1. WHAT THIS PRIVACY NOTICE IS FOR
In order to fulfil the contract between you and the school, d’Overbroeck’s will collect, use and hold (“process”) personal
data relating to you as a parent or guardian. This makes d’Overbroeck’s a “data controller” of your personal information
under data protection law. This Privacy Notice sets out how and why we use personal information about you, and what
your rights are concerning the information we hold.
Your privacy is important to us and we want to keep your personal information safe. The school holds only the personal
information we are permitted to hold about you, and uses it only for limited purposes relating to your child’s education,
health and wellbeing at the school.
2. ABOUT THIS NOTICE
This Privacy Notice applies equally to current, past or prospective parents and guardians. It does not form part of any
contract to provide services and we may update it at any time. This Privacy Notice applies to you in addition to the
school’s other relevant terms and conditions and policies, including:
• any contract between the school and you;
• the school’s CCTV policy;
• the school’s Taking, Storing and Using Images of Students policy;
• the school’s Data Retention policy;
• the school’s Safeguarding policy;
• the school’s Health & Safety policy;
• the school’s e-Safety policy;
All the above policies are available from the policies page of our website.
3. THE KIND OF INFORMATION WE HOLD ABOUT YOU
Personal information is information that identifies you as an individual and relates to you.
This includes the following:
• your name, title, addresses, telephone numbers, email addresses, marital status, profession;
• your personal information as it relates to any concerns or complaints you have raised with the school;
• where asked by the school, your consent (or objection) for your child to participate in school trips or for us to use
certain personal information about your child;
• where appropriate, information about your health and welfare, and the health and welfare history of your family;
• where appropriate, criminal records information if you volunteer for school outings or activities where a DBS check is
required;
• bank and financial information, particularly with regard to the payment of school fees;
• financial and personal information in support of an application for a means-tested bursary;
• other financial information in connection with fees-in-advance payments in accordance with antimoney laundering law;
• information from CCTV cameras when you visit the school site;
• information relating to your presence at virtual Open Days, Parents Evening and other online events;
• information about your education, qualifications, professional experience, hobbies and interests, where you have
provided this to us voluntarily for use in school publications or at school events.
4. HOW WE COLLECT YOUR PERSONAL INFORMATION
We generally collect personal information from you directly. This may be through a form or meeting, or simply in our
day-to-day contact with you (such as emails, conversations and via an online portal).
From time to time we may collect information about you and your child from third parties. For example, from your child’s
previous school or from doctors, professionals or authorities.
Some of the personal information you provide to us is mandatory, which means that you must provide it to us so that we
can provide our services to you and your child. Other personal information you provide to us is optional, which means
that you may decide not to provide it to us. We will let you know when the personal information we request is optional.
Your duty to inform us of changes
If you move house, change your email address, telephone number or other personal details, it is important that you let
us know so that the information we hold is accurate.
5. WHY WE COLLECT YOUR PERSONAL INFORMATION
We use your personal information:
a) to decide whether your child can be admitted to the school
b) to decide whether your child is eligible for a bursary or scholarship
c) to facilitate the payment of school fees
d) to support your child’s learning and education
e) to monitor and report on your child’s progress
f) to make sure your child’s health and wellbeing is looked after
g) to make sure we provide your child with a high quality of education
h) to ensure the school complies with the law and meets its legal obligations.
Further details are in section 6 below.
6. THE BASIS FOR USING YOUR PERSONAL INFORMATION
We will only use your personal information when the law allows us to. We are likely to use your personal information for
the following purposes:
a) Entering into, or fulfilling, our contract with you
Most of the personal information we collect about you is needed to make sure we are able to fulfil our obligations to you
under the parent contract. For example:
• to keep you informed of your child’s health, wellbeing and educational development.
• to arrange educational and extra-curricular trips and activities.
• to arrange for payment of fees.
b) Compliance with legal rights, duties or obligations, for example:
• relating to child welfare, social protection, equality monitoring, immigration/visa sponsorship compliance and health &
safety.
• submitting data as part of the annual school census collection by the Department for Education and Independent
Schools Council, using anonymised data and statistics.
