HAMPTON SCHOOL TRUST
1. Who We Are
Hampton School is a charitable company registered in England and Wales (the “School”). Its company registration number is 06264434, its charity registration number is 1120005 and its registered office is at Hanworth Road, Hampton, Middlesex, TW12 3HD. The School provides education to pupils aged 2-19. This Privacy Notice applies to the Hampton School Trust (comprising Hampton School and Hampton Pre-Prep & Prep School).
2. What This Privacy Notice Is For
This Privacy Notice is intended to provide information about how the School will collect, use and hold (or "process") personal data about individuals including: current, past and prospective pupils and their parents, carers or guardians (referred to in this notice as "parents"). Personal data is information about an identifiable individual. This Privacy Notice covers all forms of personal data processed by the School, including both paper and electronic data.
The School is a data controller of personal information for the purposes of data protection law. Data protection law gives individuals rights to understand how their data is processed and this Privacy Notice sets out how the School will use that information and the rights individuals have in respect of the data the School holds about them. Anyone who works for, or acts on behalf of, the School (including Governors, staff, volunteers, contractors and service providers) should also be aware of and comply with this Privacy Notice.
The School also has:
• A Privacy Notice (Staff and Job Applicants) providing information about how the School will process personal data about employees, other staff (including Governors) and prospective job applicants (this forms Appendix 1 to this Privacy Notice);
• A Privacy Notice (Alumni and Fitzwygram Foundation Office) providing information about how the School’s Alumni and Fitzwygram Foundation Office (the “Foundation Office”) will process personal data (this forms Appendix 2 to this Privacy Notice);
• A Privacy Notice (School Archives) providing information about the School’s maintenance of certain records for archival and historical purposes (this forms Appendix 5 to this Privacy Notice).
This Privacy Notice applies alongside any other information the School may provide about a particular use of personal data, for example when collecting data online or in paper form.
This Privacy Notice also applies in addition to the School's Terms and Conditions (Parent Contract) and policies, including:
• The School’s CCTV Policy (Appendix 3 to this Privacy Notice);
• the School's policy on taking, storing and using images of children (Appendix 4 to this Privacy Notice);
• the School’s biometrics consent forms (for pupils and staff);
• the School’s Data Protection Policy;
• the School’s Records Management Policy;
• the School's safeguarding, pastoral, and health and safety policies, including as to how concerns or incidents are recorded; and
• the School's IT policies and its Website Cookie Policy.
3. Responsibility for Data Protection
The Bursar is the senior person with responsibility for data protection matters within the School and is the point of contact for the Information Commissioner’s Office (ICO). The Bursar can be contacted by emailing data@hamptonschool.org.uk.
The School’s data protection responsibilities will be delegated to staff members within the School who have the best knowledge to handle or respond to a given matter. In particular, the Bursar will work closely with other members of staff who have data protection responsibilities (including the Director of IT and the Compliance Manager). Such staff will deal with requests and enquiries concerning the School’s processing of your personal data (see section on “Your Rights” below) and endeavour to ensure that all personal data is processed in compliance with this policy and data protection law.
4. Why the School Needs to Process Personal Data
In order to carry out its ordinary duties to staff, pupils and parents, the School needs to process a wide range of personal data about its community as part of its daily operations.
Some of this activity the School will need to carry out in order to fulfil its legal rights, duties or obligations –including those under a contract with staff, or parents of pupils.
Other uses of personal data will be made in accordance with the School’s legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals and provided it does not involve special or sensitive types of data.
The School expects that the following uses will fall within that category of its (or its community’s) “legitimate interests”:
• For the purposes of pupil selection, to confirm the identity of prospective pupils and their parents, and retain a record (if appropriate) for the purposes of future applications or openings;
• To carry out credit, identity and source of funds checks, whether with previous schools and/or third party sources or service providers, including for the purposes of verifying that parents are not subject to (or within the purview of) sanctions;
• To provide education services (including musical education, physical training, spiritual development, career services, and extra-curricular activities to pupils), school trips and visits (including international travel), monitoring of pupil progress and educational needs, including where such services are provided remotely (either temporarily or permanently);
• To report to and liaise with parents about their child’s progress, welfare and development including by way of regular reports and parents’ evenings;
• To organise and manage meetings, events and social engagements for pupils and parents;
• To maintain relationships with the School community, including by sending invites to events, newsletters, direct marketing and fundraising activity (e.g., processing donations) (see also the information below regarding consent) and by maintaining a School Archive (see further detail in Appendix 5);
• For the purposes of donor due diligence, and to confirm the identity of prospective donors and their background and relevant interests (see further detail in Appendix 2);
• For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as tax, diversity or gender pay gap analysis);
• To enable relevant authorities to monitor the School's performance and to intervene or assist with incidents as appropriate;
• To give and receive information and references about past and current pupils, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend; and to provide references to potential employers of past pupils;
• To enable pupils to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils of the School;
• To safeguard pupils' health and welfare and provide appropriate pastoral care (including following the requirements and recommendations of the government’s guidance on Keeping Children Safe in Education (or “KCSIE”);
• To monitor (as appropriate) use of the School's IT and communications systems in accordance with the School's Pupil and Staff IT Acceptable Use Policies;
• To make use of photographic images of pupils in School publications, on the School website and (where appropriate) on the School's social media channels in accordance with the School's policy on taking, storing and using images of children (Appendix 4 to this Privacy Notice);
• For security purposes, including biometrics and CCTV in accordance with the School’s biometrics consent forms and CCTV Policy (see Appendix 3);
• For the prevention and detection of crime, and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities;
• For regulatory record keeping / compliance purposes in respect of immigration requirements;
• To carry out or cooperate with any School or external complaints, disciplinary or investigation process;
• To promote the School to prospective parents and pupils; and
• Where otherwise reasonably necessary for the School's purposes, including to undertake market research, and obtain appropriate professional advice and insurance for the School.
