d’Overbroeck’s is a “data controller” under data protection law. This means that we are responsible for deciding how we hold and use personal information about you.
This Privacy Notice tells you how and why we use your personal information when visiting our website or speaking at the school, and what your rights are.
The school holds only the personal information we are permitted to hold, and uses it only for limited purposes. Your privacy is important to us and we want to keep your personal information safe.
- HOW AND WHY WE USE YOUR PERSONAL DATA
1.1. Enquiry Data We may process information that you provide to us through our website forms ("Enquiry Data"). Our website forms include the Admissions Enquiry Form, Application Form, Open Day Registration Form and Alumni Consent Form. This Enquiry Data may include your name, title, address, telephone number and email address. The legal basis for this processing is your consent.
1.2. Your Child’s Data We may process information of a child to whom you are a parent or guardian when you complete an Admissions Enquiry Form, Application Form or Open Day Registration Form (“Your Child’s Data”). Your Child’s Data may include their name, title, gender, address, telephone number, date of birth, education details, nationality, whether English is their first language and their referees’ name and contact details. The legal basis for this processing is consent you give on behalf of your child.
1.3. Website Data We may process data about your use of our website and services ("Website Data"). The Website Data is collected through cookies and other IT tracking technologies and may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use. Website Data includes information gathered and stored during virtual events, such as an online Open Day and online Parents Evening. It also includes communication data resources that are accessed, and the associated telemetry data, eg, how long you spent watching a video. The source of the Website Data is our analytics tracking system. This Website Data may be processed for the purposes of analysing the use of the website and services. The legal basis for this processing is our legitimate interests, namely monitoring and improving our website and services.
1.4. Marketing Data We may process information that you provide to us when responding to questions about how you heard about us ("Marketing Data"). These questions are asked when you submit an application form. We may also provide third parties with statistical information about our users, but this information will not be anonymised and not used to identify any individual user. The legal basis for this processing is your consent. We will not provide your personal information to any third parties for the purpose of direct marketing.
1.5. External Speakers We may process your personal information when you speak at events organised by the school (“External Speaker Data”). You may have provided us with this information specifically for the event or we may have collected it when you were a student at the school, or in the course of our alumni communications with you. This information may include your name, title, education, qualifications, work/career information and comments about the event or the school. If the school agrees that you may be a speaker, we may use your information to create a personal profile which may be displayed on the school’s social media, in the school’s newsletter, and in its brochures. We may also display in these media any materials you provide to us during the course of your speaking engagement. The school will do searches to ascertain if you have links to extremist views. If the school becomes aware of extremist or other views which, in the opinion of the school, are offensive and make you unsuitable as a speaker within school, we may record this presence of this data.
The legal basis for this processing is consent and/or legitimate interests, namely safeguarding our students and promoting the school.
1.6. Other Processing Activities In addition to the specific purposes for which we may process your personal data set out above, we may also process any of your personal data where such processing is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another person.
1.7. Sensitive Personal Data During the course of using our website and/or completing our website forms you may provide us with sensitive personal data (“Sensitive Data”). This Sensitive Data may include your nationality and any disability or medical needs you may have. We may use this data to consider your eligibility to study in the UK and assess what reasonable adjustments we could make during the application process and when you join the school (if applicable). The legal basis for this processing is consent and/or compliance with the Equality Act 2010 and/or other legal obligations.
- COOKIES
We use cookies on our website. A cookie is a text file sent by a web server to a web browser, and stored by that browser. The text file is then sent back to the server each time the browser request a page from the server. This enables the web server to identify and track the web browser. Our website cookies distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site.
We may use the information we obtain from the cookie in the administration of this website, to improve the website’s usability and for marketing purposes. If you choose to refuse our cookies, you may not be able to use all the website elements.
Our Cookie Policy can be found here: www.doverbroecks.com/cookie-policy. The policy explains how you can disable cookies if you wish.
- SHARING YOUR PERSONAL DATA WITH OTHERS
3.1. To our partner service providers We may disclose your personal data to iSAMS, our database supplier, and WPEngine, providers of our website hosting services, whose functions include processing of personal data for the purposes of improving our website and services for you. We may also share data with companies who facilitate virtual events, such as Open Days, Parents Evenings and other interactive online events, or who assist us in providing educational services, such as online learning. The legal basis for this processing is our legitimate interests.
We may also share your personal data with companies such as RSAcademics Ltd who carry out research to help us with our future planning for the school. The legal basis for this processing is our legitimate interests, namely improving our customer service and offering to prospective (and current) students. We will normally give you the opportunity to opt out of this research before any personal data is shared.
Where we share your personal data with any third party, both parties sign a Third Party Data Agreement and we ensure this processing is protected by appropriate safeguards. Some of these agreements are made with Nord Anglia Education, our parent company, rather than directly with d’Overbroeck’s.
