Privacy notices
Visitors to the ASL website
The American School in London Educational Trust Limited (ASL) respects the privacy of every individual who visits the ASL campus and website. This privacy notice demonstrates our commitment to your privacy and outlines the information ASL may collect about you from your visit to this website and how this information will be handled.
- About this document
- What personal data is processed and how it is collected
- Who has access to personal data and with whom we share it
- How long your information is kept
- Your rights
- Data accuracy and security
- This notice
- Contact and complaints
About this document
This policy is intended to provide information about how the School will use (or "process") personal data about individuals who visit the ASL campus or website.
This information is provided because Data Protection Law gives individuals rights to understand how their data is used. Visitors are encouraged to read this privacy notice and understand the school’s obligations and commitment to data protection.
This document also applies in addition to the school's other relevant terms and conditions and policies, including:
- any contract between the School and an individual, such as the terms and conditions of employment, and any applicable employee handbook
- the school's safe working practices, and child protection and health and safety policies
- the school’s CCTV policy, responsible use agreement, and data retention schedule.
This privacy notice also applies alongside any other information the School may provide about particular uses of personal data, for example when collecting data via an online or paper form.
What personal data is processed and how it is collected
Generally, the School receives personal data from the individual directly (including, in the case of students, from their parents). This may be via a form, or simply in the ordinary course of interaction or communication such as email.
We do not collect personally identifiable information about you when you visit our website unless you have provided it voluntarily. By providing such information to us, you are giving us your consent to contact you; you can opt-out of future mailings by following the ‘unsubscribe’ links in the emails or by contacting dpo@asl.org. We will use your data to respond to your inquiry and may send you communications by email, text message or mail. These may include information about upcoming events, fundraising, and school news. ASL will not sell, rent or market personal data about you to third parties.
Cookies are small text files that are placed on your computer or mobile phone when you browse websites. We use cookies to compile visitor statistics such as how many people have visited our website, what type of technology they are using (e.g., Mac or Windows, which helps to identify when our site isn't working as it should for particular technologies), how long they spend on the site, what pages they look at, etc. This helps us to continuously improve our website.
Cookies on asl.org:
- make our website work as you'd expect
- save you having to login every time you visit the site
- remember your settings during and between visits
- improve the speed/security of the site
- help you get to what you need faster.
We do not use cookies to:
- collect any personally identifiable information (without your express permission)
- pass data to advertising networks
- pass personally identifiable data to third parties
- pay sales commissions.
When you visit the ASL campus, we may collect certain personal data to identify you and maintain records of individuals on site for security and emergency purposes. This may include by way of example:
- Name, telephone number, email and other contact information
- Portrait photo taken for ASL visitor badge ID
- Images captured by the school's CCTV system (in accordance with the school's policy on taking, storing and using images of children)
- Ccar details (about those who use our car parking facilities).
Who has access to personal data and with whom we share it
Occasionally, the School will need to share personal information relating to its community with third parties, such as:
- professional advisors (e.g., lawyers, insurers, PR advisers and accountants)
- government authorities (e.g., HMRC, DfE, police or the local authority).
For the most part, personal data collected by the School will remain within the School, and will be processed by appropriate individuals only in accordance with access protocols (i.e., on a ‘need to know’ basis). Particularly strict rules of access apply in the context of:
- medical records held and accessed only by the school nurses and appropriate medical staff under his/her supervision, or otherwise in accordance with express consent
- safeguarding files.
Household directories
The following contact details will be included in the School's online household directory by default:
- Household name
- Your child(ren)’s full names and grade level
- Parent/guardian full name(s)
- Parent/guardian email address(es)
- Home address
- Home phone
- Mobile phone
The online directory is in the Veracross parent portal and is only accessible to current families, and faculty and staff via the website. You can update your directory visibility preferences by selecting the ‘Update family profile’ button in Veracross, and navigating to the ‘Directory preferences’ tab.
It is understood that the contents of the online directory will only be used to facilitate school-related arrangements at ASL, or for purely social contact between consenting families. As a community we operate on trust and would ask that personal data and contact details not be used for any other purpose without the specific consent of the person whose data you wish to use. Any violations of this trust will be taken very seriously.
How long your information is kept
The School will retain personal data securely and as long as it is necessary to keep it for a legitimate and lawful reason, and inline with ASL’s retention policy. Personal data captured at the front desk when visitors arrive to campus is kept for up to 12 months, however, incident reports and safeguarding files containing personal data will need to be kept much longer, in accordance with specific legal requirements. The School maintains a data retention schedule, which dictates how long personal and special category data is kept and how it is to be archived and disposed of in accordance with Data Protection Law.
If you have any specific queries about how our retention policy is applied, or wish to request that personal data you believe to be relevant is considered for erasure, please contact dpo@asl.org. Please bear in mind that the School will often have lawful and necessary reasons to hold on to some personal data following such request.
Your rights
Individuals have various rights under Data Protection Law to access and understand personal data about them held by the School, and in some cases ask for it to be erased or amended, or have it transferred to others, or for the School to stop processing it—but subject to certain exemptions and limitations.