• for the prevention and detection of crime, such as money laundering, and to assist with investigations (including
criminal investigations) carried out by the police and other competent authorities.
c) Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights
do not override those interests. For example:
• when the parent contract we have with you does not apply (or is not yet in place) or when there is no specific law
which requires us to use your personal information, such as when deciding whether your child can be admitted to the
school.
• monitoring students’ progress and educational needs.
• asking for professional advice or information from someone outside the school, such as professionals or a previous
school.
• safeguarding a student’s welfare, and providing appropriate education services, such as physical or spiritual
development.
• for site security purposes, such as CCTV in accordance with our CCTV policy, or to carry out any school or external
complaints or investigations processes. or to record the presence and activity of visitors to virtual events such as Open
Days and Parents Evenings.
• to record the presence and activity of visitors to virtual events such as Open Days and Parent Evenings.
• when you have given your informed and freely given consent to use your personal information, for instance when you
agree to us using your personal information when giving pupils career guidance (including at career events).
7. HOW WE USE PARTICULARLY SENSITIVE PERSONAL INFORMATION
It is important to be aware that, where appropriate, we may also use sensitive personal information about you, such as
your medical and health information, ethnicity or religion. This information is used to safeguard your child’s welfare and
provide us with the information we require to meet your child’s specific needs, and to fulfil the school’s legal and
regulatory responsibilities regarding child protection and monitoring.
Particularly strict rules apply when processing medical, pastoral or safeguarding records.
8. SHARING YOUR DATA WITH OTHERS
Personal data collected by the school usually remains within the school and will be processed by appropriate individuals
only in accordance with access protocols, ie on a ‘need to know’ basis. However, we routinely share your data with third
parties, including third-party service providers where it is necessary to administer our contract with you, where required
by law, or where we have a legitimate interest in doing so, as outlined above.
Third-party service providers who may process your personal information
We may disclose limited personal data (including in limited cases special category or criminal data) to a variety of
recipients including:
• schools that your child attends after leaving us.
• other service providers for administration and IT services, such as web developers, virtual event facilitators or cloud
storage providers, although this is not sharing your data in a legal sense, as these are considered data processors on
our behalf.
• our parent company, Nord Anglia Education. For example, so that we may make efficient use of our resources. NAE
may also receive information that you have consented to providing us for the purposes of giving career guidance to
pupils.
• where we are required or permitted to do so by law, or where we have a legitimate interest in sharing your personal
information. This might include the Department for Education, the Independent Schools Inspectorate, relevant public
health/NHS agencies, the Information Commissioner’s Office, the Charity Commission, the local authority, Ofsted,
professional advisers, auditors, or other regulators. It may also include companies who carry out research to help us
with our future planning for the school, for example RSAcademics Ltd.
• when the school is legally required to do so (by a court order, government body, law enforcement agency or other
authority of competent jurisdiction), for example HM Revenue and Customs or police.
9. TRANSFERRING STUDENT, PARENT AND GUARDIAN DATA INTERNATIONALLY
Your personal information may be stored and processed outside of the country where it is collected, including outside of
the European Economic Area. We will only transfer personal data to a country or territory outside the European
Economic Area:
• where the transfer is to a place that is regarded by the European Commission as providing adequate protection for
your Personal Information; or
• where we have put in place appropriate safeguards to ensure that your Personal Information is protected (for example
where both parties involved in the transfer have signed standard data protection clauses adopted by the European
Commission); or
• the above does not apply but we are still legally permitted to do so, for example if the transfer is necessary for the
establishment, exercise or defence of legal claims. We have put in place measures to protect the security of your
information. Details of these measures are available from Tracy Roslyn, Data Compliance Administrator,
tracy.roslyn@doverbroecks.com.
Third parties will only process your personal information on our instructions and where they have agreed to treat the
information confidentially and to keep it secure.
10. HOW WE SECURE YOUR INFORMATION WHEN OTHERS USE IT
All our service providers have to take appropriate security measures to protect your personal information in line with our
policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only
allow them to use your personal data for specified purposes and in accordance with our instructions and in accordance
with the law.
Arrangements with third party IT processors are always subject to contractual assurances that personal data will be
kept securely.
