRIVACY NOTICE FOR WATFORD GRAMMAR SCHOOL FOR GIRLS OLD GRAMMARIAN ALUMNAE (OGA)
Watford Grammar School for Girls OGA collects data and information about our pupils (current and former), staff (current and former) and friends of the school – our ‘school community’ – so that we can run effectively as a part of the school’s work. This privacy notice explains how and why we collect data, what we do with it and what rights data subjects have with regard to this data.
Watford Grammar School for Girls is an Academy Trust school, company number 07348254, registered office at Lady’s Close, Watford, WD18 0AE, registered as a company in England and Wales, and an exempt charity. We are well known for our rich academic curriculum, our strong and supportive pastoral care, and the wide range of extended activities that, taken as a whole, educate, encourage and empower our girls. The school motto is Sperate Parati - or ‘Go forward with preparation’ - which encapsulates our aim for every member of the school community.
We are proud of the strong academic traditions and the importance of service to others that have shaped the ethos of our school since its foundation by Elizabeth Fuller in 1704. We value hard work and nurture scholarship, always encouraging our girls to achieve excellence in all fields of study. The girls have the opportunity to excel at music, drama and sport, as well as to play an active role in the wider community by taking part in many charitable activities. Thus they learn to be their best selves: hard working, compassionate and high achieving in all areas of life.
We are a diverse and thriving community, founded on consideration, toleration and trust. Each girl is given opportunities to develop confidence and resilience both in and outside the classroom, and to develop a sense of personal responsibility that is best summarised in the maxim ‘I can do it, and I will do it' - words which every member of the school learns and takes to heart.
As part of ensuring the effective running of our school we support our school community staying in touch with the school and with fellow community members – through the Old Grammarian Alumnae (OGA) organisation. In order to do this, we need to hold and use data and information about our school community. It is important to us that we do this professionally and in line with our statutory, moral and contractual obligations, and this notice is part of how we explain how we do this. Legally the school is a Data Controller under the Data Protection Act 2018 / the General Data Protection Regulation with respect to the OGA and to its website, the School is registered as such with the Information Commissioner, and the responsible officer at the school is Zia Rehman who is Data Protection Officer.
Why do we collect and use information as part of the work of the Old Grammarian Alumnae?
Under the General Data Protection Regulation (GDPR) / Data Protection Act 2018, which comes into force on 25 May 2018, the school as Data Controller must have a lawful basis (under Article 6 of the GDPR/ Data Protection Act 2018) for all its collection and use of data, and make that clear as part of this notice.
We collect and use information about our school community under the following lawful basis:
- where we have the consent of the data subject - and please note that in line with best practice it is considered that children under 13 cannot give their own consent;
- where it is necessary for compliance with a legal obligation;
- where processing is necessary to protect the vital interests of the data subject or another person;
- where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- we have explicit consent;
- processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; and / or
- processing is necessary for reasons of substantial public interest, on the basis of UK, European Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
We use the data which we collect from or about members of our school community to support the work of the OGA, via the OGA website or otherwise, and in particular:
- to provide services that you request as part of signing up to or visiting our website, or to membership of the OGA, including updating you on any changes or improvements to the service, and staying in touch;
- creating your user profile;
- subscribing you to any of our newsletters that you request;
- to support your participation in discussion boards or forums as and when you wish to participate;
- to enter you in a competition or facilitate your participation in a survey or other activity which you wish to participate in;
- to provide you with products, services or content where you have specifically requested this (please note that we only use your data for marketing purposes if you have specifically consented to this)
- if and when you ever report a problem with our website
The categories of OGA member information that we collect, hold and share include:
- Personal information (such as name, contact details, dates at the school, qualifications) which are provided at the start of your participation in the OGA and which you may update or add to from time to time;
- Information about any interests or career you have developed and you tell us about;
- Information relating to your participation in and preferences for activities run by the OGA
- Information related to your use of the OGA site, in particular IP address, web browser type, URLs of websites viewed before and after viewing the OGA site. Please note that this information is normally fully anonymised and therefore does not constitute personal data for the purposes of this Privacy Notice – we include this note here in the interest of transparency
Consent to the OGA’s processing of personal data
When you participate in the OGA’s activities, use or sign up to its website, or to membership by any other means, you consent to us processing the personal data you provide. You may withdraw consent at any time. We will record how and where consent is given or declined, usually via our external provider’s website consent preference management system.
