Privacy Policy

WHY THE SCHOOL NEEDS TO PROCESS PERSONAL DATA

In order to carry out its ordinary duties to pupils and parents, the school needs to process a wide range of personal data about individuals (including current pupils and parents) as part of its daily operation.

Some of this activity the school will need to carry out in order to fulfil its legal rights, duties or obligations – including those under a contract with the parents of its pupils.

Other uses of personal data will be made in accordance with the school’s legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals, and provided it does not involve special or sensitive types of data.

The school expects that the following uses will fall within that category of its (or its community’s) “legitimate interests”:

• for the purposes of pupil selection (and to confirm the identity of prospective pupils and their parents);
• to provide education services, including musical education, physical training or spiritual development, career services, and extra-curricular activities to pupils, and monitoring pupils’ progress and educational needs; including where such services are provided remotely (either temporarily or permanently;)
• to enable relevant authorities to monitor the school’s performance and to intervene or assist with incidents as appropriate;
• to give and receive information and references about past, current and prospective pupils, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend; and to provide references to potential employers of past pupils;
• to enable pupils to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils of the school;
• to safeguard pupils’ health and welfare, and provide appropriate pastoral care;
• to monitor (as appropriate) use of the school’s IT and communications systems in accordance with the school’s IT acceptable use policy;
• to make use of photographic images of pupils, OWs and the school community in school publications, on the school website, in the online digital archive, and (where appropriate) on the school’s social media channels in accordance with the school’s policy on taking, storing and using images of children;
• for identification and security purposes, including biometrics and CCTV in accordance with the school’s biometrics and CCTV policies;

• to carry out or cooperate with any school or external complaints, disciplinary or investigation process;
• for regulatory record keeping / compliance purposes in respect of immigration requirements as an employer and / or visa sponsor; and
• where otherwise reasonably necessary for the school’s purposes, including to obtain appropriate professional advice and insurance for the school.

In addition, the school will on occasion need to process data, including special category personal data (concerning health, ethnicity, religion, biometrics or sexual life) or criminal records information (such as when carrying out DBS checks) in accordance with rights or duties imposed on it by law, including as regards safeguarding and employment, or from time to time by explicit consent where required. These reasons will include but are not limited to:

• to safeguard pupils’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual’s medical condition or other relevant information where it is in the individual’s interests to do so: for example for medical advice, for social protection, safeguarding, and cooperation with police or social services, for insurance purposes or to caterers or organisers of school trips who need to be made aware of dietary or medical needs;
• to comply with public health requirements in respect of an outbreak of a notifiable disease; including managing on-site testing and / or processing the results of tests taken by pupils or other members of the School community, and sharing this information with relevant health authorities.
• to provide educational services in the context of any special educational needs of a pupil;
• to provide spiritual education in the context of any religious beliefs;
• to run any of its systems that operate on biometric data, such as for security and other forms of pupil identification (lockers, lunch etc.);
• as part of any school or external complaints, disciplinary or investigation process that involves such data, for example if there are SEN, health or safeguarding elements; or
• for legal and regulatory purposes (for example child protection, diversity monitoring, health and safety and immigration / visa sponsorship compliance) and to comply with its legal obligations and duties of care.

TYPES OF PERSONAL DATA PROCESSED BY THE SCHOOL

This will include by way of example:

• names, addresses, telephone numbers, e-mail addresses and other contact details;
• car details (about those who use our car parking facilities);
• biometric information, which will be collected and used by the school in accordance with the school’s biometrics policy;
• bank details and other financial information, e.g. about parents who pay fees to the school;
• details of any gifts given to the School;
• past, present and prospective pupils’ academic, disciplinary, admissions and attendance records (including information about any special needs), and examination scripts and marks;
• nationality and other immigration status information (e.g. right to work / study) including copies of passport information. MCS has student sponsor status.
• where appropriate, information about individuals’ health and welfare, and contact details for their next of kin;
• references given or received by the school about pupils, and relevant information provided by previous educational establishments and/or other professionals or organisations working with pupils;
• correspondence with and concerning pupils and parents past and present; and
• images of pupils (and occasionally other individuals) engaging in school activities, and images captured by the school’s CCTV system (in accordance with the school’s policy on taking, storing and using images of children).

HOW THE SCHOOL COLLECTS YOUR DATA

Generally, the school receives personal data from the individual directly (including, in the case of pupils, from their parents). This may be via a form, or simply in the ordinary course of interaction or communication (such as email or written assessments).

However in some cases personal data will be supplied by third parties (for example another school, or other professionals or authorities working with that individual).

