DATA PROTECTION - PRIVACY NOTICE FOR PUPILS, PARENTS AND OLD ALLEYNIANS

Last updated 2018

1. Introduction

This Privacy Notice explains how Dulwich College uses (or “processes”) the personal information (or data) of members of current, prospective and former pupils and parents (including guardians). This notice is provided in accordance with the rights of individuals under Data Protection Law to understand how their data is used. 

There is a separate privacy notice for DUCKS.

This Privacy Notice applies alongside any other information the College may provide about a particular use of personal data, for example when collecting data via an online or paper form.This Privacy Notice also applies in addition to the College's other relevant terms and conditions and policies, including:

• any contract between the College and the parents of pupils;
• the College's policy on taking, storing and using images of children;
• the College’s CCTV policy;
• the College's safeguarding and health and safety policies; and
• the College's IT policies (including its Acceptable Use policies).

‍Anyone who works for, or acts on behalf of, the College (including employees, casual workers, volunteers, governors, agency workers, peripatetic staff, self-employed contractors and individuals working for the College via service companies owned by them) should also be aware of and comply with this Privacy Notice. 

‍The Clerk to Governors will deal with all requests and enquiries concerning the College’s use of your personal data and endeavour to ensure that all personal data is handled in accordance with this Privacy Notice and Data Protection Law. The Clerk’s contact details are set out at the end of this document.

This Privacy Notice will be updated by the College from time to time. The latest version will be available in the policies section of the College’s website.

‍2. Why the College needs to process personal data

‍The College needs to process a wide range of personal data about individuals (including current, past and prospective pupils and parents) as part of its daily operation.

Some of this activity the College will need to carry out in order to fulfil its legal rights, duties or obligations, including those under the contract made between parents and the College for the education of a pupil (“the Parent Contract”).

Other uses of personal data will be made in accordance with the College’s legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals and provided it does not involve special or sensitive types of data. The College expects that the following uses fall within the category of its (or its community’s) “legitimate interests”:

• For the purposes of pupil selection (and to confirm the identity of prospective pupils and their parents);
• To provide education services to pupils (including sports and co-curricular activities, wellbeing provision, library facilities and career services);
• To monitor pupils' progress and educational needs;
• To maintain relationships with our alumni (Old Alleynians) and the College community, including direct marketing and fundraising activity;
• For the purposes of donor due diligence, and to confirm the identity of prospective donors and their background and relevant interests;
• For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as tax and gender pay gap analysis);
• To conduct parent and pupil surveys (whether across the whole parent or pupil body or selectively) and to consult with parents and pupils (either the whole parent or pupil body or selected groups or individuals);
• To enable relevant authorities to monitor the College's performance and to intervene or assist with incidents as appropriate;
• To give and receive information and references about past, current and prospective pupils (including relating to outstanding fees or payment history) to/from any educational institution that the pupil attended previously or that it is proposed they attend in the future;
• To provide references to potential employers;
• To assess the financial position of a family applying for bursarial or other financial assistance and in connection with debt recovery;
• To enable pupils to take part in national and other assessments, and to publish the results of public examinations and other achievements of pupils of the College;
• To safeguard pupils' welfare and provide appropriate pastoral care;
• To monitor (as appropriate) use of the College's IT and communications systems in accordance with the College's IT Acceptable Use Policies;
• To make use of photographic images of pupils (including films) in College publications, on the College website and (where appropriate) on the College's social media channels and various regular and ad hoc publications, in accordance with the College's policy on taking and using images of children;
• For security purposes, including CCTV in accordance with the College’s CCTV policy;
• To carry out or co-operate with any internal or external complaints, disciplinary or investigation process;
• For the purposes of processing orders placed in the school shop (the Commissariat); and
• Where otherwise reasonably necessary for the College's purposes, including to obtain appropriate professional advice and insurance for the College.