Individuals wishing to access or amend their personal data, or wishing it to be transferred to another person or organization, or who have some other objection to how their personal data is used, should put their request in writing to the data protection officers at dpo@asl.org.
The School will endeavor to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time limits.
The School will be better able to respond quickly to smaller, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, the School may ask you to reconsider, or require a proportionate fee (but only where Data Protection Law allows it).
You should be aware that the right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information that identifies other individuals, or information that is subject to legal privilege (for example legal advice given to or sought by the School, or documents prepared in connection with a legal action).
Data accuracy and security
The School will endeavor to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must notify the School of any significant changes to important information, such as contact details, held about them.
Individuals have the right to request that any out-of-date, irrelevant or inaccurate or information about them is erased or corrected (subject to certain exemptions and limitations under Data Protection Law).
The School will take appropriate technical and organizational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to school systems. All staff will be made aware of this policy and their duties under Data Protection Law and receive relevant training.
This notice
The School will update this privacy notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.
Contact and complaints
Any comments or queries on this policy should be directed to divisional offices or in writing to dpo@asl.org.
If an individual believes that the School has not complied with this policy or acted otherwise than in accordance with Data Protection Law, s/he should notify dpo@asl.org. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with the School before involving the regulator.
May 2018
Parents and HS students
In the course of the services we provide to you, the American School in London Educational Trust Limited (ASL) will process personal data relating to you and your children. This makes the School a data controller of your personal information, and this privacy notice sets out how we will use that information and what your rights are.
- About this document
- Why we need to process personal data
- Types of personal data we process
- How we collect your personal data
- Who has access to personal data and with whom we share it
- How long your personal data is kept
- Keeping in touch and supporting the School
- Your rights
- Parental requests
- Whose rights?
- Data accuracy and security
- This notice
- Contact and complaints
About this document
This privacy notice is intended to provide information about how the School will use (or "process") personal data about its current, past and prospective students; and their parents, carers or guardians (referred to in this document as "parents").
This information is provided because Data Protection Law gives individuals rights to understand how their data is used. Parents and students are all encouraged to read this privacy notice and understand the school’s obligations to its entire community.
This privacy notice applies alongside any other information the School may provide about a particular use of personal data, for example when collecting data via an online or paper form.
This privacy notice also applies in addition to the school's other relevant terms and conditions and policies, including:
- any contract between the School and its employees or the parents of students;
- divisional handbooks and codes of conduct;
- the school’s CCTV policy, responsible use agreement, and data retention schedule.
Anyone who works for, or acts on behalf of, the School (including employees, contractors, trustees and volunteers) should also be aware of and comply with the school's data protection policy, which also provides further information about how personal data on those individuals will be used. For the purposes of this document, this group of individuals is referred to as ‘personnel.’
Why we need to process personal data
In order to carry out its ordinary duties to personnel, students and parents, the School needs to process a wide range of personal data about individuals (including current, past and prospective personnel, students or parents) as part of its daily operation.
The School needs to carry out some of this activity in order to fulfill its legal rights, duties or obligations—including those under a contract with its personnel, or parents of its students.
Other uses of personal data will be made in accordance with the school’s legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals, and provided it does not involve special or sensitive types of data.
The School expects that the following uses will fall within that category of its (or its community’s) “legitimate interests”:
- For the purposes of student admission (and to confirm the identity of prospective students and their parents)
- To provide education services, including musical and physical education, and extracurricular activities to students, and monitoring student progress and specific educational needs
- To maintain relationships with alumni and the school community, including direct marketing or fundraising activity
- For the purposes of donor due diligence, and to confirm the identity of prospective donors and their background (more details can be found in the Advancement Office Privacy Notice)
- To enable relevant authorities to monitor the school's performance and to intervene or assist with incidents, as appropriate
- To give and receive information and references about past, current and prospective students, including relating to outstanding fees or payment history, to/from any educational institution that the student attended or where it is proposed they attend; and to provide references to potential employers of past students
- To safeguard students’ welfare
- To monitor (as appropriate) use of the school's IT and communications systems in accordance with the school's IT Responsible Use Agreement
- To make use of photographic images of students in school publications, on the school’s website and (where appropriate) on the school's social media channels in accordance with the school's policy on taking, storing and using images of children
- For security purposes, including CCTV in accordance with the school’s CCTV policy
- To carry out or cooperate with any school or external complaints, disciplinary or investigation process where otherwise reasonably necessary for the school's purposes, including to obtain appropriate professional advice and insurance for the School.
In addition, the School will on occasion need to process special category personal data (concerning health, ethnicity, or religion) or criminal records information (such as when carrying out DBS checks) in accordance with rights or duties imposed on it by law, including as regards safeguarding and employment, or from time to time by explicit consent where required. These reasons will include:
- To safeguard students’ welfare (and where necessary, medical care), and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual's medical condition or other relevant information where it is in the individual's interests to do so, e.g., for medical advice, social protection, safeguarding and cooperation with police or social services, insurance purposes or information to caterers or organizers of school trips who need to be made aware of dietary or medical needs
- To provide student support services in the context of any specific educational needs of a student
- For legal and regulatory purposes (e.g., child protection, diversity monitoring, and health and safety) and to comply with its legal obligations and duties of care.