WHO HAS ACCESS TO PERSONAL DATA AND WITH WHOM IT IS SHARED

For the most part, personal data collected by the school will remain within the school, and will be processed by appropriate individuals in the context of providing the necessary care and education that the pupil requires. However, some functions are outsourced including catering, educational visits and IT. In accordance with data protection law, this type of external data processing is always subject to contractual assurances that personal data will be kept securely and used only in accordance with the school’s specific directions.

Occasionally, the school will need to share personal information relating to its community with third parties, such as but not limited to:

• professional advisers (e.g. lawyers, insurers, PR advisers and accountants);
• government authorities (e.g. HMRC, DfE, Police, Home Office, a relevant public health / NHS body and / or the local authority);
• appropriate regulatory bodies e.g. the Independent Schools Inspectorate, the Information Commissioner, the Charity Commission, NCTL;
• organisations essential for the ongoing education and welfare of our pupils, for example examination awarding bodies, the Joint Council for Qualifications (JCQ), universities and UCAS.
• relevant authorities such as the Local Authority Designated Officer (LADO) and the police in the event of a safeguarding referral. For further information about this, please view the school’s Safeguarding Policy;
• a child’s new school or college, should they leave the School. KCSIE requires that the child’s child protection file be promptly provided to the new organisation, along with any other information which the School’s Designated Safeguarding Lead considers material to the ongoing care needs of any pupil. For further information about this, please view the school’s Safeguarding Policy. It should be noted that data protection legislation does not prevent the sharing of information for the purposes of keeping children safe and promoting their welfare.

The Admissions office, that department of the school covering all processes relating to admission to the school, holds information on prospective, current and former pupils and their parents. This information comes primarily from the registration forms and/or any correspondence we may have with candidates and their parents, however in some cases personal data will be supplied by third parties (for example the prospective pupil’s current school). We will collect and use this information because we have a contractual obligation to consider your application, because we are subject to various regulations such as the Equality Act, because we consider that we have a legitimate interest in assessing applicants and making decisions regarding a candidate’s application to join the school, because we would like to provide candidates with appropriate support throughout the admissions process, or because you have consented to its use.

We use the data to inform the admissions process and to make decisions regarding a candidate’s application to join the school.

TYPES OF DATA PROCESSED BY THE SCHOOL

This will include by way of example:

• Contact details
• Details of current and previous school(s) attended
• Details about the pupil and family and other personal data supplied to the school including date of birth, ethnicity, religion, gender
• Copy of pupil’s passport
• Copy of pupil’s visa if applicable
• Copies of parents’ passports, and visas if applicable
• Information about interests, hobbies and extra-curricular activities that the school has been notified of and/or in support of scholarship applications
• Reference from current school
• Results of admissions tests taken at the school
• Details of issues regarding fee payment at current school (if appropriate)
• Details of visits to the school
• Any transaction carried out for registration and acceptance payments and direct debit collection of fees
• Medical history
• Diagnostic reports and/or documents relating to educational, medical and behavioural requirements and assessments
• Information relating to support in place at a prospective pupil’s current school
• Court orders regarding custody arrangements
• Financial data provided in support of bursary applications
• External exam results (GCSE and other equivalent)

KEEPING IN TOUCH

The school and Admissions office will use the contact details of prospective parents to keep them updated about the admissions process by sending updates via email.  The school will also contact parents to invite them to attend school events where appropriate.

Should you wish to limit or object to receiving communications from the school, or would like further information about them, please email data@mcsoxford.org.  You always have the right to withdraw consent or otherwise object to direct marketing, however the school is nonetheless likely to retain some of your details to maintain a suppression record.

This notice applies to staff at the school, including: employees, governors, contractors, visiting music teachers and other peripatetic workers, casual workers, temps, and volunteers who may be employed or engaged by the school to work for it in any capacity, as well as prospective applicants for roles.

Please note that, even if this Notice applies to you, references to “employment”, “staff” etc. in this Notice are not intended to imply or confer any employment rights on you if you are a contractor, non-employed worker, or job applicant.

Please note that any contract you may have with the school will be relevant to how the school processes your data, in accordance with any relevant rights or obligations under that contract. However, this Staff Privacy Notice is the primary document by which we notify you about the use of your personal data by the school.

HOW THE SCHOOL COLLECTS YOUR DATA

We may collect your personal data in a number of ways, for example:

• from the information you provide to us before making a job application, for example when you come for an interview;
• when you submit a formal application to work for us, and provide your personal data in application forms and covering letters, or when you complete a self-declaration, etc.; and
• from third parties, for example the Disclosure and Barring Service (DBS) and referees (including your previous or current employers or school), or from third party websites (as part of online suitability checks for shortlisted candidates) or (if you are a contractor or a substitute) your own employer or agent, in order to verify details about you and/or your application to work for us.

