1.1 OXFORD INTERNATIONAL SCHOOL LTD trading as Oxford International College (OIC), is committed to safeguarding Personal Data. This Privacy Policy is addressed to Parents or Guardians that are responsible for one or more prospective, past or present Student of OIC. It explains how we collect and use your Personal Data and the Personal Data of each Student you are responsible for during the course of our provision of educational and related services to them.
1.2 If you are the Parent or Guardian of a Student who is, or becomes, competent to provide his/her own consent in respect of the processing of his/her personal data, you must provide a copy of this Privacy Policy to them.
1.3 This Privacy Policy is intended to explain our privacy practices and covers the following areas:
What Personal Data do we process;
How we use your Personal Data;
Use of Special Categories of Personal Data / Criminal Convictions Data;
Transmission, storage and security of Personal Data;
Rights relating to Personal Data;
Changes to our PRIVACY POLICY; and
Definitions, Lawful Bases and Contact Details
1.4 By providing your information, or the information of any Student you are responsible for (whether via our website, in person, in writing or over the phone) to us, you acknowledge the processing set out in this Privacy Policy. Further notices highlighting certain uses we wish to make of your Personal Data together with the ability to opt in or out of selected uses may also be provided to you when we collect Personal Data from you.
1.5 Some of the processing activities set out in this Privacy Policy are undertaken by OIC. Other processing activities are undertaken by NAE itself, as the ultimate owner of OIC. The exact split differs between OIC and NAE over time. We can confirm which processing activities are undertaken by which entity, on request of a Student or the Parent or Guardian of a minor Student. Contact details for relevant OIC and NAE entities can be found at Appendix 3.
1.6 This Privacy Policy only relates to processing undertaken by or on behalf of OIC. Whilst our websites may contain links to other third party websites, please note that we do not accept any responsibility or liability for their policies in relation to any Personal Data or their collecting and processing of any Personal Data.
2 What Personal Data do we process?
We may collect and process the following Personal Data about you and any Student you are responsible for:
(a) Biographical and identification information ► including name, gender, nationality, date and place of birth, details of family members, passport and national identity information;
(b) Contact information ► including address(es), telephone number(s), email address(es), emergency contacts;
(c) Student information► this includes admission information (e.g. tests scores), start date, year group, class information, school ID, grades, transcripts of public exams, copies of assignments, classroom observations, information about class participation, learning skills, notes, timetables, transport routes, photographs or videos, and communications with Parents or Guardians, teachers and other Students and information relating to reports made by/concerning Student (e.g. bullying reports etc.).
(d) Financial information ► including bank account and credit/debit card information, and, where applicable, the results of any relevant checks;
(e) Our correspondence ► where we are contacted by you or a Student you are responsible for, we will keep a record of that correspondence;
(f) Website and communication usage ► details of visits to our websites (including use of any educational tools) and information collected through cookies and other tracking technologies including, but not limited to, IP address and domain name, browser version and operating system, traffic data, location data, web logs and other communication data, resources that are accessed and associated telemetry data (e.g. how long you spent watching a video);
(g) Information you have provided to us ► any additional information that you or a Student you are responsible for may provide to us, such as through completing enquiry or feedback forms.
(h) Special Categories of Personal Data and Criminal Convictions Data ► we are, in certain very limited circumstances, required to collect, process and disclose Special Categories of Personal Data and or Personal Data relating to criminal convictions or offences (“Criminal Convictions Data”) of Students: please see section 4 for further information.
3 How we use your Personal Data
3.1 We may process your Personal Data (and that of any Student you are responsible for) manually or electronically (including through our learning tools, which may use the latest technologies such as machine learning).
3.2 Personal Data will only be processed where we have a specific purpose, and a lawful basis, for doing so. These purposes and bases are listed below. An explanation of the scope of the grounds available can be found at Lawful Bases.
(a) To select, onboard and enrol Students ► to process application forms, tests, interviews, travel arrangements and all activities relating to the Student’s enrolment in a School. This may in certain limited circumstances include Special Categories of Personal Data, for example, photographs and video footage of Students, (eg. for identification or security purposes);
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services). In the limited circumstances where we need to process Special Categories of Personal Data or Criminal Convictions Data, we may also rely on explicit consent.