Types of personal data we process
This will include by way of example:
- names, addresses, telephone numbers, email addresses and other contact details
- bank details and other financial information, e.g., about parents who pay fees to the School
- past, present and prospective students’ academic, disciplinary, admissions and attendance records (including information about any specific educational needs)
- where appropriate, information about individuals' health and welfare, and contact details for their next of kin
- references given or received by the School about students, and relevant information provided by previous educational establishments and/or other professionals or organizations working with students
- correspondence with and concerning personnel, students and parents past and present
- images of students (and occasionally other individuals) engaging in school activities, and images captured by the school's CCTV system (in accordance with the school's policy on taking, storing and using images of children and CCTV policy).
How we collect your personal data
Generally, the School receives personal data from the individual directly (including, in the case of students, from their parents). This may be via a form, or simply in the ordinary course of interaction or communication.
In some cases, however, personal data will be supplied by third parties (for example another school, or other professionals or authorities working with that individual); or collected from publicly available resources.
Access to personal data and with whom we share it
Occasionally, the School will need to share personal information relating to its community with third parties, such as:
- subsidiaries and foundations that support ASL, other employees, agents and contractors
- professional advisers (e.g., lawyers, insurers, PR advisers and accountants)
- the Parent Community Association (PCA), community partnerships, and extracurricular organizations (e.g,. International School Sports Tournament ISST)
- government authorities (e.g., HMRC, DfE, police or the local authority).
For the most part, personal data collected by the School will remain within the School, and will be processed by appropriate individuals only in accordance with access protocols (i.e., on a ‘need to know’ basis). Particularly strict rules of access apply in the context of:
- medical records held and accessed only by the school nurses and appropriate medical staff under his/her supervision, or otherwise in accordance with express consent
- safeguarding files.
A certain amount of any student’s relevant specific educational needs information, however, will need to be provided to personnel more widely in the context of providing the necessary care and education that the student requires.
Personnel, students and parents are reminded that the School is under duties imposed by law and statutory guidance (including Keeping Children Safe in Education) to record or report incidents and concerns that arise or are reported to it, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness in their nature or regularity. This is likely to include file notes on personnel or safeguarding files, and in some cases referrals to relevant authorities such as the local authority or police. For further information about this, please view the school’s Safeguarding Policy.
Finally, in accordance with Data Protection Law, some of the school’s processing activity is carried out on its behalf by third parties, such as IT systems, or cloud storage providers. This is always subject to contractual assurances that personal data will be kept securely and only in accordance with the school’s specific directions.
How long your personal data is kept
The School will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason. Typically, the legal recommendation for how long to keep ordinary student files is up to seven years following departure from the School; however, incident reports and safeguarding files will need to be kept much longer, in accordance with specific legal requirements.
If you have any specific queries about how our retention policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact dpo@asl.org. Please bear in mind, however, that the School will often have lawful and necessary reasons to hold on to some personal data even following such a request.
A limited and reasonable amount of information will be kept for archiving purposes, for example; and even where you have requested we no longer keep in touch with you, we will need to keep a record of the fact in order to fulfill your wishes (called a "suppression record"). The School maintains a data retention schedule that dictates how long personal and special category data is kept and how it is to be archived and disposed of in accordance with Data Protection Law.
Keeping in touch and supporting the School
The School will use the contact details of parents, alumni and other members of the school community to keep them updated about the activities of the School, or alumni and parent events of interest, including by sending updates and newsletters, by email, by telephone and by post. Unless the relevant individual objects, the School will also:
- Share personal data about parents and/or alumni, as appropriate, with organizations set up to help establish and maintain relationships with the school community, such as the PCA
- Contact parents and/or alumni by email, telephone, and post in order to promote and raise funds for the School (more details can be found in the Advancement Office Privacy Notice);
- Should you wish to limit or object to any such use, or would like further information about them, please contact dpo@asl.org in writing. You always have the right to withdraw consent, where given, or otherwise object to direct marketing or fundraising, however, the School is nonetheless likely to retain some of your details (not least to ensure that no more communications are sent to that particular address, email or telephone number).
Your rights
Individuals have various rights under Data Protection Law to access and understand personal data about them held by the School, and in some cases ask for it to be erased or amended or have it transferred to others, or for the School to stop processing it—but subject to certain exemptions and limitations.
Any individual wishing to access or amend their personal data, or wishing it to be transferred to another person or organization, or who has some other objection to how their personal data is used, should put their request in writing to the data protection officers, dpo@asl.org.
The School will endeavor to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time limits.
The School will be better able to respond quickly to smaller, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, the School may ask you to reconsider, or require a proportionate fee (but only where Data Protection Law allows it).
You should be aware that the right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information that identifies other individuals, or information which is subject to legal privilege (for example legal advice given to or sought by the School, or documents prepared in connection with a legal action).
The School is also not required to share any confidential reference given by the School itself for the purposes of the education, training or employment of any individual.
You may be aware of the "right to be forgotten," however, we will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing your personal data: for example, a legal requirement, or where it falls within a legitimate interest identified in this privacy notice. All such requests will be considered on their own merits.
