Introduction
Berkhamsted Schools Group takes the security and the privacy of personal data entrusted to us extremely seriously. We are registered with the ICO (registration number ZA080432) and you can view our record on the ICO’s register here
This Privacy Notice explains how any personal data collected when you visit and interact with our website, is used and protected; it also provides details of your data protection rights and explains how we comply with relevant data protection legislation, including but not limited to the Data Protection Act (2018) and the UK GDPR.
Berkhamsted Schools Group have additional privacy notices that cover the processing of personal data of our pupils, parents, donors and those who use the School’s facilities, such as the Knox-Johnston Sports Centre. Copies of these privacy notices can be viewed and downloaded from our website:
School Policies
This privacy notice also provides contact details for our Data Protection Advisor should you have a concern, complaint or query relating to any data protection matter.
What Information and Personal Data we Collect and why
When you complete one of our online forms, we will ask you to provide us with personal data that can identify you, known as Personally Identifiable Information (PII), such as your name, address, email address, phone number and other contact details, so that we can respond to your enquiry.
Personal data can also include information that relates to you but cannot identify you on its own. Such information may include, for example, details of your device’s operating system, browser, pages viewed, approximate geographical location and your device’s IP address.
This additional information is used by Berkhamsted Schools Group to create general statistics regarding the use of our website, which we use to help us better understand how visitors use the website and help us make improvements to its design and content.
How we use the Personal Data we Collect
Berkhamsted Schools Group will use the personal data submitted and obtained via our website to respond to any enquiries submitted, to better understand how our website is being used, to send correspondence, and from time-to-time email individuals with relevant marketing material.
If you have opted into receiving marketing emails from Berkhamsted Schools Group, then you will always have the ability to unsubscribe from any future emails by using the link provided within our emails.
Berkhamsted Schools Group strives to ensure that the processing of all personal data complies with the key principles of the UK GDPR, namely that any processing of personal data will be:
· Lawful – We will always ensure there is a clear lawful basis for processing your personal data.
· Specific – We will use the personal data for a specific purpose and will not use this for an unconnected, or incompatible purpose.
· Adequate and not excessive – We will only look to collect the personal data we actually need from you. Accurate – We aim to ensure that personal data collected is
· accurate and have processes in place to review and amend personal data to ensure it remains accurate and up to date.
· Kept for no longer than required – We ensure that personal data is kept for no longer than is reasonably required and ensure that personal data is securely deleted in line with our retention policy.
· Processed securely – We ensure that appropriate technical and organisational measures are in place, such as encrypting personal data, and review these regularly.
Berkhamsted Schools Group ensures that we remain accountable to these key principles, and we undertake regular reviews of our systems, our suppliers and working practices to ensure ongoing compliance, and make improvements where required.
Lawful basis for Processing Personal Data
As data controller, Berkhamsted Schools Group needs to have a clear lawful basis for processing personal data.
Our lawful basis for collecting and using the personal data will depend on the personal data concerned and the specific context in which we collect it. However, we will normally collect personal data from you only where we have either your consent to do so, where we need the personal data to fulfil a contract with you, or where the processing is in our legitimate interests, and not overridden by your data protection interests, or fundamental rights and freedoms.
In the event we ask you to provide personal data to comply with a legal requirement, or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal data is mandatory or not, as well as any possible consequences if you do not provide your personal information.
Sharing your Personal Data
Berkhamsted Schools Group does not share any personal data collected through this website with unconnected third-parties, unless there is a clear and compelling legal obligation to do so.
The website uses third-party solutions to provide services on Berkhamsted Schools Group’s behalf to the visitors of our website. For example, Berkhamsted Schools Group uses HubSpot and Formstack, which are used to securely process enquires submitted via our website’s forms. This means that your personal data will be held on systems provided by HubSpot and Formstack as data processors but controlled by Berkhamsted Schools Group as the data controller.
These companies (data processors) are prohibited from using your personal data except for providing these specific services to Berkhamsted Schools Group and are required to maintain the confidentiality and security of your personal data at all times.
In all cases where Berkhamsted Schools Group use such data processors, we explicitly require them to acknowledge such restrictions and the need to adhere to strict contractual and confidentiality obligations, which are detailed within contracts between us, and as required by data protection legislation.
Security of your Personal Data
We use a variety of technical and organisational measures to help protect your Personal Data from unauthorised access, corruption, use or disclosure. We ensure that Personal Data is held on systems located in controlled, redundant and physically secure environments.