3.2. Our parent company, Nord Anglia Education We will regularly share anonymised statistical data to our parent company in the form of marketing reports. The legal basis for this processing is our legitimate interests.
3.3 Our insurers/professional advisers We may disclose your personal data to our insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining and maintaining insurance coverage, managing risks, obtaining professional advice and managing legal disputes.
3.4. To comply with legal obligations In addition to the specific disclosures of personal data detailed above, we may also disclose your personal data where such disclosure is necessary for compliance with a legal obligation we have to comply with, or in order to protect your vital interests or the vital interests of another individual.
- TRANSFERRING YOUR PERSONAL DATA INTERNATIONALLY
Your personal information may be stored and processed outside of the country where it is collected, including outside of the European Economic Area.
We will only transfer personal data to a country or territory outside the European Economic Area if the following conditions apply:
- where the transfer is to a place that is regarded by the European Commission as providing adequate protection for your Personal Information; or
- where we have put in place appropriate safeguards to ensure that your Personal Information is protected (for example where both parties involved in the transfer have signed standard data protection clauses adopted by the European Commission); or
- the above does not apply but we are still legally permitted to do so, for example if the transfer is necessary for the establishment, exercise or defence of legal claims.
We have put in place measures to protect the security of your information. If you would like details of these measures please contact us (see section 10).
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
- RETAINING AND DELETING PERSONAL DATA
Personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
Unless we contact you and obtain your consent for us to retain your personal data for a longer period, we will retain and delete your personal data as follows:
5.1 Enquiry data and your child’s data. If your child does not attend the school, this data will be retained for three years after the enquiry then anonymised on our systems. If your child attends the school, the enquiry data and your child’s data will form part of the student record and will be retained in line with our Data Retention policy, which is available from the policies page of our website.5.2 Website data will be retained for 18 months following the date of our last contact with you, at the end of which period it will be deleted from our systems.
5.3 Marketing data will be retained for 18 months following the date you submitted the prospectus request form, at the end of which period it will be deleted from our systems.
5.4 External speaker data will be retained for 18 months following the date you spoke at our event.
We may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another person.
- LINKS TO OTHER SITES
Our site may contain links to other sites. If you click on third party links, you will be directed to external website that are not operated by us. We have no control over, and assume no responsibility for the content, privacy notices or practices of any third party sites or services. We therefore strongly advise you to review the Privacy Notices of these websites.
- CHANGES TO THIS PRIVACY NOTICE
We may update this notice from time to time by publishing a new version on the Privacy Notices page of our website. You should check this page occasionally to ensure you are happy with any changes to this notice.
- YOUR RIGHTS
You have the following rights in connection with your personal information:
- Subject Access Request – you may ask to see a copy of any personal data we hold about you. This information will generally be provided within one month of us confirming your identity and understanding the scope of your request;
- Rectification – you may ask for your personal information to be amended or incomplete data completed;
- Erasure – you may ask for your personal information to be deleted;
- Restriction – you may ask for us to limit the processing of your personal information in some circumstances, for example, whilst we resolve a complaint. Restriction means that although
we still store the data, we will not process it (or will not process it for certain purposes) until such time as the restriction may be lifted;
- Portability – you may ask for a copy of any personal data you have provided to us to be returned to you, or transmitted to another controller, in a commonly used machine readable format;
- Objection – you may object to us processing a specific type of personal information that requires your voluntary consent, unless there are legitimate grounds on which we can rely to process it;
- You may also request further detail about the safeguards we have in place regarding transfers of personal information outside of the EEA and, where applicable, a copy of the standard data protection clauses that we have in place.
If you want to do any of the above, please contact us in writing (see section 10). The school will endeavour to respond to any such requests as quickly as reasonably practicable, and in any event within statutory time-limits, which is one month in the case of requests for access to information.
The school may have compelling reasons to refuse specific requests to amend, delete or stop processing your personal data, for example, a legal requirement, or where it falls within a legitimate interest in this Privacy Notice.
- OUR DETAILS
This website is owned and operated by d’Overbroeck’s.
We are a registered company in England and Wales under registration number 01501239, and our registered address is at New Kings Court, Tollgate, Chandler’s Ford, Eastleigh, Hampshire SO53 3LG.
- CONTACT
If you have any questions about this privacy notice or how we handle your personal information, or if you wish to exercise any of your rights under applicable law, please contact the Data Compliance Administrator via tracy.roslyn@doverbroecks.com.
If you are not satisfied with how we are processing your personal data, or how we deal with your complaint, you can make a complaint to the Information Commissioner’s Office (ICO) www.ico.org.uk, the UK supervisory authority for data protection issues. The ICO recommends that you take steps to resolve the matter with the school before involving them.