In addition, the School will on occasion need to process special category personal data (concerning health, ethnicity, religion, biometrics or sexual life) or criminal records information (such as when carrying out DBS checks) in accordance with rights or duties imposed on it by law, including as regards safeguarding, or from time to time by explicit consent where required. These reasons will include:
• To safeguard pupils' welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual's health / medical condition or other relevant information where it is in the individual's interests to do so: for example for emergency medical care, to arrange the assessment and diagnosis of a pupil’s health and medical conditions and special educational needs, for social protection, safeguarding, and cooperation with police or social services, for insurance purposes or to caterers or organisers of school trips or events who need to be made aware of dietary or medical needs;
• To comply with public health requirements;
• To provide educational services in the context of making reasonable adjustments for a pupil’s disability and/or any special educational needs of a pupil;
• To run the school systems that operate on biometric data, such as for security and lunch access (parental consent is obtained in advance of such pupil data being processed);
• As part of any School or external complaints, disciplinary or investigation process that involves such data, for example if there are SEND, health or safeguarding elements; or
• For legal and regulatory purposes (for example child protection, diversity monitoring, health and safety and immigration compliance) and to comply with its legal obligations and duties of care.
The School seeks consent to certain uses of personal data, rather than relying on any of the other lawful bases set out above. For example, the School would seek consent in relation to certain marketing communications (including sending School newsletters and invitations to School events to prospective parents) in cases where it cannot rely on legitimate interests. The School will also seek consent in relation to the use of biometric data (see above) and in relation to certain uses of images (see Appendix 4).
5. Types of Personal Data Processed by the School
This will include by way of example:
• names, addresses, telephone numbers, e-mail addresses and other contact details (including those of former, current and prospective parents and pupils, suppliers, service providers and third parties providing support and services to the School);
• car details (about those who use the School’s car parking facilities);
• biometric information, which will be collected and used by the School in accordance with the information and consent form provided to parents when pupils start at the School;
• bank details, employment details and other financial information, e.g. about parents (or others) who pay fees to the School and/or in relation to a bursary application;
• any source of funds and/or anti-money laundering information the School is required to collect by law;
• past, present and prospective pupils' academic, disciplinary, admissions, safeguarding and attendance records, and examination scripts and marks;
• nationality and other immigration status information (e.g., right to enter, live and work or study in the United Kingdom), including copies of passport information;
• travel documentation for overseas visits;
• information about pupils’ health and medical conditions, special educational needs and family circumstances / living arrangements;
• contact details for pupils’ emergency contacts (next of kin or otherwise);
• references given or received by the School about pupils, and relevant information provided by previous educational establishments and/or other professionals or organisations working with pupils;
• information on participation in School events, emails, surveys and general correspondence with and concerning pupils and parents (past and present);
• images of pupils (and occasionally other individuals) engaging in School activities, and images captured by the School's CCTV system (in accordance with the School’s CCTV Policy and the School's policy on taking, storing and using images of children – see Appendices 3 and 4); and
• information captured when individuals visit the School website such as IP addresses, location data, website statistics and analytics, and website cookies.
6. How the School Collects Data
Generally, the School receives personal data from the individual directly (including, in the case of pupils, in some cases, from their parents). In relation to parents and pupils, this may occur at various times before, during and after a pupil attends the School and through various points of contact with the School (e.g. Careers, the Foundation Office, the Hampton Holles Boat Club Association (HHBCA) etc.). This may be via a form (e.g. through the website, Evolve or parent portal), or simply in the ordinary course of the provision of education services, interaction with the School or communication (such as email or written assessments). This will include personal data provided in the course of applications to the School by prospective staff (see Appendix 1) or parents. The School may also collect personal data when individuals visit its website.
However, in some cases personal data will be supplied by third parties (for example another school, medical professionals, or other professionals or authorities working with that individual, or third party service providers who credit and identity check parents and their source of funds); or collected from publicly available resources. Personal data may simply be generated in the course of ordinary School business by teachers or colleagues of the individual in question.
The School also records, collects, monitors, and gathers the personal data of data subjects directly (e.g. via CCTV cameras).