(b) To manage the Student’s academic, sporting and boarding timetable and to provide access to the School’s communication networks► to schedule the Student’s activities and provide access to the School’s intranet and other information storage communication tools;
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services)
(c) To develop and support Students ► To assess and coach Students through dialogue, analysis and record keeping, to support all aspects of their development (including providing insights to students regarding their performance, recording academic progression, helping students understand how they learn and proposing techniques to improve learning) and to assess their suitability for current and future internal and external opportunities. This may in certain limited circumstances include Special Categories of Personal Data, such as:
(i) Political opinions, religious beliefs, ethnicity and race, so that Students can observe religious/cultural celebrations; and
(ii) Sex life or orientation, so that we can advise and respond to any sensitive issues that may arise.
Lawful bases: legal obligation; contract performance; legitimate interests (to enable us to perform our obligations and provide our services); consent (where this information is gathered via cookies or similar technologies). In the limited circumstances where we need to process Special Categories of Personal Data we may also rely on explicit consent
(d) To provide a safe and healthy environment for Students and staff ► this may in certain limited circumstances include Special Categories of Personal Data such as:
(i) Health data, to make provision for disabilities, allergies, illnesses and injuries, including the provision of such information to third parties such as insurers or medical professionals where appropriate; or
(ii) Details of criminal offences, so that we can deal with serious behavioural issues and authorities appropriately.
(iii) Photographs of Students, so that we can identify them onsite
Lawful bases: contract performance; legal obligations; legitimate interests (to enable us to perform our obligations and provide our services). In the limited circumstances where we need to process Special Categories of Personal Data or Criminal Convictions Data, we may also rely on explicit consent, protection of vital interests of you or another person (where you are unable to consent), substantial public interest or legal claims
(e) To conduct extra-curricular programs ► to organise, administer and operate extra-curricular expeditions and activities, including processing payment, which may include passing Personal Data to third parties for relevant insurance cover, medical assistance, supervision and execution of activities;
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services).
(f) To keep Parents and Guardians informed about Students ► To keep Parents updated on Students’ progress (including by providing reports, note correspondence and access to learning systems (e.g. parent portal), opportunities and any issues. In conjunction with Students, Parents or Guardians, liaise with other bodies (educational, sporting or any other sector) in relation to Students;
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services); consent (where this information is gathered via cookies or similar technologies).
(g) To provide newsletters and marketing materials ► to provide you and any Students you are responsible for with updates and offers relating to our products and services, where you have chosen to receive these. Where required by law, we obtain consent to conduct this marketing activity. We will provide an option to unsubscribe or opt-out of further communication on any electronic marketing communication sent to you or you may opt out by contacting us as set out using the details at the end of the Policy;
Lawful bases: legitimate interests (to promote our services); consent.
(h) To ensure that we are paid ► where required, to recover any payments due to us and where necessary to enforce such recovery through the engagement of third party debt collection agencies or taking legal action (including the commencement and carrying out of legal and court proceedings);
Lawful bases: contract performance; legal claims; legitimate interests (to ensure that we are paid for our services).
(i) To improve our services ► to analyse Personal Data in order to better understand your requirements, or those of any Student you are responsible for. This will assist us in tailoring and developing the services we offer;
Legal basis: legitimate interests (to allow us to improve our services).
(j) To support, develop and improve our teaching ► to analyse pseudonymised Personal Data in order to gather insights regarding our teaching which we use to support, develop and improve our teaching including to help us understand and develop our curriculum and to develop and improve our educational products (including our technology tools). The resulting insights, learnings and products (but not the underlying personal data) may be used for education related commercial purposes;
Legal basis: legitimate interests (to allow us to improve our educational products and services); consent (where this information is gathered via cookies or similar technologies).
(k) To monitor certain activities ► to monitor communications to ensure compliance with our internal procedures and any legal requirements;
Lawful bases: legal obligations; legal claims; legitimate interests (to ensure that the quality and legality of our services).
(l) To ensure website content is relevant ► to ensure that content from our websites are presented in the most effective manner for you and any Student you are responsible for;
Lawful bases: contract performance; legitimate interests (to allow us to provide the content and services on the websites).
(m) To reorganise or make changes to our business ► In the event that we are (i) subject to negotiations for the sale of our business or part thereof to a third party, (ii) is sold to a third party or (iii) undergo a re-organisation, we may need to transfer some or all of your and your Student(s)’Personal Data to the relevant third party (or its advisors) as part of any due diligence process or transferred to that re-organised entity or third party and used for the same purposes as set out in this PRIVACY POLICY or for the purpose of analysing any proposed sale or re-organisation;
Lawful basis: legitimate interests (in order to allow us to change and develop our business).
