PRIVACY NOTICE

Version: 01/2022

This notice is intended to explain how Uppingham School and Uppingham School Enterprises Limited (“the School”) process personal data about our current, prospective, and former pupils; and their parents, carers, or guardians (referred to in this notice as “parents”).

Uppingham School is a co-educational boarding school registered as a charity (number 1147280) and as a company limited by guarantee (number 08013826).

Uppingham School Enterprises Limited (company number 01130851) is the trading subsidiary of theSchool, managing the commercial activities that take place at the School, including Uppingham School Sports Centre (USSC), and the Uppingham School Shop.

This notice applies alongside any other information we may provide about a particular use of personal data, for example if the School needs to collect specific information via a questionnaire or form. It also applies in addition to any other relevant terms and conditions, or School policies, including:
− Any contract between the School and the parents of pupils (the “Parent Contract”);
− The School’s Safeguarding and Child Protection Policies;
− The School’s CCTV Policy;
− The School’s Acceptable Use of Images Policy;
− The School’s Information Security Policy and Acceptable Use Policy; and
− The School’s Retention of Records Policy.

What types of personal data does the School use?
During the School’s routine activities, we collect, store and process large quantities of personal data(sometimes sensitive in nature) about pupils and their parents.
‍
For example, this can include:
− Names, addresses, telephone numbers, email addresses and other contact information;
− Bank details and other financial information (for example about parents who pay fees to theSchool);
− Records of purchases and events attended;
− Records of gifts and donations;
− Information about pupils’ academic, disciplinary and attendance records (including information about any Special Educational Needs);
− Information about an individuals’ health and wellbeing;
− Images of pupils engaging in School activities;
− Images of individuals captured by the School’s CCTV system; and
− Information about an individuals’ whereabouts on the School estate captured by the School’s access control system.

How does the School obtain my personal data?
Generally, we receive personal data directly from the individual (including, in the case of pupils, from their parents). This may be via a form, whether online or on paper, or simply in the ordinary course of interaction or communication (such as email or written assessments).We may occasionally receive personal data from third parties, for example references from a previousSchool or information from the local authority where a pupil has an Education, Health and Care Plan(EHCP) in place.

We may also use publicly available data about prospective or existing parents, from reputable sources, where someone would expect their information may be read by the public. This includes data from Companies House, corporate and charity websites, media coverage, and business due diligence websites.

We reserve the right to carry out credit and identity checks to ascertain whether any person is a‘blocked person’ under UK economic sanctions laws, UK anti-money laundering laws, or UK anticorruption laws.

Why does the School use personal data?
We need to process a wide range of personal data to provide the breadth and quality of education required by our pupils, to safeguard their welfare, to provide appropriate pastoral care, and to facilitate our smooth operation.

For example, we have a legitimate interest to use personal data:
− For the purposes of pupil selection (and to confirm the identity of prospective pupils and their parents);
− To exchange information and references about current or prospective pupils, including information about outstanding fees or payment history, with any educational institution that they attended, or it is proposed they attend;
− To safeguard pupils’ welfare and provide appropriate pastoral care;
− To provide pupils with education services, including musical studies, sport and physical activity, spiritual development, career services, and co-curricular activities;
− To assess means-tested scholarships and bursary applications, in order to make fee remission awards, and to determine the suitability of awarding a bursary;
− To enable pupils to take part in national or other assessments, and to publish the results of public examinations;
− To provide references to educational establishments, or potential employers, on behalf of former pupils;
− To allow us to use photographs or video of our pupils in our own “community” media, such as our website, magazines, social media accounts, school prospectuses, online school guidebooks, or intranet sites;
− To maintain relationships between alumni, the School, and the wider foundation community;
− For security purposes, including CCTV and ANPR cameras, to make sure the School estate is secure;
− To maintain the health and safety of all those who live, work and study on the School estate;
− To monitor use of the School’s IT and communications systems;
− For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law;
− Where otherwise reasonably necessary for the School’s purposes, including to obtain appropriate professional advice and insurance for the School;
− To enable relevant authorities to monitor the School’s performance and to intervene or assist with incidents as appropriate;
− To carry out (or co-operate with) any School or external complaints, disciplinary or investigation process; and
− For legal and regulatory purposes (for example child protection, diversity monitoring and health & safety) and to comply with our legal obligations and duties of care;