Students can make subject access requests for their own personal data, provided that, in the reasonable opinion of the School, they have sufficient maturity to understand the request they are making (see section Whose Rights? below). A student of any age may ask a parent or other representative to make a subject access request on his/her behalf.
Indeed, while a person with parental responsibility will generally be entitled to make a subject access request on behalf of younger students, the law still considers the information in question to be the child’s: for older students, the parent making the request may need to evidence their child's authority for the specific request.
Students age 16 and above are generally assumed to have this level of maturity, although this will depend on both the child and the personal data requested, including any relevant circumstances at home. Students age 13 to 16 years, however, may be sufficiently mature to have a say in this decision, depending on the child and the circumstances.
Parental requests
It should be clearly understood that the rules on subject access are not the sole basis on which information requests are handled. Parents may not have a statutory right to information, but they and others will often have a legitimate interest or expectation in receiving certain information about students without their consent. The School may consider there are lawful grounds for sharing with or without reference to that student.
Parents will receive educational updates about their children. Where parents are legally separated, the School will aim to provide the same information to each person with parental responsibility, but may need to factor in all the circumstances including the express wishes of the child.
Therefore, all information requests from, on behalf of, or concerning students—whether made under subject access or simply as an incidental request—will be considered on a case-by-case basis.
Where the School is relying on consent as a means to process personal data, any person may withdraw this consent at any time. Examples where we do rely on consent are: certain types of uses of images and certain types of fundraising and school advancement functions. Please be aware however that the School may not be relying on consent but have another lawful reason to process the personal data in question even without your consent.
That reason will usually have been asserted under this Privacy Notice, or may otherwise exist under some form of contract or agreement with the individual (e.g., an employment or parent contract, or because a purchase of goods, services of or membership in an organization such as an alumni or parents' association has been requested).
Whose rights?
The rights under Data Protection Law belong to the individual to whom the data relates., however, the School will often rely on parental authority or notice for the necessary ways it processes personal data relating to students—for example, under the parent contract, or via a form. Parents and students should be aware that this is not necessarily the same as the School relying on strict consent (see section on Consent above).
Where consent is required, it may in some cases be necessary or appropriate—given the nature of the processing in question, and the student's age and understanding—to seek the student's consent. Parents should be aware that in such situations they may not be consulted, depending on the interests of the child, the parents’ rights at law or under their contract, and all the circumstances.
In general, the School will assume that students’ consent is not required for ordinary disclosure of their personal data to their parents, e.g., for the purposes of keeping parents informed about the student's activities, progress and behavior, and in the interests of the student's welfare. That is unless, in the school's opinion, there is a good reason to do otherwise.
Where a student seeks to raise concerns confidentially with a member of ASL personnel and expressly withholds their agreement to their personal data being disclosed to their parents, the School may be under an obligation to maintain confidentiality unless, in the school's opinion, there is a good reason to do otherwise; for example where the School believes disclosure will be in the best interests of the student or other students, or if required by law.
Students are required to respect the personal data and privacy of others, and to comply with the school's policies, agreements, and the school rules.
Data accuracy and security
The School will endeavor to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must notify the admissions office of any significant changes to important information, such as contact details, held about them and maintain current information on school platforms.
An individual has the right to request that any out-of-date, irrelevant or inaccurate or information about them is erased or corrected (subject to certain exemptions and limitations under Data Protection Law).
The School will take appropriate technical and organizational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to school systems. All personnel will be made aware of this policy and their duties under Data Protection Law and receive relevant training.
This notice
The School will update this privacy notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.
Contact and complaints
Any comments or queries on this policy should be directed to divisional offices or to dpo@asl.org.
If an individual believes that the School has not complied with this policy or acted otherwise than in accordance with Data Protection Law, they should notify dpo@asl.org. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with the School before involving the regulator.
May 2018
Advancement
The American School in London Educational Trust Limited (ASL) respects the privacy of every individual who engages with our establishment and community. This privacy notice demonstrates our commitment to your privacy and outlines the information ASL may collect about you from your engagement with the advancement office and how this information will be handled.
- About this document
- Why we need to process personal data
- Types of personal data we process
- How we collect your personal data
- Research and wealth analysis
- Who has access to personal data and who we share it with
- How long your information is kept
- Your rights
- Data accuracy and security
- This notice
- Contact and complaints
About this document
The American School in London is proud of its history of engagement, and spirit of generosity embraced by the ASL family around the world.
The purpose of the advancement office at ASL is to meaningfully engage the school’s worldwide community of current parents, alumni, parents of alumni, and current and former faculty and staff; to draw all constituents closer to the School and to each other; to promote the ideals of the institution; to encourage charitable contributions to the School; and to support ASL in achieving its mission to empower each student to thrive as a lifelong learner and courageous global citizen by fostering intellect, creativity, inclusivity and character.
In order achieve this, the advancement office maintains a database of personal data. The School takes the safeguarding of this information very seriously and operates in line with Data Protection Laws. This privacy notice is intended to provide information about how the school will use (or "process") personal data about its current parents, alumni, parents of alumni, and current and former faculty and staff.
This information is provided because Data Protection Law gives individuals rights to understand how their data is used. Individuals are encouraged to read this privacy notice and understand the school’s obligations to its entire community.
