Your Privacy

Woodhouse Grove School is an independent co-educational day and boarding school for pupils aged 2 to 18. Pupils aged 2 to 11 attend Brontë House School, the preparatory school within Woodhouse Grove School.

Woodhouse Grove School forms part of the Methodist Independent Schools Trust (MIST).

For the purposes of UK data protection legislation, Woodhouse Grove School is the Data Controller responsible for the personal data it holds and processes.

This Privacy Notice explains how Woodhouse Grove School collects, uses, stores and shares personal information relating to:
• current, past and prospective pupils;
• parents, guardians and carers;
• current, former and prospective staff;
• volunteers;
• governors;
• alumni;
• contractors and suppliers; and
• private candidates.

This Privacy Notice should be read alongside other School policies and documents, including:
• Parent Contract;
• Staff Contracts of Employment;
• Data Retention Policy;
• Safeguarding and Child Protection Policy;
• CCTV Policy;
• Information Security Policy;
• Data Breach Procedure;
• IT Acceptable Use Policies; and
• Records Management Procedures.

The School may collect and process personal data including:

Identity Information
• name;
• date of birth;
• nationality;
• passport information;
• photographs; and
• identification documents.

Contact Information
• home address;
• email address;
• telephone numbers;
• emergency contact details.

Financial Information
• bank account details;
• fee payment records;
• bursary information; and
• financial assistance applications.

Educational Information
• admissions records;
• academic progress;
• assessment and examination results;
• attendance records;
• references;
• learning support information; and
• disciplinary records.

Employment Information
• recruitment records;
• qualifications;
• employment history;
• references;
• payroll information;
• pension information; and
• performance management records.

Special Category Data
The School may process information relating to:
• physical or mental health;
• disabilities and medical conditions;
• racial or ethnic origin;
• religious beliefs;
• biometric data, where applicable; and
• safeguarding information.

Criminal Offence Information
The School may process criminal records information where permitted by law, including:
• DBS checks;
• safeguarding investigations; and
• criminal allegations and convictions where relevant.

The School processes personal data on one or more of the following lawful bases:

Contract
Where processing is necessary for the performance of a contract with an individual or to take steps prior to entering into a contract.

Legal Obligation
Where processing is necessary for compliance with legal or regulatory obligations.

Legitimate Interests
Where processing is necessary for the legitimate interests of the School or another organisation and those interests are not overridden by individual rights and freedoms.

Vital Interests
Where processing is necessary to protect someone's life or safety.

Consent
Where consent is required under data protection law.
Where Special Category Data is processed, the School will rely on additional lawful conditions permitted under UK GDPR and the Data Protection Act 2018.

The School processes personal data in order to:

Admissions and Pupil Management
• assess applications;
• manage enrolment;
• verify identity;
• administer bursaries and scholarships;
• support educational provision.

Educational Provision
• teach and assess pupils;
• monitor academic progress;
• provide learning support;
• administer examinations;
• organise educational visits and activities.

Safeguarding and Welfare
• fulfil safeguarding responsibilities;
• maintain pastoral records;
• protect pupils, staff and visitors;
• manage medical needs and emergencies.

Employment and Recruitment
• recruit staff;
• manage employment matters;
• administer payroll and pensions;
• carry out DBS and safeguarding checks.

School Operations
• manage finances and fee collection;
• maintain records;
• manage IT systems;
• provide security and site management.



Alumni and Development Activity
• maintain relationships with former pupils;
• organise school events;
• provide newsletters and publications;
• undertake fundraising activity where permitted by law.

Legal and Regulatory Compliance
• comply with statutory duties;
• cooperate with regulators;
• respond to complaints, investigations and legal proceedings.

Personal data is obtained from a variety of sources, including:

• parents and pupils;
• staff members;
• application and registration forms;
• correspondence and communications;
• previous schools;
• examination boards;
• local authorities;
• healthcare professionals;
• government agencies;
• publicly available sources; and
• third-party service providers.

References received by the School are treated confidentially.

The School operates CCTV systems across its sites to:

• safeguard pupils, staff and visitors;
• prevent and detect crime;
• protect School property;
• investigate incidents; and
• assist with health and safety obligations.