(n) In connection with legal or regulatory obligations ► We may process your personal Data or that of any Student you are responsible for to comply with our regulatory requirements or to engage in dialogue with our regulators. This may include disclosing that Personal Data to third parties, the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so;
Lawful bases: legal obligations; legal claims; legitimate interests (to cooperate with law enforcement and regulatory and public authorities). In the limited circumstances where we need to process Special Categories of Personal Data or Criminal Convictions Data we may also rely on explicit consent or legal claims.
3.3 We may also process personal data (including Special Categories of Personal Data or Criminal Conduct Data) where necessary in relation to the establishment, exercise or defence of legal claims.
Sharing Personal Data with other organisations
3.4 In order to provide our education and schooling services (including extra-curricular activities) effectively, we sometimes need to share information with other organisations. We share information with the following entities:
(a) Our Regional Office Teams, which undertake management functions; and
(b) Our suppliers, who assist us in providing educational and extra-curricular services, including after-school programmes, catering, transportation, our programme partners Julliard, MIT and UNICEF, and IT contractors who help us develop our products and services. A list of our suppliers can be provided upon request by Contacting us;
3.5 Where these entities are outside of the UK, we ensure that there are adequate safeguards in place to ensure the security of your Personal Data. See Export of data outside of the UK for more information.
4 Use of Special Categories of Personal Data / Criminal Convictions Data
4.1 As a general rule, we do not process Special Categories of Personal Data or Personal Data relating to criminal convictions or offences (“Criminal Convictions Data”) of Students, Parents or Guardians. However, in order to provide our education and schooling services (including extra-curricular activities) effectively to you and any Student you are responsible for, we are, in certain very limited circumstances, required to collect, process and disclose such Personal Data, including but not limited to:
(a) Health/medical information (e.g. allergies, disabilities, dietary requirements, records of accidents and illnesses) so that we can maintain a safe environment for all Students;
(b) Political opinions, religious beliefs, ethnicity and race, so that Students can observe religious/cultural celebrations;
(c) Sex life or orientation, so that we can advise and respond to any sensitive issues that may arise; and
(d) Photographs and video footage of Students, (for identification or security purposes); and
(e) Details of criminal offences (including alleged criminal offences) so that we can deal with serious behavioural issues and authorities appropriately and in accordance with our safeguarding obligations.
4.2 In addition to the usual appropriate technical and organisational measures we implement to ensure the security and integrity of the personal data processed by us, we may implement additional measures in relation to Special Categories of Personal Data, as appropriate. These may include segregation, pseudonymisation or restriction of access to the data.
4.3 Where we must process Special Categories of Personal Data and Criminal Convictions Data, we will generally do so on the basis that we are protecting the vital interests of a Student or, for Special Categories of Personal Data, that it is necessary for reasons of substantial public interest.
4.4 Where we cannot rely on an alternative legal basis to justify necessary processing of the data listed above we will either:
(a) Rely on your explicit consent for the collection, processing and disclosure of the above Special Categories of Personal Data on behalf of each Student you are responsible for; or
(b) Where a Student you are responsible for is capable of providing consent with respect to the processing of his/her personal data, rely on his or her explicit consent to our collection, processing and disclosure of the above Special Categories of Personal Data.
4.5 Where a Student you are responsible for is capable of providing consent with respect to the processing of his/her personal data, you agree that you have procured his or her consent to our collection, processing and disclosure of the above Special Categories of Personal Data. Once a Student is competent to provide this consent, we will reaffirm with them any consent previously provided by you on their behalf.
4.6 In any instance where a Student who was deemed to be capable of providing consent acts against his/her own best interests, we will revert to you to obtain your consent on his/her behalf.
4.7 You (or the Student you are responsible for, as applicable) are free to withdraw your consent at any time by contacting us. However, where you do so we may not be able to provide a service that requires the use of such data.
4.8 We may obtain Personal Data from you (or any Student you are responsible for) directly, or from third parties such as other educational or sporting institutions, credit reference and anti-fraud agencies (we will contact you in advance where such checks are necessary), sanctions and politically exposed persons screening lists (in accordance with our regulatory obligations), our business partners and public registers.