This privacy notice applies alongside any other information the school may provide about a particular use of personal data, for example when collecting data via an online or paper form.
This privacy notice also applies in addition to the school's other relevant terms and conditions and policies, including:
- any contract between the school and its employees or the parents of students;
- the school’s CCTV policy, responsible use agreement, and data retention schedule.
Anyone who works for, or acts on behalf of, the school (including employees, contractors, trustees, and volunteers) should be aware of and comply with the school's data protection policy which also provides further information about how personal data about those individuals will be used. For the purposes of this document, this group of individuals is referred to as ‘personnel.’
Why we need to process personal data
In order to advance the mission of the School, the advancement office processes personal data it holds for:
- Alumni activities and programs, including event invitations, e-newsletters, alumni profiles and networking
- Fundraising, including mail and email appeals, wealth analysis, appeal segmentation and volunteering assignments
- School communications, including Accents magazine, updates on school activities and correspondence promoting the ideals of the School.
It is in ASL’s legitimate interests to process personal data in order to maintain and build on the school’s relationship with its constituents; to offer services and programs reasonably expected by alumni, parents, parents of alumni, and former faculty and staff; and to ensure the furtherance of the school’s mission. The advancement office will seek specific consent for any processing where a constituent’s interests, rights or freedoms are overridden by the legitimate interests of the School.
Types of personal data we process
The advancement office collects and holds the following data, where possible, on its constituents:
- Names and contact details
- Contact preferences
- Engagement with the School, including events attended and volunteer service
- Details of ASL education, including ASL activities
- Further and higher education
- Current interests and activities, which may include selected media coverage
- Philanthropy and volunteering, including gifts and service to ASL and other charitable organizations
- Information on financial assets that is publicly available
- Relationship to other ASL community members
- Employment and professional activities.
- How we collect your personal data
The advancement office collects personal data provided through the school’s admissions process, event registrations, conversations held in the course of involvement with ASL employees and volunteers, and through change-of-address and donation forms.
How we collect your personal data
The advancement office collects personal data provided through the school’s admissions process, event registrations, conversations held in the course of involvement with ASL employees and volunteers, and through change-of-address and donation forms.
In keeping with common practice in the education and charity sector, the advancement office also seeks to keep records up to date with data collected from publicly available sources of information and to append this information to constituents’ records, for example the National Change of Address Service or PR announcements from employers. In addition, publicly available sources are used to further understand our constituents to enable the advancement office to:
- Assess constituents’ ability and inclination to engage with the School, both in terms of volunteering and financial support
- Tailor proposals, appeals and requests for donations
- Be effective and efficient in its work.
Publicly available sources include:
- Annual reports
- UK Charities Commission
- Companies House and other business related resources
- Guidestar
- Mouseprice
- National and international newspapers
- National Change of Address Service
- Rich lists: Forbes and Sunday Times
- SEC EDGAR
- UK Charity Commission
- UK Land Registry
- Zillow
- Zoopla
Research and wealth analysis
Philanthropy and volunteering are at the heart of the ASL community and the School relies on gifts of time and treasure. In order to ensure the success of the advancement program, ASL uses the sources listed above to analyze an individual’s wealth, and ability and inclination to support the School. This vital work helps the advancement office to determine an appropriate and respectful proposed level of giving. At the heart of this work are the students who benefit every day from the generosity of the global ASL community.
Who has access to personal data and with whom we share it
Occasionally, the advancement office will need to share personal information relating to its community with third parties, such as:
- subsidiaries and foundations that support ASL,
- professional advisors (e.g. lawyers, insurers, PR advisers and accountants);
- the Parent Community Association (PCA);
- government authorities (e.g. HMRC, DfE, police or the local authority);
- agents processing data on behalf of the school, e.g., mailing houses
- connected individuals working on behalf of the school's fundraising efforts, e.g., parent and alumni canvassers.
All third parties are carefully vetted for strict adherence to Data Protection Law. For organizations based in the US, the School enters into a written contract that details the purposes for which the information can be used and the security measures that must be in place.
All volunteers sign a privacy agreement that details the purposes for which the data can be used and the security measures that must be in place.
How long your information is kept
The school will retain personal data securely as long as it is necessary to keep it for a legitimate and lawful reason, and inline with ASL’s retention policy.
If you have any specific queries about how our retention policy is applied, or wish to request personal data you believe to be relevant is considered for erasure, please contact dpo@asl.org. Please bear in mind that the School will often have lawful and necessary reasons to hold on to some personal data following such request.
A limited and reasonable amount of information will be kept for archiving purposes, for example; and even where you have requested we no longer keep in touch with you, we will need to keep a record of the fact in order to fulfill your wishes (called a "suppression record"). The school maintains a data retention schedule which dictates how long personal and special category data is kept and how it is to be archived and disposed of in accordance with Data Protection Law.
Your rights
Individuals have various rights under Data Protection Law to access and understand personal data about them held by the School, and in some cases ask for it to be erased or amended or have it transferred to others, or for the school to stop processing it – but subject to certain exemptions and limitations.