‍In addition, the College will on occasion need to process special category personal data1 (including medical information) or criminal records information (such as when carrying out DBS checks) in accordance with rights or duties imposed on it by law, including as regards safeguarding and employment, or from time to time with explicit consent where required. These reasons will include:

• To safeguard pupils' welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual's medical condition or other relevant information where it is in the individual's interests to do so: for example for medical advice, for social protection, safeguarding and co-operation with the police or social services, for insurance purposes or to caterers or organisers of College trips (who may, for example, need to be made aware of dietary or medical needs);
• To provide educational services in the context of any special educational needs of a pupil;
• To provide spiritual education in the context of any religious beliefs;
• To run any of its systems that operate on biometric data, such as for security and other forms of pupil identification;
• As part of any internal or external complains, disciplinary or investigation process that involves such data (for example, if there are SEN, health or safeguarding elements); or
• For legal and regulatory purposes (for example child protection, diversity monitoring and health and safety) and to comply with its legal obligations and duties of care.

3. Types of personal data processed by the College

This will include by way of example: 
‍
• names, addresses, telephone numbers, e-mail addresses and other contact details;
• car details (about those who use our car parking facilities);
• bank details and other financial information, e.g. about parents who pay fees to the College;
• past, present and prospective pupils' academic, disciplinary, admissions and attendance records (including information about any special needs), and examination scripts and marks;
• where appropriate, information about individuals' health and welfare, and contact details for their next of kin;
• references given or received by the College about pupils, and relevant information provided by previous educational establishments and/or other professionals or organisations working with pupils;
• correspondence with and concerning current and former pupils and parents; and
• images of pupils (and occasionally other individuals) engaging in College activities, and images captured by the College's CCTV system (in accordance with the College's policy on taking and using images of children).

4. How the College collects data 

Generally, the College receives personal data from the individual directly (including, in the case of pupils, from their parents). This may be via a form, or simply in the ordinary course of interaction or communication (such as email or written assessments). 

However, in some cases personal data will be supplied by third parties (for example another College, or other professionals or authorities working with that individual) or collected from publicly available resources.

5. Who has access internally 

For the most part, personal data collected by the College will remain within the College and will be processed by appropriate individuals only in accordance with access protocols. Particularly strict rules of access apply in the context of:

• medical records held and accessed only by the College doctor and appropriate medical staff (information in medical records only being shared with other members of staff when our medical staff deem it necessary for pastoral or safeguarding purposes or otherwise with express consent); and
• safeguarding files.

‍In the case of pupils with Special Educational Needs, a certain amount of relevant information will need to be provided to staff more widely in the context of providing the necessary care and education that the pupil requires.6. Sharing with third partiesIn the course of running the College, we need to share personal data (including special category personal data where appropriate) with third parties, including:

• self-employed contractors and contractors working for the College via service companies owned by them;
• peripatetic teachers (including visiting music and drama teachers) and other self-employed staff (including self-employed sports coaches);
• the school doctor and other medical practitioners (including hospitals and dentists) and physiotherapists; • speech and language therapists and occupational therapists;
• educational psychologists;
• other schools (e.g. for the purposes of joint activities, sports matches etc) and colleges; • sports bodies and umpires/referees;
• universities and UCAS;
• exam boards;
• travel companies and transport providers (including air lines);
• competition organisers;
• overseas exchange organisers and host families;
• work placement providers and prospective employers;
• governmental and regulatory bodies (e.g. Social Services, UK Visas and Immigration, HM Revenue and Customs, the Department for Education, the Independent Schools Inspectorate, the Charity Commission, the Health & Safety Executive, the Information Commissioner and the Teaching Regulation Agency);
• Premium Credit Ltd (if you participate in School Fee Plan’s finance arrangement for payment of school fees in monthly instalments);
• the police and other emergency services; and
• the College’s professional advisors (e.g. auditors, lawyers and insurance brokers) and insurers.

‍Staff, pupils and parents are reminded that the College is under duties imposed by law and statutory guidance (including Keeping Children Safe in Education) to record or report incidents and concerns that arise or are reported to it, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness in their nature or regularity. This is likely to include file notes on personnel or safeguarding files, and in some cases referrals to relevant authorities such as social services or the police. For further information about this, please view the College’s Safeguarding Policy. 

In common with many other schools, the College provides parents with the names, dates of birth and parent contact details of other children in their child’s class or year. Disclosure in this case is only done with the explicit consent of the parents i.e. we only disclose the details of parents who have given explicit consent to their details being shared with other parents.