CCTV footage is managed in accordance with the School's CCTV Policy.

The School may share information with:

• MIST;
• examination boards;
• local authorities;
• the Department for Education;
• HMRC;
• DBS;
• police and safeguarding agencies;
• legal advisers;
• insurers;
• auditors;
• professional advisers;
• educational software providers; and
• contracted service providers.

Information is only shared where there is a lawful basis for doing so.
Within the School, access to personal information is restricted to those who require it in order to carry out their responsibilities.
Enhanced protections apply to:
• safeguarding records;
• pastoral records;
• medical information; and
• child protection files.

The School uses CPOMS, a secure safeguarding and pastoral management system, to record and manage safeguarding, child protection, welfare and wellbeing concerns.

Access to CPOMS is restricted to authorised staff members who require access in the course of their duties.

The School is required by law and statutory guidance, including Keeping Children Safe in Education, to record, retain and where necessary share safeguarding concerns with relevant agencies.

The School takes appropriate technical and organisational measures to protect personal data from:

• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction; or
• damage.

Such measures include:
• access controls;
• encryption;
• staff training;
• secure storage systems;
• cyber security controls; and
• regular security reviews.

Whilst every effort is made to protect information, no method of transmission over the internet can be guaranteed to be completely secure.

Some of the School's service providers may process personal data outside the United Kingdom.

Where personal data is transferred internationally, the School will ensure that appropriate safeguards are implemented, including approved contractual protections and other measures required by UK GDPR.

The School maintains procedures for identifying, investigating and responding to personal data breaches.
Where required by law, the School will notify:

• the Information Commissioner's Office (ICO); and/or
• affected individuals.

The School retains personal data in accordance with its Data Retention Policy.

Retention periods vary depending upon:
• the type of information;
• the purpose for which it was collected;
• statutory requirements; and
• safeguarding obligations.

In certain circumstances, information may be retained for historical, legal or archival purposes.

The School may also retain minimal information, such as suppression records, to ensure future communication preferences are respected.

Keeping in touch:

The School may use contact details to provide:
• newsletters;
• event invitations;
• alumni communications;
• fundraising information;
• development updates; and
• news about the School.

Individuals may opt out of receiving marketing or fundraising communications at any time by contacting:
data@woodhousegrove.co.uk
The School will only send such communications where permitted by law.

Automated decision making:

The School does not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Your rights:

Under UK GDPR, individuals have the right to:
Right of Access
Request access to personal data held by the School.

Right to Rectification
Request correction of inaccurate or incomplete information.

Right to Erasure
Request deletion of personal data in certain circumstances.

Right to Restrict Processing
Request limits on how personal data is used.

Right to Data Portability
Request transfer of personal data to another organisation where applicable.

Right to Object
Object to certain processing activities, including direct marketing.

Rights Relating to Automated Decision-Making
Request human review of automated decisions where applicable.

Requests should be submitted to:
data@woodhousegrove.co.uk

The School will respond in accordance with statutory timescales.

The School recognises that pupil information belongs to the pupil.
Subject Access Requests may be made by pupils who have sufficient maturity to understand the request.

The School will assess requests on a case-by-case basis, taking into account:
• the age and maturity of the pupil;
• parental responsibility;
• confidentiality obligations;
• safeguarding considerations; and
• the best interests of the pupil.

Parents will continue to receive information required under the Parent Contract and which is necessary to support their child’s education and welfare.

Information for pupils:

Where appropriate to their age and understanding, pupils will be informed about:
• how their information is used;
• who it may be shared with;
• how it is protected; and
• their rights under data protection legislation.

Individuals are asked to notify the School promptly of any changes to their personal information.

The School will take reasonable steps to ensure personal data remains accurate and up to date.

The School may amend this Privacy Notice from time to time to reflect changes in legal requirements, operational practices or School procedures.

The most recent version will be published on the School website.

Questions regarding this Privacy Notice should be directed to:

data@woodhousegrove.co.uk

Individuals also have the right to raise concerns with the Information Commissioner's Office (ICO).

Further information is available from the ICO:

https://www.ico.org.uk

The School would appreciate the opportunity to address any concerns before the ICO is contacted