5 Transmission, storage and security of Personal Data
Security over the internet
5.1 No data transmission over the Internet or through a website can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic and procedural safeguards to protect your Personal Data, and that of any Student you are responsible for, in accordance with data protection legislative requirements.
5.2 All information you, or any Student you are responsible for, provide to us is stored on our or our suppliers’ secure servers and accessed and used subject to our security policies and standards. We ask that you, or any Student you are responsible for:
5.3 Refrain from sharing any password providing access to certain parts of our websites, applications or systems with any other person; and
5.4 Comply with any other security procedures that we may notify you of from time to time.
Export outside the UK
5.5 NAE is a global network of schools, which includes OIC, and your Personal Data, or that of any Student you are responsible for, may be transferred to, stored in or accessed by staff or suppliers in, a destination outside the UK. Regardless of location, we will impose the same data protection safeguards that we deploy inside the UK.
5.6 Certain countries outside the UK have been approved by the Information Commissioner’s Office as providing essentially equivalent protections to UK data protection laws and therefore no additional safeguards are required to export Personal Data to these jurisdictions. In countries which have not had these approvals, (see the full list here https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/the-uk-gdpr/international-data-transfers/) we will transfer it subject to United Kingdom approved contractual terms (as appropriate) that impose equivalent data protection obligations directly on the recipient, unless we are permitted under applicable data protection law to make such transfers without such formalities.
5.7 Please contact us as set out in paragraph 6.4 / Appendix 3 below if you would like to understand more about where your personal data is located, or to see a copy of the specific safeguards applied to the export of Personal Data relating to you or any Student you are responsible for.
Storage limits
5.8 We will retain Personal Data for as long as is necessary for the processing purpose(s) for which they were collected and any other permitted linked purpose (for example certain transaction details and correspondence may be retained until the time limit for claims in respect of the transaction has expired or in order to comply with regulatory requirements regarding the retention of such data). So if Personal Data is used for two purposes we will retain it until the purpose with the latest period expires; but we will stop using it for the purpose with a shorter period once that period expires. We restrict access to Personal Data to those persons who need to use it for the relevant purpose(s).
5.9 Our retention periods are based on business needs and relevant laws. Records that are no longer needed are either irreversibly anonymised (and the anonymised information may be retained) or securely destroyed.
6 Rights relating to Personal Data
Be aware of the rights that Data Subjects have in relation to their Personal Data
6.1 Data Subjects have a number of rights relating to how their personal data is used. Please be aware that certain exceptions apply to the exercise of these rights and so you will not be able to exercise them in all situations. If you wish to exercise any of these rights we will check your entitlement and respond within a reasonable timescale.
6.2 Students may be able to exercise these rights independently, provided that they have Legal Capacity.
6.3 You have, to the extent applicable, the following rights relating to your Personal Data (and may exercise these rights on behalf of a Student you are responsible for):
b) Rectification: to require us to have inaccurate Personal Data amended or incomplete Personal Data completed;
c) Erasure: to require us to erase Personal Data in certain circumstances. If the Personal Data has been made public, reasonable steps will be taken to inform other controllers that are processing the data that you have requested the erasure of any links to, copies or replication of it.
d) Withdrawal of consent: to withdraw any consents to processing that you have given us and prevent further processing, if there is no other ground under which we can rely to process your Personal Data;
e) Restriction: to require certain Personal Data to be marked as restricted in some circumstances, for example, whilst we resolve a complaint. Restriction means that whilst we still store the data, we will not process it (or will not process it for certain purposes) until such time as the restriction may be lifted;
f) Portability: to have a copy of any Personal Data you have provided to us returned to you, or transmitted to another controller, in a commonly used, machine readable format;
g) Prevent processing: Require us to stop any processing based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your interests, rights and freedoms; and
h) Marketing: require us to stop processing your Personal Data for direct marketing purposes.
i) Raise a complaint: Complain to your local Data Protection Authority about our processing of your Personal Data. Details of your relevant Data Protection Authority can be found at Appendix 3.
6.4 If you would like to exercise any of your rights, or have any queries relating to your rights or exercise of your rights, please contact us using the details set out at Appendix 3.
7 Changes to our Policy
7.1 This Privacy Policy was last updated on 23 May 2024.
Appendix 1: Lawful bases
Use of Personal Data under UK data protection laws must be justified under one of a number of Lawful bases and we are required to set out the Lawful bases in respect of each use in this policy. We note the Lawful bases we use to justify each use of your information next to the use in the “Uses made of your Personal Data” section of this PRIVACY POLICY.
