Privacy

WATFORD GRAMMAR SCHOOL FOR GIRLS
  
PRIVACY NOTICE FOR WATFORD GRAMMAR SCHOOL FOR GIRLS OLD GRAMMARIAN ASSOCIATION (OGA)
 
Watford Grammar School for Girls OGA collects data and information about our pupils (current and former), staff (current and former) and friends of the school – our ‘school community’ – so that we can run effectively as a part of the school’s work.  This privacy notice explains how and why we collect data, what we do with it and what rights data subjects have with regard to this data.

Watford Grammar School for Girls is an Academy Trust school, company number 07348254, registered office at Lady’s Close, Watford, WD18 0AE, registered as a company in England and Wales, and an exempt charity. We are well known for our rich academic curriculum, our strong and supportive pastoral care, and the wide range of extended activities that, taken as a whole, educate, encourage and empower our girls. The school motto is Sperate Parati - or ‘Go forward with preparation’ - which encapsulates our aim for every member of the school community.

We are proud of the strong academic traditions and the importance of service to others that have shaped the ethos of our school since its foundation by Elizabeth Fuller in 1704. We value hard work and nurture scholarship, always encouraging our girls to achieve excellence in all fields of study. The girls have the opportunity to excel at music, drama and sport, as well as to play an active role in the wider community by taking part in many charitable activities. Thus they learn to be their best selves: hard working, compassionate and high achieving in all areas of life.

We are a diverse and thriving community, founded on consideration, toleration and trust. Each girl is given opportunities to develop confidence and resilience both in and outside the classroom, and to develop a sense of personal responsibility that is best summarised in the maxim ‘I can do it, and I will do it' - words which every member of the school learns and takes to heart.

As part of ensuring the effective running of our school we support our school community staying in touch with the school and with fellow community members – through the Old Grammarian Alumnae (OGA) organisation. In order to do this, we need to hold and use data and information about our school community. It is important to us that we do this professionally and in line with our statutory, moral and contractual obligations, and this notice is part of how we explain how we do this. Legally the school is a Data Controller under the Data Protection Act 2018 / the UK General Data Protection Regulation with respect to the OGA and to its website, the School is registered as such with the Information Commissioner, and the responsible officer at the school is Michael Lewis who is Data Protection Officer.

If you visit our OGA website and continue to use it, you consent to this Privacy Policy, our website terms and conditions and our Cookie Policy. If you ask us to join you to the OGA by means other than the website, or maintain your membership outside of the website, you are also consenting to the terms of this Privacy Policy.
 
 

Last updated: July 2022

Why do we collect and use information as part of the work of the Old Grammarian Alumnae?
 
Under the UK General Data Protection Regulation (GDPR) / Data Protection Act 2018, the school as Data Controller must have a lawful basis (under Article 6 of the UK GDPR/ Data Protection Act 2018) for all its collection and use of data, and make that clear as part of this notice.

We collect and use information about our school community under the following lawful basis:

where we have the consent of the data subject - and please note that in line with best practice it is considered that children under 13 cannot give their own consent; 

where it is necessary for compliance with a legal obligation; 

where processing is necessary to protect the vital interests of the data subject or another person; 

where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

We do not generally process personal data on the ‘legitimate interests’ basis allowed for under the UK GDPR. If we do ever do this, we will carry out a Legitimate Interests Assessment first in line with the requirements of the Information Commissioner’s Office, and only use this basis should it be justified under that Assessment. See our Data Protection Policy for further information

Where the personal data we collect about members of our school community is sensitive personal data, we will only process it where lawful under Article 9 of the UK GDPR / Data Protection Act 2018, for example where:

we have explicit consent;

processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; and / or

processing is necessary for reasons of substantial public interest, on the basis of UK  law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Please see our Data Protection Policy for a definition of sensitive personal data.

We use the data which we collect from or about members of our school community to support the work of the OGA, via the OGA website or otherwise, and in particular:
 

to provide services that you request as part of signing up to or visiting our website, or to membership of the OGA, including updating you on any changes or improvements to the service, and staying in touch;

creating your user profile;

subscribing you to any of our newsletters that you request;

to support your participation in discussion boards or forums as and when you wish to participate;

to enter you in a competition or facilitate your participation in a survey or other activity which you wish to participate in;

to provide you with products, services or content where you have specifically requested this (please note that we only use your data for marketing purposes if you have specifically consented to this)

if and when you ever report a problem with our website

 

The categories of OGA member information that we collect, hold and share include:
 

Personal information (such as name, contact details, dates at the school, qualifications) which are provided at the start of your participation in the OGA and which you may update or add to from time to time;

Information about any interests or career you have developed and you tell us about;

Information relating to your participation in and preferences for activities run by the OGA

Information related to your use of the OGA site, in particular IP address, web browser type, URLs of websites viewed before and after viewing the OGA site. Please note that this information is normally fully anonymised and therefore does not constitute personal data for the purposes of this Privacy Notice – we include this note here in the interest of transparency

  
Consent to the OGA’s processing of personal data
 
When you participate in the OGA’s activities, use or sign up to its website, or to membership by any other means, you consent to us processing the personal data you provide. You may withdraw consent at any time. We will record how and where consent is given or declined, usually via our external provider’s website consent preference management system.
 