More generally, during the course of your employment with us, as a member of staff, we will collect data from or about you, including:

• when you provide or update your contact details;
• when you or another member of staff completes paperwork regarding your performance appraisals;
• in the course of fulfilling your employment (or equivalent) duties more generally, including by filling reports, note taking, or sending emails on school systems;
• in various other ways as you interact with us during your time as a member of staff, and afterwards, where relevant, for the various purposes set out below.

TYPES OF PERSONAL DATA PROCESSED BY THE SCHOOL

We may collect the following types of personal data about you (and your family members and ‘next of kin’, where relevant):

• contact and communications information, including:

• your contact details (including email address(es), telephone numbers and postal address(es);
• contact details (through various means, as above) for your family members and ‘next of kin’, in which case you confirm that you have the right to pass this information to us for use by us in accordance with this Privacy Notice;
• records of communications and interactions we have had with you;

• biographical, educational and social information, including:

• your name, title, gender, nationality and date of birth;
• your image and likeness, including as captured in photographs taken for work purposes;
• details of your education and references from your institutions of study;
• lifestyle information and social circumstances;
• your interests and extra-curricular activities;
• information in the public domain, including information you may have posted to social media, where relevant to your role (e.g. as part of pre-employment screening);

• financial information, including:

• your bank account number(s), name(s) and sort code(s) (used for paying your salary or invoices and processing other payments);
• your tax status (including residence status);
• Gift Aid declaration information, where relevant (for example, where we help you to administer donations to charity from your pre-taxed earnings);
• information related to pensions, national insurance, or employee benefit schemes;

• work related information, including:

• details of your work history and references from your previous employer(s);
• your personal data captured in the work product(s), notes and correspondence you create while employed by or otherwise engaged to work for the school;
• details of your professional activities and interests;
• your involvement with and membership of sector bodies and professional associations;
• information about your employment and professional life after leaving the school, where relevant (for example, where you have asked us to keep in touch with you);
• nationality and other immigration status information (i.e. about your entitlement to work in the UK), including copies of passport information (if applicable);
• information about your use of our information and communications systems;
• CCTV footage and swipe card records;

• and any other information relevant to your employment or other engagement to work for the school.

Where this is necessary for your employment or other engagement to work for us, we may also collect special categories of data, and information about criminal convictions and offences, including:

• information revealing your racial or ethnic origin;
• trade union membership, where applicable;
• information concerning your health and medical conditions (for example, where required to monitor and record sickness absences, dietary needs, or to make reasonable adjustments to your working conditions or environment);
• information concerning your sexual life or orientation (for example, in the course of investigating complaints made by you or others, for example concerning discrimination); and
• information about certain criminal convictions (for example, where this is necessary for due diligence purposes, whether by self-declaration or otherwise, or for compliance with our legal and regulatory obligations);

However, this will only be undertaken where and to the extent it is necessary for a lawful purpose in connection with your employment or other engagement to work for the school.

WHY THE SCHOOL NEEDS TO PROCESS PERSONAL DATA

(i) Entering into, or fulfilling, our contract with you

We process your personal data because it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, such as a contract of employment or other engagement with us. In this respect, depending on your role and status, we are likely to use your personal data for the following purposes:

• administering job applications and, where relevant, offering you a role with us;
• carrying out due diligence checks on you, whether during the application process for a role with us or during your engagement with us, including by checking references in relation to your education and your employment history and obtaining any required self-declarations;
• once you are employed or engaged by us in any capacity, for the performance of the contract of employment (or other agreement) between you and us;
• to pay you and to administer benefits (including pensions) in connection with your employment or other engagement with us;
• monitoring your attendance and your performance in your work, including in performance appraisals;
• promoting the school to prospective parents and others, including by publishing the work product(s) you create while employed by or otherwise engaged to work for the school;
• for disciplinary purposes, including conducting investigations where required;
• for other administrative purposes, for example to update you about changes to your terms and conditions of employment or engagement, or changes to your pension arrangements;
• for internal record-keeping, including the management of any staff feedback or complaints and incident reporting; and
• for any other reason or purpose set out in your employment or other contract with us.