11. DATA SECURITY
We protect the security of your information. If you want to know how we do this, please contact Tracy Roslyn, Data
Compliance Administrator, tracy.roslyn@doverbroecks.com.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost,
used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information
to those individuals who have a need to know it. They will only use your personal information on our instructions and
they will be required to treat it as confidential.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable
regulator of a suspected breach where we are legally required to do so.
12. DATA RETENTION
The school will keep your personal information securely and only for as long as it is necessary for a legitimate and
lawful reason. When we do not have a lawful reason to hold it, we will delete or destroy your personal information
securely. In some circumstances we may anonymise your personal information, so that it can no longer be linked to
you. If we do this, we may use such information without telling you.
Typically, we will hold your personal information until your child reaches the age of 25. Some will be kept for a much
shorter period, eg, CCTV images, recorded virtual events, and bank account details. However, any of your personal
information which relates to incident reports and safeguarding must be kept much longer, as required by the law.
For further information, please see our Data Retention Policy, available from our website or on request from the school
office.
13. YOUR RIGHTS
• ask to see your personal information;
• ask for a correction of your personal information to ensure it is accurate;
• ask for your personal information to be deleted (the ‘right to be forgotten’);
• object to processing of your personal information;
• ask for us to limit the processing of your personal information;
• request the transfer of your personal information to another party.
If you want to do any of the above, please contact Tracy Roslyn, Data Compliance Administrator,
tracy.roslyn@doverbroecks.com in writing. The school will endeavour to respond to any such requests as quickly as
reasonably practicable, and in any event within statutory time-limits, which is one month in the case of requests for
access to information.
Requests that cannot be fulfilled
The right of access is limited to your own personal data. The school therefore cannot disclose:
• information which is subject to legal privilege, such as legal advice given or sought by the school, or documents
prepared in connection with legal action;
• information which discloses student examination scripts or other information consisting solely of student test answers
or test marks ahead of any ordinary publication;
• any confidential reference given by the school for the purposes of the education of any individual;
• information which identifies other individuals, and this may include your own children. Although a person with parental
responsibility will generally be entitled to make a subject access request on behalf of younger students, the law still
considers the information in question to be the child’s. For older students, generally aged 12 and above, the parents
making the request may need to provide the child’s written permission for that specific request to be carried out.
The school may have compelling reasons to refuse specific requests to amend, delete or stop processing you or your
child’s personal data, for example, a legal requirement, or where it falls within a legitimate interest in this Privacy Notice.
All such requests will be considered on their own merits.
Your right to withdraw consent
Where you have voluntarily supplied optional personal information, you can withdraw this consent at any time.
Examples may include certain types of images or helping to promote and run a careers event.
Parental rights
The school usually relies on parental authority for the necessary ways it processes personal data relating to students,
for example under the parent contract.
Parents will generally receive educational and pastoral updates about their children. Where parents are separated, the
school will, in most cases, aim to provide the same information to each person with parental responsibility, but may
need to factor in all the circumstances including the wishes of the child.
Student rights
In general, the school will assume that student’s consent is not required for ordinary disclosure of their personal data to
their parents, such as keeping parents informed about the student’s activities, progress and behaviour, and in the
interests of the student’s welfare.
However, where a student seeks to raise concerns confidentially with a member of staff and expressly withholds their
agreement to their personal data being disclosed to their parents, the school may be under an obligation to maintain
confidentiality unless, in the school’s opinion, there is a good reason to do otherwise, for example where the school
believes disclosure will be in the best interests of the student or other students, or if required by law.
14. CHANGES TO THIS PRIVACY NOTICE
We may update this notice from time to time and publish a new version on the Privacy Notices page of our website. We
may also notify you in other ways from time to time about the processing of your personal information.
15. CONTACTS AND COMPLAINTS
If you have any questions about this privacy notice or how we handle your personal information, or if you wish to
exercise any of your rights under applicable law, please contact Tracy Roslyn, Data Compliance Administrator, at
tracy.roslyn@doverbroecks.com.
Application Form - Cecile Bolton Family
If you are not satisfied with how we are processing your personal data, or how we deal with your complaint, you can
make a complaint to the Information Commissioner’s Office (ICO) www.ico.org.uk, the UK supervisory authority for data
protection issues. The ICO recommends that you take steps to resolve the matter with the school before involving them