7. Who Has Access To Personal Data and Who The School Shares It With
Processing by third parties. For the most part, personal data collected by the School will remain within the School and will be processed by appropriate individuals only in accordance with access protocols (i.e. on a ‘need to know’ basis). To perform their duties, certain staff members such as Personal Assistants, may have access to Senior Leadership Team inboxes that contain personal data. Some functions are outsourced including, but not limited to, cloud storage, the School’s website, filtering and monitoring, information management and School mailing. In addition, the School implements high-quality educational and administrative Artificial Intelligence tools, which it believes will enhance the experience of pupils, parents and staff and facilitate efficient use of resources. The School’s use of AI tools is governed by its Artificial Intelligence Policy and its Pupil AI Acceptable Use Policy. In accordance with data protection law, these types of external data processing are always subject to contractual assurances that personal data will be kept securely and used only in accordance with the School’s specific directions.
Data sharing Occasionally, the School – including its governing board – will need to share personal information relating to its community of pupils and parents with third parties, such as:
• appropriate contractors, such as visiting music teachers;
• trading subsidiaries, suppliers or service providers who provide services to the School (coach service, caterers etc);
• the School’s insurance company;
• professional advisers (e.g. lawyers, insurers, PR advisers and accountants);
• third parties to facilitate certain purchases, e.g. optional insurance;
• third parties who assist with the School’s bursary application assessment process;
• other schools or educational establishments;
• various specialists and advisors who assist the School in fulfilling its obligations and may need a pupil’s information if this is relevant to the support they provide;
• organisations such as examination boards, extra-curricular music and drama examination boards and university admissions testing providers, school visit providers, other schools including Lady Eleanor Holles School (LEH) and/or competition organisers in connection with learning and extracurricular activities of pupils;
• Stage 3 complaints panels, which will include governors and independent panel members (in accordance with the School’s Complaints Procedure);
• third parties and their advisers in the unlikely event of a possible or actual sale, merger or other restructuring of the School;
• government authorities (e.g. HMRC, DfE, CAFCASS, police, Home Office, a relevant public health / NHS body and / or local authority) and/or appropriate regulatory bodies e.g. the Teaching Regulation Agency, the Independent Schools Inspectorate, the Charity Commission or the Information Commissioner; and
• affiliated organisations to help establish and maintain relationships with the School (e.g. the Hampton School Parents’ Association (“HSPA”), the HHBCA, the Hampton School Music Society (“HSMS”), the Foundation Office and the Old Hamptonians’ Association (“OHA”)). Subject to Appendix 2 regarding the Foundation Office, the School is not responsible for these organisations’ processing of personal data.
Data may need to be shared with other schools, including LEH, to facilitate the safe and effective administration of joint educational and extra-curricular activities, including the Combined Cadet Force (CCF), musical and drama productions, and Sixth Form curriculum enrichment, specifically to ensure pupil safety, manage dietary/medical requirements and coordinate academic collaboration..
Wherever possible, all data sharing and data transfers with third parties will be carried out under a written agreement, setting out the scope and limits of the sharing in accordance with legal requirements. Any disclosure of personal data will follow approved procedures.
The School may transfer personal data overseas to facilitate its own processing activities or to share personal data with the third parties listed above. Such transfers will be completed using legally approved methods to ensure that necessary protections are in place to protect the personal data.
The School will inform individuals how their data is being used either through this Privacy Notice or other relevant notices that may be contained in a form, contract, policy or request for consent.
The School may not inform an individual about the use of their data when the School shares or processes the personal data of individuals under a legal obligation.
8. Access To, and Sharing Of, Sensitive Data
Particularly strict rules of access apply in the context of “special category” data, most notably:
• health and medical / special educational needs records; and
• pastoral or safeguarding files.
Medical / health data. The School needs to process such information to comply with statutory duties and to keep pupils and others safe, but the School will ensure only authorised staff can access information on a need-to-know basis. This may include wider dissemination if needed for school trips or for catering purposes. Express consent will be sought where appropriate. However, a certain amount of any relevant information will need to be provided to staff more widely in the context of providing the necessary care and education that the pupil requires. It may also be necessary to share such data with LEH staff to enable them to supervise pupils, manage activities safely and meet welfare and safeguarding responsibilities while pupils are under LEH’s care. Access to such data is restricted to staff who require the information to perform their role and responsibilities.
Safeguarding data. The School is under duties imposed by law and statutory guidance (including Keeping Children Safe in Education ) to record or report incidents and concerns that arise or are reported to it, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness in their nature or regularity. This is likely to include notes on personnel or safeguarding files, low-level concerns records kept about adults (which may include references to pupils or family members), and in some cases
referrals to relevant authorities such as the LADO, Children’s Services, CAMHS or the police. The School is required to report to the Local Authority when pupils reach certain thresholds of absence; such reports may include safeguarding and special educational needs data.