Individuals wishing to access or amend their personal data, or wishing it to be transferred to another person or organization, or who has some other objection to how their personal data is used, should put their request in writing to the data protection officers, dpo@asl.org.
The school will endeavor to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time-limits.
The school will be better able to respond quickly to smaller, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, the school may ask you to reconsider, or require a proportionate fee (but only where Data Protection Law allows it).
You should be aware that the right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information which identifies other individuals, or information which is subject to legal privilege (for example legal advice given to or sought by the school, or documents prepared in connection with a legal action).
Data accuracy and security
The School will endeavor to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must please notify the admissions office of any significant changes to important information, such as contact details, held about them and maintain current information on school platforms.
Individuals have the right to request that any out-of-date, irrelevant or inaccurate or information about them is erased or corrected (subject to certain exemptions and limitations under Data Protection Law).
The School will take appropriate technical and organizational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to school systems. All personnel will be made aware of this policy and their duties under Data Protection Law and receive relevant training.
This notice
The School will update this Privacy Notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.
Contact and complaints
Any comments or queries on this policy should be directed to divisional offices or in writing to dpo@asl.org.
If an individual believes that the school has not complied with this policy or acted otherwise than in accordance with Data Protection Law, s/he should notify dpo@asl.org. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with the School before involving the regulator.
May 2018
Personnel
In the course of your employment, engagement or other basis of work undertaken for The American School in London Educational Trust Limited (ASL), we will collect, use and hold (“process”) personal data relating to you as an individual undertaking work on behalf of the School. This makes the School a data controller of your personal information, and this Privacy Notice sets out how we will use that information and what your rights are.
- About this document
- Why we need to process personal data
- Types of personal data we process
- How we collect your information
- Who has access to personal data and with whom we share it
- How long your personal data is kept
- Data accuracy and security
- Your rights
- This notice
- Contact and complaints
About this document
This privacy notice applies to all current and former employees, contractors, substitute teachers, athletics coaches, casual workers, trustees, temps and volunteers who may be employed or engaged by the School to work on its behalf in any capacity, as well as prospective applicants. For the purposes of this document, this group of individuals is referred to by the term “ASL personnel.”
This document also applies in addition to the school's other relevant terms and conditions and policies, including:
- any contract between the School and an individual, such as the terms and conditions of employment, and any applicable employee handbook;
- the school's Safe Working Practices, and Child Protection, and Health and Safety policies;
- the school’s CCTV policy, responsible use agreement, and data retention schedule.
This privacy notice also applies alongside any other information the School may provide about particular uses of personal data, for example when collecting data via an online or paper form.
Why we need to process personal data
(i) Entering into, or fulfilling, our contract with you
We process your personal data because it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, such as a contract of employment or other engagement with us. In this respect, we use your personal data for the following:
- administering job applications and, where relevant, offering you a role with us;
- carrying out due diligence checks on you, whether during the application process for a role with us or during your engagement with us, including by checking references in relation to your education and your employment history;
- once you are employed or engaged by us in any capacity, for the performance of the contract of employment (or other agreement) between you and us;
- to pay you and to administer benefits (including pensions) in connection with your employment or other engagement with us;
- monitoring your attendance and your performance in your work, including performance appraisals;
- promoting the School to prospective parents and others, including publishing the work product(s) you create while employed by or otherwise engaged to work for the School;
- for disciplinary purposes, including conducting investigations, where required;
- for other administrative purposes, for example to update you about changes to your terms and conditions of employment or engagement, or changes to your pension arrangements;
- for internal record-keeping, including the management of any feedback or complaints and incident reporting;
- for any other reason or purpose set out in your employment or other contract with us.
(ii) Legitimate Interests
We process your personal data because it is necessary for our (or sometimes a third party's) legitimate interests. Our “legitimate interests” include our interests in running the School in a professional, sustainable manner, in accordance with all relevant ethical, educational, charitable, legal and regulatory duties and requirements (whether or not connected directly to data protection law). In this respect, we use your personal data for the following:
providing you with information about us and what it is like to work for us (where you have asked for this, most obviously before you have made a formal application to work for us);
- for security purposes, including by operating security cameras in various locations on the school's premises;
- to enable relevant authorities to monitor the school's performance and to intervene or assist with incidents, as appropriate;
- to provide education services to students;
- to safeguard students' welfare;
- to carry out or cooperate with any school or external complaints, disciplinary or investigatory process;
- for the purposes of management planning and forecasting, research and statistical analysis;
- in connection with organizing events and social engagements for ASL personnel;
- making travel arrangements on your behalf, where required;
- contacting you or your family members and “next of kin” for business continuity purposes, to confirm your absence from work, etc.;
- publishing your image and likeness in connection with your employment or engagement with us;
- to monitor (as appropriate) use of the school's IT and communications systems in accordance with the school's Responsible Use Agreement.
(iii) Legal Obligations
We also process your personal data for our compliance with our legal obligations, notably those in connection with employment, tax law and accounting, and child welfare. In this respect, we use your personal data for the following:
- to meet our legal obligations (for example, relating to child welfare, social protection, diversity, equality, and gender pay gap monitoring, employment, and health and safety);
- for tax and accounting purposes, including transferring personal data to HM Revenue and Customs to ensure that you have paid appropriate amounts of tax, and in respect of any Gift Aid claims, where relevant;
- for the prevention and detection of crime, and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.
