Privacy Policy

Privacy Notice for Pupils and Parents
1. Introduction
The UK General Data Protection Regulation (UK GDPR) includes rules on giving privacy information
to those whose data is held (data subjects) by an organisation (the data controller). These rules
are more detailed and specific than in the DPA and place an emphasis on making privacy notices
understandable and accessible. Data controllers are expected to take ‘appropriate measures’ to
ensure that this is the case.
The Alpha Plus Group Limited (company number: 438111), as the data controller, interprets this as
using very clear language to outline each of the responsibilities for each of the data subject
groups.
The purpose of this policy is to inform on how the schools and colleges that are part of the Alpha
Plus Group collect and use personal data on pupils. This notice will also inform which third
parties the school or college may share your personal data with.
The registered office of Alpha Plus Group is 50 Queen Anne Street, London, W1G 8HJ. The Group’s
Data Protection Officer can be contacted at this address, by telephoning 020 7487 6000 or by
emailing dpo@alphaplusgroup.co.uk.
2. How we use your information
The Alpha Plus Group is the data controller for all schools and colleges within the Group and will only
process your personal data in accordance with this privacy policy notice and in accordance with the
current Data Protection legislation (the Data Protection Act 2018).
The group takes it duties and responsibilities under the Legislation extremely seriously and will only
keep your data for as long as necessary bearing in mind the purposes for which your personal data is
collected. Further information on how long we retain data can be found on our Data Retention
Policy available from our Data Protection Office at the above address. We are registered with the
Information Commissioners Office (ICO) with the registration number Z5215334.
This notice may be updated from time to time to ensure continued compliance with current
legislation and to reflect best practice.
3. What information is being collected about pupils and their
parents/guardians
The types of personal and sensitive personal data the school or college may process include:
 Name and contact information such as address, email and telephone number of the pupil,
parent, guardian and fee payer.
2
 Pupil date and country of birth, ethnicity and country of domicile, passport number or
national identity card details and visa status.
 Information relating to pupil education history such as previous schools and education
institutions, courses completed, dates of study, attendance records and examination results.
As part of this, we may collect references from previous schools or education establishments
as required by the application process.
 Information relating to fees such as banking details, scholarships and bursaries.
 Information which may assist with provision for the appropriate medical and pastoral care of
the pupil such as any disability, medical, or dietary issues. This may also include information
about family or personal circumstances where this is relevant to the assessment of
suitability to receive a bursary.
 A photograph of the pupil will be kept. This will be for identification purposes only and we
will seek consent for any other usage.
4. How and why information is collected
When you first contact the Group, by telephoning us or looking at our websites, you may be invited
to complete an Enquiry or Application form. This information will be recorded and may be followed
up by our Marketing and Admissions departments in order to provide you with further pertinent
information or to further your admission process.
Through the course of the admission process personal data is recorded by the group to enable the
school or college to care for the pupil and to fulfil its contractual obligations in the delivery of
studies. It may also be collected to fulfil legal obligations and/or the regulatory duties that it owes to
its regulators and to other third parties.
The primary method the Group uses to collect personal data throughout this time will be from the
information contained on the application form and associated documents completed when joining
the school or college along with:
 Information provided whilst the pupil is attending the school or college relating to their
studies.
 Information received from previous places of education (whether part of the Group or not).
 Information generated during the course of studies and time at the school (e.g. attendance,
academic achievement, behaviour or safeguarding information).
 Information provided by the Home Office or other third party in relation to status as a home
or international pupil.
 Information provided by a third party in relation to funding (for example for bursaries or
scholarships).
5. How personal data is used/processed
The primary use of the personal data we collect is to support the learning and development of pupils
during their time at schools or colleges in the Group, whilst ensuring the wellbeing and safeguarding
of the pupils.
3
We will process personal data because it is necessary for the performance of a contract with you,
or prior to admitting pupils, in order to take steps towards entering into a contract with you. We
will use your data in order to:
 Communicate with you before enrolment of a pupil, as part of the admissionsprocess.
 Provide suitable provision and services for the pupil following admission.
 Deal with any feedback or concerns you may have.
 Provide educational services which may not be set out in our Agreement but which are
nevertheless a part of our academic and educational mission.
 Monitor and evaluate the performance and effectiveness of ourschool/college.
 Carry out research and statistical analysis.
 Maintain and improve the academic, corporate, financial, estate and human resource
management of the school/college.
 Promote equality and diversity.
 Seek advice on our rights and obligations, for instance where we require our own legal
advice.
 Recover monies owed to us
 Fundraising purposes
To comply with our legal obligations we may use your personal data in order to:
 Meet our compliance and regulatory obligations, such as compliance with anti-money
laundering laws and safeguarding requirements.
 For the prevention and detection of crime.
 To assist with investigations, including criminal investigations carried out by the police and
other competent authorities.
We may also process your personal datawhere:
 It is necessary for medical purposes (e.g. medical diagnosis, provision of health or social care
or treatment, or a contract with a health professional.
 It is necessary to protect the vital interests of the pupil or another person.
 We have a legitimate business interest to do so.
 We have the specific or where required explicit consent of the data subject to doso.
Where we believe there is a legitimate interest we may also contact parents or pupils to promote
our services on matters such as openings on waiting lists at sister schools, opportunities within
the Parent Teacher Associations or friends of the school, or for Alumni events and activities. You
may request to be excluded from data being processed in this way.
We may ask for your consent to use your information in certain ways as an alternative to relying on
any of the legal bases set out in this notice and in the UK GDPR. For example, we may ask for the
pupil’s consent and or his/her parents’ consent before taking or using some photographs and videos
if the photograph or video is more intrusive and we cannot rely on legitimate interests. If we ask for
consent to use personal information the individual can take back this consent at any time.