We may ask your consent to use personal data in certain ways, for example:
‍
− We will seek consent from parents prior to publishing any image or video of our pupils where they are to be identified by name, are especially prominently featured, or are in swimming or games clothes;
− When the School hosts agreed visits from the media, they may wish to interview pupils or record footage. We will always seek consent from parents prior to broadcast or publication where their child is featured; and
− We may ask for your consent before processing sensitive personal data (such as medical information, racial or ethnic origin, or religious or philosophical beliefs) where there is a need to obtain this information;

Who else see my personal data?
Occasionally, we may need to share personal data belonging to our pupils and their parents with third parties, such as:
− The School Doctor (Uppingham Surgery);
− Print and fulfilment firms when creating or distributing newsletters or magazines;
− Event providers, host venues, or catering firms (to allow them to adequately prepare for an event);
− UK Visas and Immigration if a pupil requires a Tier 4 (Child) Student Visa to study atUppingham;
− The School’s professional advisors (for example our solicitors, insurers, or auditors);
− Appropriate regulatory bodies such as the Independent School’s Inspectorate, the Charity Commission, the Boarding School Association, or the Medical Officer of Schools Association; and
− The police or local authority (for example where we have a legal obligation to report a safeguarding concern).

Finally, in accordance with UK Data Protection legislation, some of the School’s processing activity is carried out by specialist third parties such as mailing houses, statistical research and analysis providers, IT systems providers, web developers or cloud storage providers. This is always subject to contractual assurances that personal data will be kept securely and only in accordance with the School’s specific directions.

Woodfield Health Centre
Woodfield Health Centre looks after pupils’ all-round health and wellbeing by promoting good health and healthy lifestyles, as well as treating ill health and accidents as they arise.

It is professionally equipped and staffed by registered nurses and counsellors to provide a 24-hour service during term time.

Staff at Woodfield Health Centre are governed by their professional codes of practice, including minimum standards for patient confidentiality. Wherever possible staff at Woodfield will uphold patient confidentiality, but where in the interests of patient safety or public protection, they may occasionally share information with other areas of the School (for example house staff or the safeguarding team)on a “need to know” basis.

OU Association
The OU Association is an unincorporated association that unites and supports alumni of UppinghamSchool, connecting members socially and professionally, and sharing news and stories with the alumni community.

The OU Association allows the School to stay in touch with its former pupils, keeping them updated about the activities of the School, for example by arranging events or sending regular newsletters or updates.

Where alumni or parents give their prior consent, the School may share personal data with organisations set up to help establish and maintain relationships with the School community, such as the Friends of Uppingham, The OU Charity Fund, and The Mango Tree.

The School occasionally receives requests from third parties, such as researchers or authors, wishing to access information held in the School’s historical archives about individuals associated with theSchool, particularly where they have gone on to become famous or hold a pre-eminent position in later life. The School will seek prior permission from the individual concerned (or their legal representative), prior to granting access.

Uppingham Foundation
‍The philanthropic contribution of the Uppingham community has enabled numerous children to access the financial support they need to study at Uppingham and supported constant investment in the School campus, maintaining Uppingham’s reputation as one of the finest independent schools in the UK.

Our community includes a number of generous individuals who support the School by sharing their networks and by making major donations. We prepare thoroughly and carefully for individual meetings and bespoke events with this small group of supporters to make our contact with them as meaningful as possible.

We may research an individual’s professional and charitable interests and their likely capacity to support Uppingham School. We use this information to help us identify which aspects of the School’s activities are the best match to an individual’s philanthropic ambitions.

Individuals always have the right to withdraw consent, where given, or otherwise object to direct marketing or fundraising. However, the School is nonetheless likely to retain some personal details(not least to ensure that no more communications are sent to that particular address, email or telephone number). Should an OU or parent wish to limit or object to any such use, or would like further information, please contact the Bursar at data@uppingham.co.uk.

Uppingham School historic archive
‍Uppingham School maintains a private historic archive as a record of school life and pupil’s achievements. As part of the archive, the School keeps a register of former pupils.

Information about individual pupils, members of staff, and trustees held in the archive is intended for use in responding to queries from Old Uppinghamians (OUs), historical researchers, and other individuals with an interest in Uppingham’s history.