(iv) Special categories of data
We process special categories of personal data (such as data concerning health, religious beliefs, racial or ethnic origin, sexual orientation or disability status) or criminal convictions and allegations for the reasons set out below.
We will process this data on the basis that such processing is necessary to carry out obligations and exercise rights (both yours and ours) in relation to your employment.
In particular, we process the following types of special category personal data for the following reasons:
- your physical or mental health or condition(s) in order to record sick leave and take decisions about your fitness for work, or (in emergencies) act on any medical needs you may have;
- recording your racial or ethnic origin in order to monitor our compliance with equal opportunities legislation;
- categories of your personal data that are relevant to investigating complaints made by you or others, for example concerning discrimination, bullying or harassment;
- data about any criminal convictions or offences committed by you, for example when conducting criminal background checks with the Disclosure and Barring Service (DBS), or where it is necessary to record or report an allegation (including to police or other authorities, with or without reference to you);
- We will process special categories of personal data for lawful reasons only, including because:
- you have given us your explicit consent to do so, in circumstances where consent is appropriate;
- it is necessary to protect your or another person's vital interests, for example, where you have a life-threatening accident or illness in the workplace and we have to process your personal data in order to ensure you receive appropriate medical attention;
- it is necessary for some function in the substantial public interest, including the safeguarding of children or vulnerable people, or as part of a process designed to protect others from malpractice, incompetence or unfitness in a role (or to establish the truth of any such allegations);
- it is necessary for the establishment, exercise or defense of legal claims, such as where any person has brought a claim or serious complaint against us or you.
Types of personal data we process
We may collect the following types of personal data about you (and your family members and “next of kin,” where relevant):
- contact and communications information, including:
- your contact details (including email address(es), telephone numbers and postal address(es);
- contact details (through various means, as above) for your family members and “next of kin”, in which case you confirm that you have the right to pass this information to us for use by us in accordance with this privacy notice;
- records of communications and interactions we have had with you.
- biographical, educational and social information, including:
- your name, title, gender, nationality and date of birth;
- your image and likeness, including as captured in photographs taken for work purposes;
- details of your education and references from your institutions of study;
- lifestyle information and social circumstances;
- your interests and extracurricular activities.
- financial information, including:
- your bank account number(s), name(s) and sort code(s) (used for paying your salary and processing other payments);
- your tax status (including residence status);
- Gift Aid declaration information, where relevant (for example, where we help you to administer donations to charity from your pre-taxed earnings);
- information related to pensions, national insurance, or employee benefit schemes.
- work-related information, including:
- details of your work history and references from your previous employer(s);
- your personal data captured in the work product(s), notes and correspondence you create while employed by or otherwise engaged to work for the School;
- details of your professional activities and interests;
- your involvement with and membership of sector bodies and professional associations;
- information about your employment and professional life after leaving the School, where relevant (for example, where you have asked us to keep in touch with you).
- and any other information relevant to your employment or other engagement to work for the School.
Where this is necessary for your employment or other engagement to work for us, we may also collect special categories of data, and information about criminal convictions and offenses, including:
- information revealing your racial or ethnic origin, sexual orientation, gender identity, disability status, and religious beliefs;
- information concerning your health and medical conditions (for example, where required to monitor and record sickness absences, dietary needs, or to make reasonable adjustments to your working conditions or environment);
- information about certain criminal convictions (e.g., where this is necessary for due diligence purposes, or compliance with our legal and regulatory obligations).
- This will only be undertaken, however, where and to the extent it is necessary for a lawful purpose in connection with your employment or other engagement to work for the School.
How we collect your information
We may collect your personal data in a number of ways, for example:
- from the information you provide to us before making a job application;
- when you submit a formal application to work for us, and provide your personal data in application forms and covering letters, etc.;
- from third parties, for example the DBS and referees (including your previous or current employers or school), in order to verify details about you and/or your application to work for us.
More generally, during the course of your employment with us, as a member of ASL personnel, we will collect data from or about you, including:
- when you provide or update your contact details;
- in the course of fulfilling your employment (or equivalent) duties more generally, including by filling reports or sending emails on school systems;
- in various other ways as you interact with us during your time as a member of ASL personnel, and afterwards, where relevant, for the various purposes set out below.
Who has access to personal data and with whom we share it
For the purposes referred to in this privacy notice and relying on the bases for processing as set out above, we may share your personal data with certain third parties. We may disclose limited personal data (including in limited cases special category or criminal data) to a variety of recipients, including:
- Subsidiaries and foundations that support ASL, other employees, agents and contractors (e.g., third parties processing data on our behalf as part of administering payroll services, the provision of benefits including pensions, IT, etc., although this is not sharing your data in a legal sense, as these are considered data processors on the school’s behalf);
- DBS and other relevant authorities and agencies such as the Department for Education and the local authority;
- external auditors or inspectors;
- our advisers where it is necessary for us to obtain their advice or assistance, including insurers, lawyers, accountants, or other external consultants;
- when the School is legally required to do so (by a court order, government body, law enforcement agency or other authority of competent jurisdiction), e.g., HM Revenue and Customs or the police.