KCSIE also requires that, whenever a child leaves the School to join another school or college, their child protection file is promptly provided to the new organisation, along with any other information which the School’s Designated Safeguarding Lead considers material to the ongoing care needs of the pupil. Where appropriate, the School will consult with parents as to how these needs are best served, but ultimately the decision as to what information is necessary to share with the new school or college is a safeguarding question that must be reserved to the School. The School will retain a copy of the child protection file in accordance with its Records Management Policy for material related to safeguarding matters.
For further information about this, please view the School’s Safeguarding (Child Protection) Policy and Procedures.
9. How Long We Keep Personal Data
The School will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason (in accordance with the School’s Records Management Policy and Records Retention Schedule).
If you have any specific queries about how the Records Management Policy is applied or wish to request that personal data you no longer believe to be relevant is considered for erasure, please email data@hamptonschool.org.uk. However, please bear in mind that the School will often have lawful and necessary reasons to hold on to some personal data even following such a request.
A limited and reasonable amount of information will be kept for archiving purposes, for example; and even where you have requested the School no longer keeps in touch with you, it will need to keep a record of that fact in order to fulfil your wishes (known as a "suppression record").
10. Keeping in Touch And Supporting the School
The School and the Foundation Office will use the contact details of parents and other members of the school community to keep them updated about the activities of the School, or events of interest, including by sending updates and newsletters, by email and by post. Unless the relevant individual objects, the School will also:
• Share personal data about parents with organisations set up to help establish and maintain relationships with the school community, such as the HSPA, HHBCA and HSMS;
• Contact parents and/or other members of the school community by email in order to promote and raise funds for the School, the Foundation and, where appropriate, other worthy causes;
• Collect information from publicly available sources about parents' and former pupils' occupation and activities (see Appendix 2 for further information).
Should you wish to limit or object to any such use, or would like further information about them, please email data@hamptonschool.org.uk or contact the Bursary. You always have the right to withdraw consent, where given, or otherwise object to direct marketing or fundraising. However, the School is nonetheless likely to retain some of your details (not least to ensure that no more communications are sent to that particular address, email or telephone number).
11. Your Rights
Individuals (both pupils and parents) have various rights under data protection law to access and understand their own personal data held and processed by the School, and in some cases ask for it to be erased or amended, or to have it transferred elsewhere, or for the School to stop processing it – but subject to certain exemptions and limitations.
The School will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time-limits (being one calendar month, with a further period of up to two additional calendar months in the case of complex or multiple requests, e.g. those involving third party information).
If you would like to exercise any of your rights under the data protection law for which the School is the data controller, please make your request by emailing data@hamptonschool.org.uk.
1. Rights of access, etc.
The School will be better able to respond quickly to smaller, targeted requests for information made during term time. If the request for information is manifestly excessive or similar to previous requests, the School may ask you to reconsider or require a reasonable fee for the administrative costs of complying with the request, or in certain cases refuse the request (but only where data protection law allows it, and in accordance with relevant regulatory guidance).
If you consider that the personal data the School holds on you is inaccurate, please let us know. However, the School will not necessarily delete or amend views, opinions, notes or records purely on the request of an individual who disputes the account, although the School may keep a record of all parties’ viewpoints.
2. Requests that cannot be fulfilled
You should be aware that UK GDPR rights (including the right of access) are limited to your own personal data, and certain data is exempt. This will include information which identifies other individuals (and parents need to be aware this may include their own children, in certain limited situations) – please see further below – or information which is subject to legal privilege (for example legal advice given to or sought by the School, or documents prepared in connection with a legal action, or where a duty of confidence is owed by a legal adviser).
The School is also not required to:
▪ disclose any pupil examination scripts (or other information consisting solely of pupil test answers, potentially including in mock exam scripts or other types of exams / tests used to assess performance – although markers’ comments may still be disclosable if they constitute pupil personal data); or
▪ provide examination or other test marks ahead of their ordinary publication date, nor share any confidential reference held by the School that was (or will be) given for the purposes of the education, training, appointment or employment of any individual.
You may have heard of the "right to be forgotten". However, the School will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing your (or your child's) personal data: for example, a legal requirement, or where it falls within a proportionate legitimate interest identified in this Privacy Notice. Generally, if the School still considers the processing of the personal data to be reasonably necessary, it is entitled to continue. All such requests will be considered on their own merits.
3. Requests by or on behalf of pupils
Pupils can make subject access requests for their own personal data, provided that, in the reasonable opinion of the School, they have sufficient maturity to understand the request they are making (see section “Whose Rights?” below). A pupil of any age may ask a parent or other representative to make a subject access request on their behalf.
Indeed, while a person with parental responsibility will generally be entitled to make a subject access request on behalf of younger pupils, the law still considers the information in question to be the child’s. For older pupils, the parent making the request may need to evidence their child's authority for the specific request. Requests not considered in the child’s best interests may sometimes be refused.
Pupils aged around 12 and above are generally assumed to have this level of maturity, although this will depend on both the child and the personal data requested, including any relevant circumstances at home. Slightly younger children may however be sufficiently mature to have a say in this decision, depending on the child and the circumstances.