These are the principal Lawful bases that justify our use of your Personal Data:
|
Consent: You have given your consent to the processing of those personal data for one or more specified purposes. You are free to withdraw your consent by contacting us using the details set out at Annex C. Where you do so, we may be unable to provide a service that requires the use of such data. |
|
Contract performance: where your information is necessary to enter into or perform our contract with you. |
|
Legal obligation: where we need to use your information to comply with our legal obligations. |
|
Legitimate interests: where we use your information to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights. |
|
Legal claims: where your information is necessary for us to defend, prosecute or make a claim against you, us or a third party. |
These are the principal Lawful bases that justify our use of Special Categories of your Personal Data, in the limited circumstances where it is necessary to do so:
|
Explicit consent: You have given your explicit consent to the processing of those personal data for one or more specified purposes. You are free to withdraw your consent by contacting us using the details set out at Annex C.. Where you do so, we may be unable to provide a service that requires the use of such data. |
|
Protection of vital interests of you or another person, where you are unable to consent: Processing is necessary to protect the vital interests of you or of another natural person where you are physically or legally incapable of giving consent. |
|
For legal claims: Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity. |
|
In the substantial public interest: Processing is necessary for reasons of substantial public interest, on the basis of EU or local law. |
Where we are processing Criminal
Convictions Data, this is permitted in accordance with EU or local law (as
applicable). In the UK this would include to protect the vital interests of you
or another person (as per the table above).
Appendix 2: Definitions
The following terms are used in this PRIVACY POLICY:
Criminal Convictions Data: In the UK, Personal Data relating to criminal convictions or offences or related security measures may only be processed when authorised by UK law.
Data Controller: this is the person which alone or jointly with others determines the purpose and means of the processing of Personal Data. OIC is the Data Controller of all employment details used in its business.
Data Subject: for the purpose of this policy this includes all living individuals about whom we hold Personal Data, including employees, Students, Parents or Guardians, suppliers and business partners. A Data Subject need not be a national or resident of the country the concerned OIC business is based in. Within the UK, all Data Subjects have legal rights in relation to their Personal Data.
Data Processor: this is the person which processes Personal Data on behalf of the Data Controller (not including employees of the Data Controller). OIC’s suppliers and agencies that handle Personal Data on our behalf will be Data Processors.
Guardians / Parents: this means any parents or guardians responsible for a Student.
OIC, Our, Us, We: Oxford International School Limited trading as Oxford International College.
NAE: our UK based Headquarters, Nord Anglia Education, Nova South, 160 Victoria Street, Westminster, London, SW1E 5LB, United Kingdom.
Personal Data: this is defined as any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified (either directly or indirectly) by reference to an 'identifier'. These include names, ID numbers, location data, online identifiers or one or more factors specific to the physical, psychological, genetic, economic, cultural or social identity of that person.
Special Categories of Personal Data: this type of data is, in the UK and some other countries, subject to more stringent processing conditions than other Personal Data and in the UK includes Personal Data which reveals racial or ethnic origin, political opinion, religious or philosophical beliefs, trade-union membership, and the processing of genetic data, biometric data in order to uniquely identify a person or data concerning health, sex life and sexual orientation. Data concerning health covers Personal Data relating to the physical or mental health of an individual which reveals information about the individual's health status.
Student: this means any prospective, past or present student of OIC.
Appendix 3: Contacting us: Nord Anglia Education Companies and Schools
|
Entity name |
Address |
Contact for data protection (and role) |
UK Data Protection Authority |
|
Oxford International School Limited |
Trading at 1 London Place Oxford, OX4 1BD United Kingdom New Kings Court, Tollgate, Chandlers Ford, Eastleigh, Hampshire SO53 3LG United Kingdom |
Data Protection Officer protectingdata@oxcoll.com |
Information Commissioner’s Office https://ico.org.uk |
|
Nord Anglia Education Limited |
Nova South, 160 Victoria Street, Westminster, London, SW1E 5LB, United Kingdom |
Group Data Protection Officer (Jon Townsley) Compliance@nordanglia.com |
As above |
|
Nord Anglia International School LLC |
Office No. 001, Level 100, Arenco Tower, Media City, Dubai |
As above |
N/A |
|
Collège Champittet SA |
Chemin de Champittet, c/o Collège Champittet Switzerland |
As above |
N/A |