Where OGA members are under 18, they are deemed to be old enough to make their own decisions in relation to their personal data from the age of 13 in line with the UK GDPR standard. Children with the maturity to make their own decisions about their personal data may withdraw consent if consent has previously been given.
 
 
Retention of OGA data
 
The school holds all data for the periods outlined in our Data Retention Policy, including for some periods of time after a member of our school community leaves the school or leaves membership of the OGA. A copy of this policy can be obtained upon request from the Data Protection Officer. Data retention is carried out in line with the best practice promoted by relevant professional bodies, and currently follow the data retention guidelines in the Information and Records Management Society (www.irms.org.uk) Toolkit for Schools.
 
The bulk of our OGA data is stored electronically. Data stored electronically may be saved on a cloud based system which may be hosted overseas, including outside of the UK. If this happens we will take steps to ensure that the data is managed and protected as if it were covered by the same protections which apply in the UK.
 
Personal data may be transferred to other countries, for specific essential purposes – if, for example, we are arranging a school trip overseas. Appropriate steps will be taken to keep the data secure.
 

Who do we share OGA member information with?
 
We will only share information in line with the consents you give us as you sign up to join the OGA or use the OGA website, or as you amend or add to these from time to time. If you do not use the website, you can check or amend your consents by emailing oldgrammarians@watfordgirls.herts.sch.uk
 
We will normally share information about you with other members of the OGA in line with the principles and objectives of running the organisations. You have the right to ask us not to do this.
 
The OGA website is provided by an external contractor, and as part of this service they are also a Data Controller in their own right. As a result we are jointly controllers of your personal data and may be jointly liable in the event of any data breaches. The current provider is Toucan Tech (https://www.toucantech.com) .
 

Information Security
 
Please note that if you use the OGA website and you choose to use access parts of it via setting a user account and password, you are responsible for keeping your password safe and secure. We ask you not to share it with anyone.
 
Please see the School’s Information Security Policy for further information on how we keep information and data in our care secure.
 
A copy of the Information Security notice provided by Toucan (operators of our OGA software) can be obtained on request from the Data Protection Officer, Michael Lewis.
 
Please note that we reserve the right to review messages sent through the OGA website for security monitoring purposes.
 
Please note that our website may contain links to other sites – for example websites belonging to partner organisations, commercial providers, advertisers or affiliates. If you follow any of these links to other sites, please note that these will have their own Privacy Policy or similar arrangements and that we do not accept any responsibility or liability for these policies. Please check the policies before you submit any personal data to external sites.
 

Cookies
 
Our website uses cookies for such purposes as distinguishing you from other users of our website, providing you with a seamless experience, and continually improving our website. For detailed information on the cookies we use and the purposes for which we use them, see our Cookie Policy.


Requesting access to your personal data
 
Under data protection legislation, members of the OGA have the right to request access to information about them that we hold (“Subject Access Request”).  From the age of 13, we generally regard children as having the capacity to exercise their own rights in relation to their personal data.  This means we will require a Subject Access Request to be made by the child and not their parent(s) on their behalf.  This does not affect any separate statutory right parents might have to access information about their child.
 
Subject to the section below, the legal timescale for the School to respond to a Subject Access Request is one calendar month.  As the School has limited staff resources outside of term time, we encourage OGA members to submit Subject Access Requests during term time and to avoid sending a request during periods when the School is closed or is about to close for the holidays where possible.  This will assist us in responding to your request as promptly as possible.  For further information about how we handle Subject Access Requests, please see our Data Protection Policy.
 
No fee usually required
 
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
 
What we may need from you
 
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
 
You also have the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress;

prevent processing for the purpose of direct marketing;

object to decisions being taken by automated means;

in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and

claim compensation for damages caused by a breach of our data protection responsibilities.

 
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance, or if you need to contact the Information Commissioner’s Office directly please visit https://ico.org.uk/concerns/
 
RIGHT TO WITHDRAW CONSENT
 
In the circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent please contact the Data Protection Officer. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
 
CHANGES TO THIS PRIVACY NOTICE
 
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information
 
Contact:
If you would like to discuss anything in this privacy notice, please contact the Data Protection Officer, Michael Lewis, at the school.