4. Parental requests, etc.
It should be clearly understood that the rules on subject access are not the sole basis on which information requests are handled. Parents may not have a statutory right to information, but they and others will often have a legitimate interest or expectation in receiving certain information about pupils without their consent. The School may consider there are lawful grounds for sharing with or without reference to that pupil.
Parents will in general receive educational and pastoral updates about their children, in accordance with the Parent Contract. Where parents are separated, the School will in most cases aim to provide the same information to each person with parental responsibility but may need to factor in all the circumstances including the express wishes of the child, court orders, or pastoral issues.
All information requests from, on behalf of, or concerning pupils – whether made under subject access or simply as an incidental request – will therefore be considered on a case by case basis.
5. Consent
Where the School is relying on consent as a means to process personal data, any person may withdraw this consent at any time (subject to similar age considerations as above). Examples where the School relies on consent are biometrics and certain types of uses of images. Please be aware however that the School may not be relying on consent but have another lawful reason to process the personal data in question, even without your consent.
That reason will usually have been asserted under this Privacy Notice or may otherwise exist under some form of contract or agreement with the individual (e.g. an employment or parent contract, or because a purchase of goods, services or membership of an organisation such as an alumni or parents' association has been requested).
6. Whose rights?
The rights under data protection law belong to the individual to whom the data relates. However, the School will often rely on parental authority or notice for the necessary ways it processes personal data relating to pupils – for example, under the Parent Contract, or via a form. Parents and pupils should be aware that this is not necessarily the same as the School relying on strict consent (see section on Consent above).
Where consent is required, it may in some cases be necessary or appropriate – given the nature of the processing in question, and the pupil's age and understanding – to seek the pupil's consent, either alongside or in place of parental consent. Parents should be aware that in such situations they may not be consulted, depending on the interests of the child, the parents’ rights at law or under their contract, and all the circumstances.
In general, the School will assume that pupils’ consent is not required for ordinary disclosure of their personal data to their parents, e.g. for the purposes of keeping parents informed about the pupil's activities, progress and behaviour, and in the interests of the pupil's welfare. That is unless, in the School's opinion, there is a good reason to do otherwise.
However, where a pupil seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, the School may be under an obligation to maintain confidentiality unless, in the School's opinion, there is a good reason to do otherwise; for example where the School believes disclosure will be in the best interests of the pupil or other pupils, or if required by law.
Pupils are required to respect the personal data and privacy of others, and to comply with the School's Pupil IT Acceptable Use Policy and the School’s Code of Conduct.
12. Data Accuracy and Security
The School will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must please notify the School of any significant changes to important information, such as contact details, held about them.
An individual has the right to request that any out-of-date, irrelevant or inaccurate information about them is erased or corrected (subject to certain exemptions and limitations under data protection law): please see above for details of why the School may need to process your data, or below for who you may contact if you disagree.
The School will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to school systems.
13. This Notice
The School will update this Privacy Notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.
14. Queries and Complaints
Any comments or queries about this Privacy Notice should be directed to the Bursar using the following contact details:
The Bursar Hampton School Hanworth Road Hampton Middlesex TW12 3HD data@hamptonschool.org.uk.
If you believe that the School has not complied with this Privacy Notice or acted otherwise than in accordance with data protection law, you should utilise the School complaints procedure and should also notify the Bursar. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (“ICO”), although the ICO recommends that steps are taken to resolve the matter with the School before involving the regulator.
Appendix 1: Privacy Notice for Staff and Job Applicants
1. Introduction
In the course of work undertaken for the School, it will collect, use and hold (“process”) personal data relating to you as a member of our staff or wider school team, regardless of your employment status. This makes the School a controller of your personal information, and this Privacy Notice sets out how the School will use that information and what your rights are.
2. Who this notice applies to
This notice applies to staff at the School, including current, former and prospective: employees, selfemployed contractors, visiting music teachers and other peripatetic workers, casual workers, temporary staff, and volunteers who may be employed or engaged by the School to work for it in any capacity, as well as prospective applicants. It also applies to Governors and trustees.
Please note that references to "employment", “staff” etc. in this notice are not intended to imply or confer any employment rights on you if you are a contractor, non-employed worker, or job applicant.
3. About this notice
This notice applies in addition to the School's other relevant terms and conditions and policies that may (depending on your role and status) apply to you, including:
• any contract between you and the School, such as terms and conditions of employment, and the Staff Handbook;
• the School’s CCTV Policy and biometric consent form;
• the School’s Records Management Policy;
• the School's policies on Safeguarding, Anti-Bullying, Health and Safety and Low Level Concerns, including as to how concerns, low-level concerns or incidents are reported or recorded (both by and about staff); and
• the School's Data Protection and IT policies, including its Staff IT Acceptable Use Policy.
Please note that any contract you may have with the School will be relevant to how the School processes your data, in accordance with any relevant rights or obligations under that contract. However, this Staff Privacy Notice is the primary document by which the School notifies you about its processing of your personal data.
This notice also applies alongside any other information the School may provide about particular uses of personal data, for example when collecting data via an online or paper form.