All forms submitted via our website are sent securely, and all connections to the website for visitors are encrypted and authenticated. Berkhamsted Schools Group ensures that security tests and reviews are undertaken on a regular basis for its network and systems, which also includes the Berkhamsted Schools Group website.
Berkhamsted Schools Group ensures that all staff undertake regular data protection training and all third-parties we share personal data with to provide services (data processors) are suitably vetted to ensure they also have their own appropriate security measures in place to protect your personal data.
Transfers of Personal Data
Berkhamsted Schools Group use a number of third-party solutions to build and operate our website. When you submit a form via our website, your personal data may be communicated to and processed via systems outside of the UK. We ensure that any such restricted personal data transfers are protected by appropriate safeguards, such as formal adequacy decisions, or via mechanisms such as approved Standard Contractual Clauses (SCCs) as required under data protection legislation.
Retention of Personal Data
How long we keep your personal data can depend on the type of personal data and the reason why this was collected. However, we ensure that personal data is only retained for as long as is reasonably required, before this is securely deleted or in some cases permanently anonymised so this can no longer identify or be linked to you and ceases to be classified as personal data.
Berkhamsted Schools Group is an education provider, with school entry points for children from 5 months to 17 years of age. If you make an enquiry regarding a place for your child at the School, we will only ever retain your contact details, and the details of your child, while our school entry points remain relevant to the age of your child.
This does not restrict your data protection rights, and you are able to ask us to remove your details from our database at any time by emailing us at admissions@berkhamsted.com.
Cookies
In addition to personal data that is actively provided and collected via our enquiry forms, our website also uses cookies. Cookies are small text files that are placed on your device by websites that you visit and are widely used in order to make websites work, or work more efficiently, as well as to provide useful information to the owners of a website.
Whilst our website uses cookies, we have implemented a cookie consent management tool to help our visitors clearly manage their cookie preferences, with the ability to only accept cookies that are “Strictly Necessary”, which are required for the website to work properly.
The cookies we use on this website can include, dependent on your cookie preferences, those used to collect information about how you interact with our website and allow us to remember you and customise your browsing experience, such as preferred language, for future visits.
Further details about the cookies in use and their purpose can be found at the following page of our website.
Social Media Features
Our Website includes Social Media Features, such as the Twitter Like button and Widgets, such as the Share Button or interactive mini-programs that run on our sites. These features may collect your IP address, which page you are visiting on our sites, and may set a cookie to enable the feature to function properly.
This Privacy Notice does not apply to these features and any interactions with these features are governed by the privacy notice and other policies of the companies providing them.
External Websites
Our website provides links to other websites of third-parties. We do not control, and are not responsible for, the content or practices of these other websites, and the provision of such links does not constitute our endorsement of these other websites, their content, their owners, or their practices.
This Privacy Notice does not apply to these other websites, which are subject to any separate privacy and other policies they may have.
Automated Individual Decision-Making, including Profiling
Any personal data collected by Berkhamsted Schools Group via our website is not used to undertake any automated decision-making, including profiling, as detailed within Article 22 of the UK GDPR.
Your Data Protection Rights
You have the following data protection rights which may be applicable to our processing of your personal data.
· You can request access, rectification, updates or deletion of your personal data.
· You can object to processing of your personal data, ask us to restrict processing of your personal data, or exercise the right of data portability.
· If we have collected and process your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data that relies on a lawful basis other than consent.
· You also have the right to complain to the ICO about our collection and use of your personal data. Should you wish to make a complaint to the ICO please visit https://ico.org.uk/make-a-complaint/ or call the ICO on (03030) 123 1113. The ICO would normally suggest that any complaint should be initially raised with Berkhamsted Schools Group before making a complaint to them.
To exercise any of these rights, where applicable, or if you need to raise any concerns, please contact our Data Protection Advisor in the first instance at dataprotection@berkhamsted.com, or by mail to:
Data Protection Advisor
Berkhamsted Schools Group
6 Chesham Road
Berkhamsted
HP4 3 AA
We will endeavour to respond to all requests without undue delay, and in any instance within the required timescales.
Our Data Protection Advisor would also like to hear from you if you have any suggestions as to how we can improve this Privacy Notice, or any other aspect of the privacy and data protection information we make available, so please do get in touch.