7. The Alleyn Club and the Hollington Trust 

We share personal data about Old Alleynians (OAs) with the Alleyn Club (the College’s alumni body). In addition, we share personal data about OAs who are supporters of the DCM Hollington Trust2 with the DCM Hollington Trust. The College provides administrative support to the Alleyn Club and the DCM Hollington Trust.

8. International Transfers 

Some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA")3, for example where you live outside the EEA, or where the pupil is going on a school trip outside the EEA or where personal data is processed by one of our suppliers who is based outside the EEA or who uses data storage facilities outside the EEA. A number of the College’s IT systems are provided by third parties who are based or use servers outside the EEA (eg providers of hosted databases, websites, school post system, school portal, cloud storage and management information systems). 

While some countries have adequate protection for personal data under applicable laws, in other countries steps will be necessary to ensure appropriate safeguards apply to it. These include imposing contractual obligations of adequacy or requiring the recipient to subscribe to or be certified with an international framework of protection. 

9. How long we keep personal data 

The College will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason. 

In the schools’ sector, the usual legal recommendation for how long to keep ordinary pupil personnel files is up to seven years following departure from the school. However, incident reports and safeguarding files may need to be kept much longer, in accordance with specific legal or regulatory requirements from time to time. At the present time, however, schools are being advised to retain historic records pending completion of IICSA4. 

If you have any specific queries about how our retention policy is applied or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact the Clerk to Governors at the College. However, please bear in mind that the College will often have lawful and necessary reasons to hold on to some personal data even following such request. A limited and reasonable amount of information will be kept for archiving purposes. 

Even where you have requested we no longer keep in touch with you, we will need to keep a record of that fact in order to fulfil your wishes (called a “suppression record”).

10. Keeping in touch and supporting the College

The College will use the contact details of parents, Old Alleynians and other members of the College community to keep them updated about the activities of the College and Old Alleynians, parent events and other events of interest (including by sending updates and newsletters, by email and by post). 

Unless the relevant individual objects, the College will also: 

• Share personal data about Old Alleynians with the Alleyn Club;
Contact parents and/or Old Alleynians by post and email in order to promote and raise funds for the College and, where appropriate, other worthy causes;
• Collect information from publicly available sources about parents' and former pupils' occupation and activities, in order to maximise the College's fundraising potential.

‍We may use profiling and screening techniques (using publicly available data about you or information that you have provided to us) to target our fundraising resources effectively and to ensure communications are relevant and timely. They can help us to make appropriate requests of donors and potential donors, thus enabling us to raise more funds, sooner, and more cost-effectively than we otherwise would.

Should you wish to limit or object to any such use, or would like further information about them, please contact the Clerk to Governors (whose contact details are at the end of this document). 

The Development Office’s Privacy Notice provides more specific information about their handling of personal data and is available in the policies section of the College website. 

11. Your rights 

Individuals have various rights under Data Protection Law to access and understand personal data about them held by the College, and in some cases ask for it to be erased or amended or have it transferred to others, or for the College to stop processing it (subject to certain exemptions and limitations). 

The College will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time-limits (which is one month in the case of requests for access to information). The College will be better able to respond quickly to smaller, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, the College may ask you to reconsider or require a proportionate fee (but only where Data Protection Law allows it).

You should be aware that the right of access is limited to your own personal data and certain data is exempt from the right of access. This will include information which identifies other individuals (and parents need to be aware that this may include their own children in certain limited situation, see further below), or information which is subject to professional privilege (for example, legal advice given to or sought by the College or documents prepared in connection with a legal action). 

The College is also not required to disclose any pupil examination scripts or other information consisting solely of pupil tests answers, nor to provide examination or other test marks ahead of any ordinary publication, not share any confidential reference given by the College itself for the purposes of the education, training or employment of any individual.

You may have heard of the “right to be forgotten” (or right of “erasure”). We will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing your (or your child’s) personal data, for example, a legal requirement or where it falls within a legitimate interest identified in this Privacy Notice. All such requests will be considered on their own merits and on a case by case basis.