Where OGA members are under 18, they are deemed to be old enough to make their own decisions in relation to their personal data usually around the age of 13.Although OGA membership is usually taken up towards or after the end of the time a pupil spends at the School, we wish to take a collaborative approach with parents and we will keep parents informed if we are approaching children for consent from the age of 13-16.Children with the maturity to make their own decisions about their personal data may withdraw consent if consent has previously been given.
Retention of OGA data
The school holds all data for the periods outlined in our Data Retention Policy, including for some periods of time after a member of our school community leaves the school or leaves membership of the OGA. A copy of this policy can be obtained upon request from the Data Protection Officer. Data retention is carried out in line with the best practice promoted by relevant professional bodies, and currently follow the data retention guidelines in the Information and Records Management Society (www.irms.org.uk) Toolkit for Schools.
The bulk of our OGA data is stored electronically. Data stored electronically may be saved on a cloud based system which may be hosted overseas, including outside of the EU. If this happens we will take steps to ensure that the data is managed and protected as if it were covered by the same protections which apply in the UK/EU.
Personal data may be transferred to other countries, including countries outside the European Union, for specific essential purposes – if, for example, we are arranging a school trip overseas including to non-EU countries.Appropriate steps will be taken to keep the data secure.
Who do we share OGA member information with?
We will only share information in line with the consents you give us as you sign up to join the OGA or use the OGA website, or as you amend or add to these from time to time. If you do not use the website, you can check or amend your consents by emailing firstname.lastname@example.org
We will normally share information about you with other members of the OGA in line with the principles and objectives of running the organisations. You have the right to ask us not to do this.
The OGA website is provided by an external contractor, and as part of this service they are also a Data Controller in their own right in which case we will be jointly controllers of your personal data and may be jointly liable in the event of any data breaches. The current provider is Toucan Tech (https://www.toucantech.com) .
Please note that if you use the OGA website and you choose to use access parts of it via setting a user account and password, you are responsible for keeping your password safe and secure. We ask you not to share it with anyone.
Please see the School’s Information Security Policy for further information on how we keep information and data in our care secure.
A copy of the Information Security notice provided by Toucan (operators of our OGA software) can be obtained on request from the Data Protection Officer, Zia Rehman.
Please note that we reserve the right to review messages sent through the OGA website for security monitoring purposes.
Requesting access to your personal data
Under data protection legislation, members of the OGA have the right to request access to information about them that we hold (“Subject Access Request”). From the age of 13, we generally regard children as having the capacity to exercise their own rights in relation to their personal data. This means that where we consider a children to have sufficient maturity to understand their own rights, we will require a Subject Access Request to be made by the child and not their parent(s) on their behalf. This does not affect any separate statutory right parents might have to access information about their child.
Subject to the section below, the legal timescale for the School to respond to a Subject Access Request is one calendar month. As the School has limited staff resources outside of term time, we encourage OGA members to submit Subject Access Requests during term time and to avoid sending a request during periods when the School is closed or is about to close for the holidays where possible. This will assist us in responding to your request as promptly as possible. For further information about how we handle Subject Access Requests, please see our Data Protection Policy.
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
You also have the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress;
- prevent processing for the purpose of direct marketing;
- object to decisions being taken by automated means;
- in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
- claim compensation for damages caused by a breach of our data protection responsibilities.
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance, or if you need to contact the Information Commissioner’s Office directly please visit https://ico.org.uk/concerns/
RIGHT TO WITHDRAW CONSENT
In the circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent please contact the Data Protection Officer. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
CHANGES TO THIS PRIVACY NOTICE
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information
If you would like to discuss anything in this privacy notice, please contact the Data Protection Officer, Zia Rehman, at the school.