We may also share information about you with other employers in the form of a reference, where we consider it appropriate, or if we are required to do so in compliance with our legal obligations.
How long your personal data is kept
Personal data relating to unsuccessful job applicants is deleted within 12 months of the end of the application process, except where we have notified you that we intend to keep it for longer (and you have not objected).
For employees, subject to any other notices that we may provide to you, we may retain your personal data for a period of 7 years after your contract of employment (or equivalent agreement) has expired or been terminated.
Some information, however, may be retained for longer than this, e.g., incident reports and safeguarding files, in accordance with specific legal requirements.
Data accuracy and security
The School will endeavor to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must notify the HR office of any significant changes to important information held about them, such as contact details, and maintain current information on school platforms.
An individual has the right to request that any out-of-date, irrelevant or inaccurate information about them is erased or corrected (subject to certain exemptions and limitations under Data Protection Law).
The School will take appropriate technical and organizational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to school systems. All ASL personnel will be made aware of this policy and their duties under Data Protection Law and receive relevant training.
Your rights
Individuals have various rights under Data Protection Law to access and understand personal data about them held by the School, and in some cases ask for it to be erased or amended or have it transferred to others, or for the School to stop processing it, but subject to certain exemptions and limitations.
Any individual wishing to access or amend their personal data, or wishing it to be transferred to another person or organization, or who has some other objection to how their personal data is used, should put their request in writing to the data protection officers at dpo@asl.org.
The School will endeavor to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time limits.
The School will be better able to respond quickly to smaller, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, the School may ask you to reconsider, or require a proportionate fee (but only where Data Protection Law allows it).
You should be aware that the right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information that identifies other individuals, or information that is subject to legal privilege (for example legal advice given to or sought by the School, or documents prepared in connection with a legal action).
The School is also not required to share any confidential reference given by the School itself for the purposes of the education, training or employment of any individual.
You may be aware of the "right to be forgotten," however, we will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing your personal data: for example, a legal requirement, or where it falls within a legitimate interest identified in this privacy notice. All such requests will be considered on their own merits.
Where the School is relying on consent as a means to process personal data, any person may withdraw this consent at any time. Examples where we do rely on consent are: participation in certain types of activities and certain types of fundraising and school advancement functions. Please be aware, however, that the School may not be relying on consent but has another lawful reason to process the personal data in question even without your consent. That reason will usually have been asserted under this privacy notice, or may otherwise exist under some form of contract or agreement with the individual (e.g., an employment or parent contract, or because a purchase of goods, services or membership of an organization, such as a parents' or an alumni association has been requested).
This notice
The School will update this privacy notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.
Contact and complaints
If an individual believes that the School has not complied with this policy or acted otherwise than in accordance with Data Protection Law, they should notify dpo@asl.org. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with the School before involving the regulator.
If you have any queries about this privacy notice or how we process your personal data, or if you wish to exercise any of your rights under applicable law, you may contact ASL’s data protection officers, dpo@asl.org.
May 2018
LS/MS students
| Throughout your time as a student at the American School in London (ASL), the School will collect and use (or “process”) personal data that relates to you. This makes ASL a data controller of your personal information, and this privacy notice explains how the School will use that information and what your rights are. |
 |
Why we collect your data
ASL needs to process personal data in order to fulfill its responsibilities.
Responsibilities include:
 |
|
||
 |
|
||
 |
|
||
 |
|
ASL collects your personal data from your parents/carers and your previous school(s) when you apply to attend ASL. ASL also collects personal data during your time here from your parents/carers and teachers.
What we do with your data
Your personal data is only shared with people who need it, such as teachers and other trusted adults at ASL who help keep you safe and provide you with education services. We do this:
- To communicate with your parents and carers and give them reports on your learning
- To make sure you are always safe at ASL and when you go on field trips
Sometimes, the School will need to share some personal data with other groups, such as:
- Professional advisers (e.g. lawyers, insurers or accountants)
- The Parent Community Association (PCA), community partnerships and extra-curricular organizations (e.g. First Lego League or International School Sports Tournament ISST)
- Technology companies, including Google and Veracross. ASL has special agreements with these companies to make sure your personal data is always safe and protected
- Government authorities (e.g. HMRC, DfE, police or local authorities)
We will normally keep your personal data for seven years after you have left ASL, but sometimes there may be reasons we need to keep them for longer.
ASL will take the appropriate steps to make sure that personal data about individuals is always safe. All teachers and staff at ASL are aware of the rules and policies and receive training on how to use school systems and devices when accessing all personal data.
What are your rights?
- Under UK Data Protection Law, you have the right to know what personal data ASL holds on you
- You and your parents/carers can ask to view some of the personal data that ASL holds
- In some cases, you and your parents can ask for certain personal data to be corrected or erased, such as correcting the spelling of your name or asking to delete an old telephone number or home address
If you have any questions about how ASL uses your data, you and your parents/carers should send an email to dpo@asl.org.
Students and families are required to respect the personal data and privacy of others, and to comply with the school's policies, agreements, and the school rules.