External third parties are only granted access to information held in the archive where prior permission has been granted by the School. Access to personal data concerning living individuals, which is not in the public domain, will only be granted if the individual (or their appointed representative) grants prior written permission.

Responsibility for data protection
‍All staff at Uppingham have a responsibility to handle any personal data they come into contact with fairly, lawfully, responsibly and securely.

The School has appointed the Bursar as the Privacy and Compliance Officer, who will endeavour to ensure that all personal data is processed in compliance with this policy and the principles of the DataProtection Act 2018.

If you have any questions about this notice, please contact the Bursar at data@uppingham.co.uk c/oUppingham School, Uppingham, Rutland, LE15 9QD.

Complaints
‍If you have any comments or queries about this notice, please contact the Bursar atdata@uppingham.co.uk c/o Uppingham School, Uppingham, Rutland, LE15 9QD.

If you believe that the School has not complied with this notice or has acted otherwise than in accordance with data protection legislation, you should use the School complaints procedure and should also notify the Bursar. You can also make a referral to, or lodge a complaint with, theInformation Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with the School before involving the regulator.

Data accuracy and security
‍We take all reasonable technical and organisational steps to ensure the security of the personal data it holds about its pupils and their parents. The School securely stores its electronic records on internal databases and servers, protected by appropriate firewalls and anti-virus, and its paper records insecure on-site archives. Access to personal data is restricted to authorised personnel only.

Your rights
‍Right of access
Pupils and parents have various rights under data protection legislation to access and understand how we store and process their personal data.

In some circumstances, an individual can ask for their personal data to be amended, erased, transferred to another person or organisation, or for the School to stop processing their personal data. The right of access is subject to certain exemptions and limitations, for example where complying with data protection legislation would breach another law. If we are unable to comply with a request for access, we will endeavour to explain the reason why but may not be able to do so in all instances.

When dealing with a request for access, we may be able to respond more quickly to small, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, we may ask an individual to reconsider, or require a proportionate fee (only as allowed under data protection legislation).

Right of correction or erasure
Pupils and parents have the right to request that any out of date, irrelevant, or inaccurate information about them is corrected or erased (subject to certain exemptions and limitations).

Right to be forgotten
Pupils and parents may have heard of the ‘right to be forgotten’. However, we can sometimes have compelling reasons to refuse specific requests to amend, delete or strop processing an individual’s personal data, for example where the processing is to meet a legal requirement. All such requests will be considered on their own merits.

Requests that cannot be fulfilled
‍We are unable to comply with requests for:
− Information which identifies, or is about another person (parents should note this may include information about their own children in certain circumstances);
− Information which is subject to legal privilege (for example, advice given to the School, or documents prepared in connection with a legal action);
− Pupil examination scripts (or other information consisting solely of pupil answers);
− Examination or other test marks ahead of any ordinary publication;
− Any confidential reference given by the School for the purposes of the education, training or employment of any individual; and
− Erasure of personal data where it would place the School in breach of its statutory and regulatory obligations.
‍
Requests by pupils
Pupils can request access to their personal data if they have sufficient maturity to understand the request they are making. Generally, pupils at Uppingham will be assumed to have this level of maturity although this will depend on the pupil, the personal data requested, and any relevant circumstances at home. All information requests from pupils will be considered on a case by case basis.

Requests by parents
Under data protection legislation, parents may not have a statutory right to information about their child. The personal data belongs to the individual, and they may need to provide consent for the information to be shared with their parents.

However, the rules on subject access requests are not the sole basis on which information requests are handled. Parents will often have a legitimate interest or expectation that information about their children is shared by the School without their consent, for example where there are grounds to do sounder the Parent Contract.

In general, the School will assume that pupils’ consent is not required for ordinary disclosure of their personal data to their parents. For example, for the purposes of keeping parents updated about their children’s activities, progress, behaviour, and in the interests of pupil welfare. That is unless, in theSchool’s opinion, there is a good reason to do otherwise.

Where parents are separated, we will in most cases aim to provide the same information to each person with parental responsibility but may need to factor in all the circumstances including the express wishes of the child.



The School may update this Privacy Notice from time to time. Where there are substantial changes that may affect your rights, the School will use all reasonable endeavours to notify you directly.