4. How the School collects personal information
Before an individual is employed or engaged by the School, the School may collect that individual’s personal data in a number of ways, for example:
• From any information provided to the School by an applicant before making a job application (e.g. an enquiry);
• when a formal application to work for the School is submitted and personal data is provided in application forms and covering letters, self-declarations etc.;
• information provided during a job assessment process, for example when attending an interview; and
• information from third parties, for example the Disclosure and Barring Service (DBS) and referees (including previous or current employers or school), or from third party websites (as part of online / social media suitability checks for shortlisted candidates) or (in the case of a contractor or a substitute) their own employer or agent, in order to verify details about an applicant / their application to work for the School.
During the course of employment or engagement with the School, it will collect data from or about the relevant individual, including:
• personal contact details (when provided or updated);
• when paperwork regarding performance appraisals is completed either by the member of staff or relevant colleague;
• in the course of fulfilling employment (or equivalent) duties more generally, including by completing reports, note taking, or sending emails on School systems;
• in various other ways as that individual interacts within the School during their time as a member of staff, and afterwards, where relevant, for the various purposes set out below.
5. The types of information collected by the School
The School collects various types of personal data, namely:
• contact and communications information, including:
▪ contact details (email address(es), telephone numbers and postal address(es);
▪ contact details (through various means, as above) of family members and 'next of kin’; this information should be given with the authority of those concerned for use in accordance with this notice and the School’s Privacy Notice;
▪ records of communications and interactions;
• biographical, educational and social information, including:
▪ name, title, gender, nationality and date of birth;
▪ marital status and details of any dependents;
▪ images and likeness, including as captured in photographs and video taken for work purposes or via CCTV cameras;
▪ educational history and references from institutions of study;
▪ lifestyle information and social circumstances;
▪ interests and extra-curricular activities;
▪ information in the public domain, including information you may have posted to social media / online, where relevant to your role (e.g. as part of pre-employment screening);
• financial information, including:
▪ bank account details, name(s) and sort code(s) (used for paying salary or invoices and processing other payments);
▪ tax status (including residence status);
▪ information related to pensions, national insurance, or employee benefit schemes;
▪ work related information, including:
▪ details of work history and references from previous employer(s);
▪ records of work at the School (including start date, working hours, training records and performance / appraisal records, and information about use of IT systems);
▪ personal data captured in the work product(s), notes and correspondence created while employed by or otherwise engaged to work for the School;
▪ if applicable, recordings of lessons and other meetings with staff and pupils, and participation in School events;
▪ details of professional activities and interests;
▪ involvement with and membership of sector bodies and professional associations;
▪ information about employment and professional life after leaving the School, where relevant (for example, where an individual has asked the School to keep in touch;)
▪ details of the right to enter, live and work in the UK, including nationality and other immigration status information (i.e. about entitlement to work in the UK), including copies of passport information (if applicable);
▪ details of any disciplinary matters or grievances;
▪ any other information relevant to employment or other engagement to work for the School.
Where necessary the School may in regard to employment or other engagement to work for the School, also collect special categories of data, and information about criminal convictions and offences, including:
• information revealing racial or ethnic origin;
• trade union membership, where applicable;
• information concerning health and medical conditions (for example, where required to monitor and record sickness absences, dietary needs, or to make reasonable adjustments to working conditions or environment);
• biometric information as necessary for School security systems;
• information concerning sexual life or orientation (for example, in the course of investigating complaints made by an individual or others, for example concerning discrimination); and
• information about certain criminal convictions (for example, where this is necessary for due diligence purposes, whether by self-declaration or otherwise, or for compliance with the School’s legal and regulatory obligations).
However, this will only be undertaken where and to the extent it is necessary for a lawful purpose in connection with employment or other engagement to work for the School.
6. Purposes of processing, how data is used and with whom it is shared
i. Entering into, or fulfilling, a contract
The School processes personal data because it is necessary for the performance of a contract to which an individual is party, or in order to take steps, at an individual’s request and prior to entering into a contract, such as a contract of employment or other engagement with the School. In this respect, depending on the individual’s role and status, the School is likely to use personal data for the following purposes:
• administering job applications and, where relevant, the offer of a position at the School;
• carrying out due diligence checks, whether during the application process or during engagement at the School, including checking references in relation to education and employment history and obtaining any required self-declarations;
• once an individual is employed or engaged by the School in any capacity, for the performance of the contract of employment (or other agreement) between that individual and the School;
• for payment purposes and to administer benefits (including pensions) in connection with an individual’s employment or other engagement with the School;
• to monitor attendance and work performance, including in performance appraisals;
• monitoring use of IT systems to ensure compliance with policies (including the School’s Staff IT Acceptable Use Policy);
• to assess and make decisions about fitness to work and training and development requirements;
• promoting the School to prospective parents and others, including by publishing the work product(s) created by staff whilst employed by, or otherwise engaged by, the School;
• for disciplinary purposes, including conducting investigations where required;
• for other administrative purposes, for example to notify updates about changes to the terms and conditions of employment or engagement, or changes to pension arrangements;
• for internal record-keeping, including the management of any staff feedback or complaints and incident reporting; and
• for any other reason or purpose set out in a contract of employment (or other agreement) with the School.
