PRIVACY NOTICE

Last updated: August 2022

Introduction
Fettes College is a company incorporated under the Companies Acts (Company Number SC719759) and a registered Scottish Charity, No SC051259.

This Privacy Notice sets outs how the School and the other organisations and affiliates within the School’s group (collectively referred to as “the School”, “We”, “Us”, “Our”) use your information. The organisations within the group, who are all Data Controllers in their own right, include:

• The Fettes Foundation
• The Old Fettesian Association
• Fettes Enterprises

‍The School is a Data Controller for the purposes of Data Protection Law (the Data Protection Act2018, the UK General Data Protection Regulation and any legislation that, in respect of the United Kingdom, replaces, or enacts into United Kingdom domestic law, the Privacy and Electronic Communications Regulations or any other law relating to data protection) which means it determines how an individual’s personal data is processed and for what purposes.

Our purpose
Fettes College aims to promote and provide for the advancement of education of children, regardless of their circumstances, which it does by operating the School of Fettes College as an independent boarding and day school for boys and girls aged between 7-18 and its affiliate organisations.
‍
Some of this activity the College will need to carry out in order to fulfil its legal rights, duties or obligations, including those under the contract made between parents and the College for the education of a pupil (“the Parent Contract”).

About this Notice
This Notice is intended to provide information about how the School will use (or "process") personal data about individuals including: its personnel, its current, past and prospective pupils and their parents, carers or guardians (referred to in this Notice as "parents").

This information is provided in accordance with the rights of individuals under Data ProtectionLaw to understand how their data is used. School personnel, parents and pupils are all encouraged to read this Privacy Notice and understand the School’s obligations to its entire community.

This Privacy Notice also applies in addition to the School's other relevant notices and policies, including:
‍
• any contract between the School and its staff or the parents of pupils;
• the School's policy on taking, storing and using images;
• the School’s policy on the use of CCTV;
• the School’s retention policy;
• the School's safeguarding and pastoral policies;
• the School’s Health and Safety policy, including how concerns or incidents are recorded;
• the School's IT policies

‍Whose data we collect
We collect data relating to individuals who fall into one or more of the categories listed below. This list is not exhaustive and represents the current, former and prospective stages of each category in the list:
‍
• Pupils
• Parents
• Staff
• Volunteers
• Donors
• Suppliers and contractors
• Visitors

Purposes for processing personal data
In order to carry out its ordinary duties to staff, pupils and parents, the School may process a wide range of personal data about individuals (including current, past and prospective staff, pupils or parents) as part of its daily operation.

Some of this activity the School will need to carry out in order to fulfil its legal rights, duties or obligations – including those under a contract with its staff or parents of its pupils. Other uses of personal data will be made in accordance with the School’s legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on data subjects and provided it does not involve special or sensitive types of data. Examples of such interests are included below under “Examples of how we might use your information”.

In addition, the School may need to process special category personal data (concerning health, ethnicity, religion, biometric data or sexual life) or criminal records information (such as when carrying out PVG checks) in accordance with rights or duties imposed on it by law, including safeguarding and employment, or from time to time by explicit consent where required. This may include:
‍
• To safeguard pupils’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including the disclosure of details of medical details where it is in the individual's interests to do so. For example: biometric security arrangements, medical advice, social services, insurance purposes or to organisers of School trips;
• To provide educational services in the context of any special educational needs of a pupil;
• In connection with employment of its staff, for example PVG checks, welfare or pension plans;
• For legal and regulatory purposes (for example child protection, diversity monitoring and health and safety) and to comply with its legal obligations and duties of care.

Examples of how we might use your information
The below is a list of the School’s processing activities that may fall within its, or a third party’s, legitimate interests. We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
‍
How we might use your information to manage parents/pupils’ relationships with the School
• For the purposes of pupil selection (and to confirm the identity of prospective pupils and their parents);
• To provide education services, including musical education and physical training, career services, extra-curricular activities and monitoring pupils' progress and educational needs;
• To enable relevant authorities to monitor the School's performance and to intervene or assist with incidents as appropriate;
• To give and receive information and references about past, current and prospective pupils, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend; and to provide references to potential employers of past pupils;
• To enable pupils to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils of the School;
• To safeguard pupils’ welfare and provide appropriate pastoral care;
• For security purposes, including CCTV in accordance with the School’s CCTV policy;
• Where otherwise reasonably necessary for the School's purposes, including to obtain appropriate professional advice and insurance for the School;
• Sending updates from the school;
• Invitations to events and;
• Offering in house medical services, including registration with our appointed GP (for boarders)
• Promote academic and extra-curricular achievements
• Give pupils access to exercise facilities onsite which are provided by ‘Fettes Enterprises’

How we might use your information if you are a prospective, existing, or former employee
• To manage the recruitment process
• Processing PVG application forms
• Paying salaries, pension contributions and tax
• For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as diversity or gender pay gap analysis and taxation records);
• Managing leave, disciplinary actions, grievance procedures
• To provide a safe and secure working environment

The Fettes College Development Team manages the functions of the Fettes Foundation and theOld Fettesian Association, who are joint Data Controllers. Below is an example of how the Development Team might process your data. If you would like to understand these processes in more detail, please click here

How we might use your information in a fundraising context
• Send relevant updates on the fundraising activities of the School
• Send segmented appeals requesting donations
• Process single and regular donations
• Manage your previous donations to the School
• Submit Gift Aid claims to HMRC
• Preparing donor lists, Roll of Honour and volunteer lists (Hard copy and online)
• Preparing research briefs for meetings or events
• Tracking email clicks and open rates
• Source additional information using external resources

The Fettes Foundation is responsible for raising funds towards capital projects, bursaries and other philanthropic initiatives to benefit the School and its pupils. To fundraise effectively, theFoundation undertakes in-house research to prepare for meetings or to help identify individuals who may be able to give support. This information may come from any publicly available resources. From time to time, it may be necessary to engage the services of an external organisation to assist us in analysing our data. In particular, where we would like to assess the feasibility of a planned project.