12. Subject Access Requests 

Pupils can make subject access requests for their own personal data, provided that, in the reasonable opinion of the College, they have sufficient maturity to understand the request they are making (see the section below “Whose Rights”). 

A pupil of any age may ask a parent or other representative to make a subject access request on his/her behalf. Indeed, while a person with parental responsibility will generally be expected entitled to make a subject access request on behalf of younger pupils, the information in question is always considered to be the child’s at law. For older pupils, the parent making the request may need to evidence their child’s authority for the request. 

Pupils aged 13 and above are generally assumed to have the requisite level of maturity to make a subject access request themselves, although this will depend on both the child and the personal data requested, including any relevant circumstances at home. Children younger than 13 may be sufficiently mature to have a say in this decision. 

The statutory rules on subject access are not the sole basis on which information requests are handled. Parents may not have a statutory right to information but they and others may have a legitimate interest or expectation in receiving certain information about their child (with or without the child’s consent). The College may consider that there are lawful grounds for sharing information with or without reference to the child. 

Parents in general will receive academic and pastoral updates about their children, in accordance with the Parent Contact. Where parents are separated, the College will in most cases aim to provide the same information to each person with parental responsibility but will need to factor to in all the circumstances, including the express wishes of the child and the child’s best interests. 

All information requests from, on behalf of or concerning pupils (whether or not made as a statutory subject access request) will be considered on a case by case basis. 

13. Consents 

Where the College has obtained your specific consent to process personal data for a particular purpose, you may withdraw this consent at any time. Please be aware however that the College may have another lawful purpose for which to process the personal data in question even without your consent. That reason will usually have been asserted under this Privacy Notice or may otherwise exist under some form of contract or agreement with you. 

14. Whose rights 

The rights under Data Protection Law belong to the individual to whom the data relates. 

The College will often in practice rely on parental authority or notice for the necessary ways it processes personal data relating to pupils (e.g. under the Parent Contract or via a separate document). Parents and pupils should be aware that for legal purposes this is not necessarily the same as the College relying on strict consent. 

Where consent is required, it may in some cases be necessary or appropriate (given the nature of the processing in question, and the pupil's age and understanding) to seek the pupil's consent. Parents should be aware that in such situations they may not be consulted (depending on the interests of the pupil and all other relevant circumstances).

In general, the College will assume that a pupil’s consent is not required for ordinary disclosure of their personal data to their parents (e.g. for the purposes of keeping parents informed about the pupil's activities, progress, behaviour and welfare) unless, in the College's opinion, there is a good reason to do otherwise. 

However, where a pupil seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, the College may be under an obligation to maintain confidentiality, unless, in the College's opinion, there is a good reason to do otherwise (e.g. where the College believes disclosure will be in the best interests of the pupil or other pupils, or if required by law). 

Staff and pupils are required to respect the personal data and privacy of others, and to comply with the College's acceptable use policies. 

15. Data accuracy and security 

The College will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals should notify the College of any significant changes to important information, such as contact details, held about them. 

The College will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to College systems. Staff will be made aware of their duties under Data Protection Law and receive relevant training. 

16. Queries and complaints 

If you have any query about this Privacy Notice or believe that the College has breached the data protection legislation, please notify the Clerk to Governors, Dulwich College, Dulwich Common, London SE21 7LD. Telephone: 0208 299 9306. Email: legal@dulwich.org.uk

‍You also have the right to take any complaints about how we process your personal data to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (Tel: 0303 123 1113 Website: www.ico.org.uk/concerns). Please note that the ICO recommends that steps are taken to resolve matters with the relevant organisation first, before involving the ICO.


_________________
1 Special category data is information about an individual’s race, ethnic origin, politics, religion, trade union membership,health, genetics, biometrics (where used for ID purposes), sex life or sexual orientation.
2 The DCM Hollington Trust (charity number 233862) owns the premises of the Hollington Youth Club in Camberwell, as wellas a portfolio of investments built up from Dulwich College Mission collections and from OA donations and legacies. The Clubwas founded by the College in 1893.
3 The EEA comprises the countries in the European Union and Iceland, Liechtenstein and Norway.
4 Independent Inquiry into Child Sex Abuse