(ii) Legitimate Interests 

We process your personal data because it is necessary for our (or sometimes a third party’s) legitimate interests. Our “legitimate interests” include our interests in running the school in a professional, sustainable manner, in accordance with all relevant ethical, educational, charitable, legal and regulatory duties and requirements (whether or not connected directly to data protection law). In this respect, depending on your role and status, we are likely to use your personal data for the following:

• providing you with information about us and what it is like to work for us (where you have asked for this, most obviously before you have made a formal application to work for us);
• for security purposes, including by operating security cameras and swipe entry points in various locations on the school’s premises;
• to enable relevant authorities to monitor the school’s performance and to intervene or assist with incidents as appropriate;
• to provide education services to pupils, including where such services are provided remotely (either temporarily or permanently);
• to safeguard staff and pupils’ health and welfare and provide appropriate pastoral care;
• to carry out or cooperate with any school or external complaints, disciplinary or investigatory process;
• for the purposes of management planning and forecasting, research and statistical analysis;
• in connection with organising events and social engagements for staff;
• making travel arrangements on your behalf, where required;
• contacting you or your family members and ‘next of kin’ for business continuity purposes, to confirm your absence from work, etc.;
• publishing your image and likeness in connection with your employment or engagement with us;
• to monitor (as appropriate) use of the school’s IT and communications systems in accordance with the school’s Computer Usage and Internet Access Policy – Staff and government guidance such as KCSIE.

(iii) Legal Obligations

We also process your personal data for our compliance with our legal obligations, notably those in connection with employment, charity law, tax law and accounting, and child welfare. In this respect, depending on your role and status, we are likely to use your personal data for the following:

• to meet our legal obligations: for example, relating to child welfare (including following the requirements and recommendations of KCSIE), social protection, diversity, equality, and gender pay gap monitoring, employment, immigration / visa sponsorship compliance and health and safety);
• for tax and accounting purposes, including transferring personal data to HM Revenue and Customs to ensure that you have paid appropriate amounts of tax, and in respect of any Gift Aid claims, where relevant;
• for the prevention and detection of crime, and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.

(iv) Special categories of data

Depending on your role and status, we process special categories of personal data (such as data concerning health, religious beliefs, racial or ethnic origin, sexual orientation or union membership) or criminal convictions and allegations (treated for these purposes as special category data) for the reasons and purposes set out below.

In particular, we process the following types of special category personal data for the following reasons:

• your physical or mental health or condition(s) in order to record sick leave and take decisions about your fitness for work, or (in emergencies) act on any medical needs you may have. This may include Covid-19 (or similar) testing: including managing on-site testing and/or processing the results of tests taken by staff, and sharing this information with relevant health authorities;
• recording your racial or ethnic origin in order to monitor our compliance with equal opportunities legislation;
• trade union membership, in connection with your rights as an employee, agent or contractor and our obligations as an employer or engager of your services;
• categories of your personal data which are relevant to investigating complaints made by you or others, for example concerning discrimination, bullying or harassment, or as part of a complaint made against the School;
• data about any criminal convictions or offences committed by you, for example when conducting criminal background checks with the DBS, or via a self-declaration, or where a matter of public record (online or by any media), or where it is necessary to record or report an allegation (including to police or other authorities, with or without reference to you);

We will process special categories of personal data for lawful reasons only, including because:

• you have given us your explicit consent to do so, but only in circumstances where seeking consent is appropriate;
• it is necessary to protect your or another person’s vital interests, for example, where you have a life-threatening accident or illness in the workplace and we have to process your personal data in order to ensure you receive appropriate medical attention;
• it is necessary for the purposes of carrying out legal obligations and exercising legal rights (both yours and ours) in connection with your employment or engagement by us;
• it is necessary in connection with some function in the substantial public interest, including:
  • the safeguarding of children or vulnerable people; or
  • to prevent or detect unlawful acts; or
  • as part of a function designed to protect the public, pupils or parents from seriously improper conduct, malpractice, incompetence or unfitness in a role, or failures in services by the School (or to establish the truth of any such allegations); or
  • or to cooperate with a relevant authority, professional or regulatory body (such as the Independent Schools Inspectorate, the Department for Education, the Local Authority Designated Officer or the Teaching Regulation Agency) in such matters
• to comply with public health requirements (e.g. in respect of Covid-19 (or in similar circumstances); or
• it is necessary for the establishment, exercise or defence of legal claims, such as where any person has brought a claim or serious complaint against us or you.

(v) Low-level concerns about adults

We will process personal data about you, whether or not it constitutes special category data, in accordance with our safeguarding policy here. This will be processed for the same safeguarding and/or employment law reasons as set out above.

Such records are subject to the rules on retention set out in the school’s Low-Level Concerns Policy (incorporated within the safeguarding policy), and you have the same rights in respect of that information, as any other personal data that we hold on you. However, any requests to access, erase or amend personal data we hold in accordance with this policy may be subject to necessary exemptions, for example if we consider that compliance with the request might unreasonably impact the privacy rights of others or give rise to a risk of harm to children.