How we might use your data if you are an Old Fettesian
• Sending information about events
• Sending the Old Fettesian Newsletter
• Provide access to an online alumni portal
• To keep a register of pupils who have attended the School

What information we collect
We will only store relevant data that allows us to fulfil our purposes outlined above. Data is generally collected directly from individuals when they enter into a contract with the School. Additional data is collated during an individual’s relationship with the school and may be sourced from third parties for fundraising purposes (depending on the individual’s relationship with theSchool). For more information about this please see ‘Sourcing additional information from third parties’ below.

Examples of the data we store include:
• Names, addresses, contact phone numbers, email addresses;
• Familial relationships;
• Bank details and other financial information, e.g. in respect of parents seeking Bursary assistance or to process salaries;
• Admissions and/or bursary applications, educational records, references, exam results, disciplinary records, safeguarding concerns, tutor and teacher notes;
• Where appropriate, information about individuals' health and contact details for their next of kin;
• Correspondence, attendance at meetings or events, meeting notes;
• References given or received by the School about pupils or prospective employees or
• Information provided by previous educational establishments and/or other professionals or organisations working with pupils;
• Images of pupils (and occasionally other individuals) engaging in School activities and images captured by the School's CCTV system (in accordance with the School's policies on CCTV and Taking, Storing and Using Images of pupils);
• Car details (about those who use our car parking facilities);
• Information, such as CVs relating to past, present and prospective School personnel;
• Higher education, profession, employment information;
• Affinity, engagement, giving capacity
• Biometric data
• Health/medical data
• Criminal offence data

Where your information is stored
Data is stored both electronically and in hard copy format where necessary. There are strict access policies in place where only authorised personnel can access the information they require. Data storage locations may include:

• Centralised administration databases
• Fettes network drives
• Emails
• Personal laptops, phones and iPads – may contain temporary notes that will be transferred to a central location
• Filing cabinets
• Third parties (See below for more information on data that is shared with third parties)

How we keep your information secure
All those who have access to, and are associated with the processing of, personal data are legally obliged to respect the confidentiality of any data they need to access in order to carry out their work and are obliged to process data in accordance with our internal policies outlined in ‘About this Notice’.

How long we keep your data for
A per our internal Retention Policy, we will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Sharing data with third parties
We may need to share some of your data with a third-party provider to fulfil our purposes. When we share data with a third party we will always ensure that we have the necessary contracts in place to ensure the security of your data. We will only share special category data, securely, with a third party if it is a legal obligation or in order for us to provide onsite medical care. Examples of third parties we may share data with include:

• Administrative databases
• Email marketing providers
• Direct mail service providers
• Educational service (including online) providers
• HMRC
• Local authorities
• Pension providers
• IT services including cloud storage providers
• Appointed GP Practice
• Consultancy organisations who may analyse our data
• Professional advisors

International Data Sharing
Some of our processes may require us to transfer data outside of the UK. In these instances, we will ensure that the appropriate safeguards in place to ensure an individual’s data protection rights are met.

Getting in touch
If you would like to get in touch to update your information, amend your preferences, change the way we process your information or for any general data protection enquiries, you can do so by using the following means:

Email: dataprotection@fettes.com
Post: Data Protection Enquiries, Bursar’s Office, Fettes College, Carrington Road, EH4 1QX
Phone: +44 (0) 131 332 2281

Complaints
If you feel your data has not been used in accordance with this Notice, please notify us by using the contact details outlined above. We do hope that any matters of complaint may be resolved between the complainant and the School, however, if you feel the need to leverage any complaint where there has been no satisfactory resolution in dealing directly with the School, you may contact the ICO ico.org.uk/, who are the governing body for data protection information in the UK.

Your rights
‍
Pupil data
The rights under Data Protection Law belong to the individual to whom the data relates. For the purposes of delivering our obligations under the School contract we will usually liaise with the parent and share pupil data with them relating to their child’s progress and behaviour, school activities and the general wellbeing of their child.

Where a pupil seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, we may be under an obligation to maintain confidentiality unless, in our opinion, there is a good reason to do otherwise; for example, where the school believes disclosure will be in the best interests of any pupil or is required by law.

How to find out if we are processing your data and request a copy of your information
You have the right to ask if your data is being processed by us and the right to ask for a copy of the data related to you that we are processing. A person with parental responsibility will generally be entitled to make a subject access request on behalf a pupil, but the information in question is always considered to belong to the individual to whom the data relates. In Scotland, the law presumes that a child of 12 years or more has the capacity to exercise their rights under the Data Protection Law. A pupil of any age may ask a parent or other representative to make a subject access request on their behalf. Moreover (if of sufficient maturity) their consent or authority may need to be sought by the parent making such a request. Requests for data that are excessive or repetitive will be subject to a fee.
‍
How to have your data amended or deleted
You have the right to have in accurate data rectified or completed (if it is incomplete), or have your data erased. Some exceptions may apply where we have another lawful reason to continue to process your data.
‍
How to stop us using your data for certain purposes
You have the right to object to certain processes, such as fundraising activities, as long as it does not interfere with contractual or lawful obligations that we still may need to fulfil.

How to transfer data
You have the right to request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

To act upon any of your rights outlined above please contact us using the details outlined on page six. Requests may be made verbally or in writing. We will aim to respond to any such requests within one month of receipt. We may need to take steps to confirm the identity of the request or depending on the method by which the request was made. Some requests (or part thereof) may be refused and in such cases, we will respond outlining the reason for refusal.