ii. Legitimate Interests
The School processes personal data because it is necessary for its (or sometimes a third party's) legitimate interests. The School’s "legitimate interests" include its interests in running the School in a professional, sustainable manner, in accordance with all relevant ethical, educational, charitable, legal and regulatory duties and requirements (whether or not connected directly to data protection law). In this respect, depending on the individual’s role and status, the School uses personal data for the following:
• providing prospective staff with information about the School, including requests (most obviously before a formal application to work for the School has been submitted) as to what it is like to work for the School;
• for security purposes, including by operating CCTV cameras in various locations on the School's premises;
• to enable relevant authorities to monitor the School's performance and to intervene or assist with incidents as appropriate;
• to provide education services to pupils, including where such services are provided remotely (either temporarily or permanently);
• to safeguard staff and pupils' health and welfare and provide appropriate pastoral care;
• to carry out or cooperate with any School or external complaints, disciplinary or investigatory process;
• for the purposes of management planning and forecasting, research and statistical analysis;
• in connection with organising events and social engagements for staff;
• making travel arrangements on behalf of staff, where required;
• contacting members of staff, their family members and 'next of kin' for business continuity purposes, to confirm absence from work, etc.;
• publishing images and likenesses in connection with employment or engagement with the School;
• to monitor (as appropriate) use of the School's IT and communications systems in accordance with the School's Staff IT Acceptable Use Policy and government guidance such as KCSIE.
iii. Legal Obligations
The School also processes personal data to comply with its legal obligations, notably those in connection with employment, charity and company law, tax law and accounting, and child welfare. In this respect, depending on the individual’s role and status, personal data is used for the following:
• child welfare (including following the requirements and recommendations of KCSIE), social protection, diversity, equality, and gender pay gap monitoring, employment, immigration / visa sponsorship compliance and health and safety);
• for tax and accounting purposes, including transferring personal data to HMRC to ensure that appropriate amounts of tax have been paid, and in respect of any Gift Aid claims, where relevant;
• for the prevention and detection of crime, and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.
iv. Special categories of data and criminal offence data
Depending on role and status, the School processes special categories of personal data (for example, but not exclusively, data concerning health, religious beliefs, racial or ethnic origin, sexual orientation or union membership) or criminal convictions and allegations (treated for these purposes as special category data) for the reasons set out below.
In particular, the School processes the following types of special category personal data for the following reasons:
• physical or mental health or condition(s) in order to record sick leave and take decisions about the individual’s fitness for work, or (in emergencies) act on any medical needs they may have;
• recording racial or ethnic origin in order to monitor the School’s compliance with equal opportunities legislation;
• recording trade union membership, in connection with rights as an employee, agent or contractor and the School’s obligations as an employer or engager of services; and
• categories of personal data which are relevant to investigating complaints made by the individual or others, for example concerning discrimination, bullying or harassment, or as part of a complaint made against the School;
• biometric data to run the School’s security systems;
• data about any criminal convictions or offences committed by an employee or prospective employee, for example when conducting criminal background checks with the DBS, or via a self-declaration, or where a matter of public record (online or by any media), or where it is necessary to record or report an allegation (including to police or other authorities, with or without reference to the individual);
The School will process special categories of personal data for lawful reasons only, including:
• when explicit consent has been given, but only in circumstances where seeking consent is appropriate;
• where it is necessary to protect a person's vital interests, for example, where an individual has a life-threatening accident or illness in the workplace and the School has to process their personal data in order to ensure they receive appropriate medical attention;
• where it is necessary for the purposes of carrying out legal obligations and exercising specific rights of the controller and/or of the data subject in connection with employment or engagement with the School;
• where it is necessary in connection with some function in the substantial public interest, including:
a. the safeguarding of children or vulnerable people; or
b. to prevent or detect unlawful acts; or
c. as part of a function designed to protect the public, pupils or parents from seriously improper conduct, malpractice, incompetence or unfitness in a role, or failures in services by the School (or to establish the truth of any such allegations); or
d. to cooperate with a relevant authority, professional or regulatory body (such as the ISI, DfE, LADO or TRA) in such matters;
• to comply with public health requirements (e.g., in respect of Covid-19 (or in similar circumstances); or
• where it is necessary for the establishment, exercise or defence of legal claims, such as where any person has brought a claim or serious complaint against the School or an engaged or employed individual.
The School processes criminal record information for employment purposes in order to fulfil legal obligations.
7. Low-level concerns about adults
The School will process personal data, whether or not it constitutes special category data, in accordance with its policy on recording and sharing low-level concerns about adults (see the School’s Low Level Concerns Policy). This will be processed for the same safeguarding and/or employment law reasons as set out above.
An individual has the same rights in respect of that information, as any other personal data that the School holds. However, any requests to access, erase or amend personal data held in accordance with this Privacy Notice may be subject to necessary exemptions, for example if the School considers that compliance with the request might unreasonably impact the privacy rights of others or give rise to a risk of harm to children.