As a general rule, records of low-level concerns will be kept at least until the termination of your employment, but may need to be retained longer: e.g. where relevant, individually or cumulatively, to any employment, disciplinary or safeguarding matter. Low-level concerns will not be included in references unless they relate to issues which would normally be included in references, for example, misconduct or poor performance. A low-level concern which relates exclusively to safeguarding (and not to misconduct or poor performance) will not be referred to in a reference.

SHARING YOUR INFORMATION WITH OTHERS

For the purposes referred to in this privacy notice and relying on the grounds for processing as set out above, we may share your personal data with certain third parties. We may disclose limited personal data (including in limited cases special category or criminal data) to a variety of recipients including:

• other employees, agents and contractors (eg third parties processing data on our behalf as part of administering payroll services, the provision of benefits including pensions, IT etc. – although this is not sharing your data in a legal sense, as these are considered data processors on our behalf);
• DBS and other government authorities (e.g. HM Revenue and Customs, DfE, CAFCASS, police, Home Office, a relevant public health body and/or local authority) and/or appropriate regulatory bodies e.g. the TRA, the ISI, the Charity Commission;
• external auditors or inspectors;
• our advisers where it is necessary for us to obtain their advice or assistance, including insurers, lawyers, accountants, or other external consultants;
• third parties and their advisers in the unlikely event that those third parties are acquiring or considering acquiring all or part of our school, or we are reconstituting or setting up some form of joint working or partnership arrangement in the unlikely event that those third parties are acquiring or considering acquiring all or part of our school, or we are reconstituting or setting up some form of joint working or partnership arrangement in the UK or abroad;
• when the school is legally required to do so (by a court order, government body, law enforcement agency or other authority of competent jurisdiction), for example HM Revenue and Customs or police.

We may also share information about you with other employers in the form of a reference, where we consider it appropriate, or if we are required to do so in compliance with our legal obligations. References given or received in confidence may not be accessible under your UK GDPR rights.

The Waynflete Office, that department of the school covering Alumni Relations (Old Waynfletes or OWs) and Fundraising Activities, holds information on former pupils, parents of current and former pupils and others connected with the school, such as former staff or supporters, as we believe it is in the school’s legitimate interests to process this data.

We use the data to keep these individuals connected with one another and with the School, to organise alumni events, for the purpose of donor due diligence and in support of the School’s activities, including sport, trips, careers, outreach and fundraising programmes. We also collect information from publicly available sources about parents’ and former pupils’ occupation, relevant interests and activities, in order to maximise the school’s fundraising potential.

TYPES OF DATA PROCESSED BY THE SCHOOL

This will include by way of example:

• contact details;
• details of OWs’ education and interests while at school;
• photographic images of OWs and the school community;
• details about family and other personal data supplied to the school;
• communications preferences;
• financial information about gifts to the school, willingness to make gifts, and information on ability to offer financial support based on publicly available sources;
• career information and highlights, based on information from individuals and other public sources, such as LinkedIn and Companies House;
• other interests or extracurricular activities that the school has been notified of, or which are available through public websites or publications; and
• information about your engagement with digital communications from the Waynflete Office and about any financial transactions carried out on or in relation to gifts or purchases made of our goods or services.

The Waynflete Offices uses third-party suppliers such as wealth screening consultants, secure payment services providers, mailing houses and software providers. The school shares personal data with these suppliers only to the extent necessary for carrying out the School’s instructions. We do not allow our third-party service providers to use your personal data for their own purposes. All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies.

Should you wish to limit or object to receiving communications from the School, or would like further information, please email data@mcsoxford.org. You always have the right to update the data we hold on you, update your communications preferences or otherwise withdraw your consent to receiving direct marketing or fundraising communications. However, the school is nonetheless likely to retain some of your details to maintain a suppression record.

The OFA will use companies to process data in order to run the Festival of the Arts, including ticketing. These companies include, by way of example, MailChimp, Ticketsolve, SurveyGizmo and SurveyMonkey.

The website may collect and process personal information about users when they complete an online form, apply for services, or correspond with the School. This includes information provided when users request a prospectus or make an online enquiry or application.

The website also collects information about how users including demographic data such as age, location etc., that may be used to inform future marketing efforts. Information regarding the device used to access the site, including internet protocol (IP) address, browser type, time zone setting, and its make, model and operating system may also be collected, along with information about user interactions with the website, such as pages accessed and files downloaded, as a means to monitor and improve the website user experience.

Further information on our use of cookies can be found at the following link: https://www.mcsoxford.org/use-of-cookies/