Any use of information before consent is withdrawn remains valid. Please contact our DPO
(dpo@alphaplusgroup.co.uk) if you would like to withdraw any consent that you have given.
4
Sensitive Personal Data
Some of the personal data the Group processes will be “sensitive personal data”. This category of
personal data will be subject to additional protections. Sensitive personal data is defined as
information about racial or ethnic origin, political opinions, religious or similar beliefs, trade union
membership, physical or mental health condition, sexual life, or commission of or proceedings for
any offence committed or alleged to have been committed.
This information may be processed for one of the reasons set out in the previous section.
Information concerning a pupil’s physical or mental health may be disclosed within the Group so
that a proper level of care and facilities may be provided. It will only be sent to individuals who
need to know this information to provide support.
In addition, sensitive personal data may be collected to meet government requirements, to
monitor our equal opportunities policies and to ensure that under-represented groups receive
appropriate support. This information may also be collected and retained in anonymised format for
statistical purposes.
6. Who personal data may be shared with
In processing personal data and/or sensitive personal data, the school or college may have reason
to share personal data and/or sensitive personal data with a third party. Where this is required the
third party will have been assessed to ensure they have appropriate procedures in place to protect
the data, and only the data required to fulfil the specific purpose shall be passed.
Some of these circumstances are as follows:
 Disclosures connected with safeguarding and SEN support – e.g. local authorities,
educational psychologist or speech therapist.
 School nurse (where the school nurse is not direct employed by thegroup).
 CAMHS (Child and Adolescent Mental Health Service).
 The Local Authority as and when required under education legislation.
 The Department for Education (DfE) as required underlegislation.
 Other agencies or organisations when required under regulatory legislation only.
 Where a bursary or scholarship has been applied for with the funding organisation – such as
the Gold Standard Charitable Trust.
 For international pupils with the Home Office where required.
 Catering and boarding suppliers – e.g to ensure that allergies can be taken into account
when preparing meals.
 IT suppliers – to allow the creation of accounts for various IT systems used within the group.
 Where we consider there to be a risk to yourself or others we may share limited information
both internally and with relevant third parties (e.g Ambulance, Police, NHS trusts etc) to
ensure appropriate support is available.
 Examination boards/assessment centres.
 Exit/destination schools (including references).
 Where we have your consent we may share data with marketing service providers for the
purpose of creating marketing assets (e.g. brochures, promotional videos).
Sensitive personal data will never be shared outside the Group without the explicit permission of
the data subject other than under those conditions specified under Data Protection Law such as to
protect the vital interests of the data subject, another person, or under law or court order.
5
Sending information to other countries
We may have need to send your information to countries which do not have the same level of
protection for personal information as there is in the UK. For example, hotels for school trips.
The European Commission has produced a list of countries which have adequate data protection
rules. The list can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/datatransfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en
If the country that we are sending your information to is not on the list, or is not a country within the
EEA (which means the European Union, Liechtenstein, Norway and Iceland), then it might not have
the same level of protection for personal information as there is in the UK.
We will ensure that appropriate safeguards are applied to continue to protect data. If you have
any questions about the safeguards that are in place please contact our DPO.
(dpo@alphaplusgroup.co.uk).
7. What happens after you leave the school or college
On conclusion of studies, the school or college will retain a certain amount of personal and financial
data, including some sensitive data, to meet regulatory and legal requirements. We will also keep an
archive of information linked to pupil records, such as records on achievements at the school or
college, to allow us to respond to any future requests you may make for information after leaving.
Full details of our Retention Policy can be found on our website.
On leaving the school or college, pupils will become members of the Alumni. Where applicable some
personal data from pupil records will be transferred to the Alumni database. This may include items
such as contact details, sporting interests, and academic details.
We believe there is a legitimate interest in using this information to keep you in touch with the
school, staff and peers. Where this is not required the data subject can opt out via the Alumni
system as required.
8. Your right to access your personal data
You have a number of rights in relation to your data under the data regulation. These are:
 The right of access
You may request a copy of the personal data that we hold on you.
 The right to rectification
You may ask us to correct any information we have about you that you believe is incorrect.
 The right to erasure
You may ask us to delete information that we hold on you. Please note that we cannot
delete data required to be kept for our legislative and regulatory compliance.
 The right to restrict processing
You may ask us to not process or limit the use of your data in some instances. Please note that
we may not be able to comply with requests that contravene our legal and regulatory
obligations.
 The right to data portability
You may ask us to transfer the data to another organisation in a format that makes it easy for
them to use.
 The right to object
You may object, on grounds relating to your particular situation, to any of our particular
processing activities where you feel this has a disproportionate impact on your rights.
6
To exercise any of these rights please contact us at dpo@alphaplusgroup.co.uk giving details of your
request. Please note that the above rights are not absolute and we may be entitled to refuse
requests where exceptions apply under existing Data Protection regulations.
9. Your rights if you are unhappy with the way your data is beinghandled
Where you have given consent to our processing data and wish to withdraw it, please contact the
Group’s Data Protection Officer. Please note that where our processing of your personal data relies
on your consent and where you then withdraw that consent, we may not be able to provide some or
all of our services to you and/or it may affect the provision of those services.
The Group will endeavour to be transparent about its processing of your personal data. However,
should you have any queries you may address them to the Group’s Data ProtectionOfficer.
You also have the right to complain to the Information Commissioner (https://ico.org.uk/concerns)
if you have any concerns in respect of thehandling of your personal data by the Group.
10. Further information
For further information please read our data protection policy and data retention policy.