The School will retain records of low-level concerns securely and in line with how long it is necessary to keep these for a legitimate and lawful reason. Low-level concerns will not be included in references unless they relate to issues which would normally be included in references, for example, misconduct or poor performance.
8. Sharing personal information with others
For the purposes referred to in this notice and relying on the grounds for processing as set out above, the School may share individuals’ personal data with certain third parties and may disclose limited personal data (including in certain cases special category or criminal data) to a variety of recipients including:
• other employees, agents and contractors (e.g. third parties processing data on the School’s behalf as part of administering payroll services, the provision of benefits including pensions, IT etc. –although this is not sharing personal data in a legal sense, as these are considered data processors on the School’s behalf);
• DBS and other government authorities (e.g. HMRC, DfE, CAFCASS, police, Home Office, a relevant public health body/ NHS body and / or local authority) and/or appropriate regulatory bodies (e.g. the Teaching Regulation Agency (TRA), the Independent Schools Inspectorate, the Charity Commission, the ICO etc);
• other schools in the Trust;
• third party background check agencies;
• external auditors or inspectors;
• external advisers or consultants to the School where it is necessary for the School to obtain their advice or assistance (including insurers, lawyers, accountants, or other external consultants);
• third parties and their advisers, in the unlikely event that those third parties are acquiring, or considering acquiring, all or part of the School, or the School is reconstituting or setting up some form of joint working or partnership arrangement in the UK or abroad;
• when the School is legally required to do so by a court order, government body, law enforcement agency or other authority of competent jurisdiction, for example HMRC or the police; and
• prospective employers in the form of a reference where the School considers it appropriate or where the School is required to do so in compliance with its legal obligations. It should be noted that references given or received in confidence may not be accessible to a data subject under their UK GDPR rights.
9. How long is personal information is kept?
Personal data relating to unsuccessful job applicants is deleted within six months of the end of the application process, except where the School has notified an individual that it intends to keep it for longer (and that individual has not objected).
For employees, subject to any other notices that the School may provide, the School will retain personal data securely and in line with how long it is necessary to keep this for a legitimate and lawful reason (in accordance with the School’s Records Management Policy and Records Retention Schedule).
10. Individuals’ Rights
The School’s Privacy Notice details the rights of a ‘data subject’ which, for School staff, are the same as any other member of the public. In brief, you have the following rights:
• to obtain access to, and copies of, the personal data that the School holds about you;
• to require the School to correct the personal data held about you if it is incorrect;
• to require the School (in certain circumstances) to erase your personal data;
• to request that the School restricts its data processing activities (and, where its processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of the School’s processing based on consent before its withdrawal);
• to receive from the School the personal data it holds about you which you have provided, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller;
• to object, on grounds relating to your particular situation, to any of the School’s particular processing activities where you feel this has a disproportionate impact on your rights.
Please note that the above rights are not absolute, and the School may be entitled to refuse requests where exceptions apply. The School will endeavour to respond to any such requests as soon as is reasonably practicable and in any event within statutory time-limits (which is generally one calendar month, but actually fulfilling more complex or multiple requests, e.g. those involving third party information, may take longer).
For more information on individual rights, see Section 11 of the School’s Privacy Notice. Further information can be found on the Information Commissioner’s Office website www.ico.org.uk
11. This notice
The School will update this notice from time to time. Any substantial changes that affect an individual’s rights will be provided directly as far as is reasonably practicable.
12. Contact and complaints
Any queries about this Privacy Notice or how the School processes personal data can be addressed to data@hamptonschool.org.uk. A request to exercise rights under data protection law can be addressed to a Line Manager or via email to data@hamptonschool.org.uk. Alternatively, the matter can be addressed via procedures as outlined in the Staff Grievance Policy (A12) which can be found on Cezanne.
If internal procedures do not satisfactorily resolve any issues, a complaint can be made to the Information Commissioner’s Office at: www.ico.org.uk. The ICO does recommend that resolution is sought before any referral.
Appendix 2: Privacy Notice (Alumni and Fitzwygram Foundation Office)
1. Introduction
1.1 The School’s Alumni and Fitzwygram Foundation Office (the “Foundation Office”) supports the School in the creation and maintenance of good relationships between the School community, alumni and former parents and staff. It also co-ordinates fundraising for bursary programmes and School projects. As such, the Foundation Office holds data about former pupils, current and former parents and current and former members of staff/Governors together with other individuals connected with the School.
1.2 The purpose of this notice is to explain in more detail how the Foundation Office stores, manages and protects your personal data. This information should be read in conjunction with the School’s Privacy Notice to which this forms an Appendix.
2. Types of Personal Data Processed by the Foundation Office and How it is Collected
2.1 Examples of the personal data which the Foundation Office might hold include:
• Name, gender and date of birth and contact details such as addresses, telephone numbers, e-mail addresses;
• Consent options and communication preferences;
• Education history, extra-curricular activities, professional activities, employment details, interests;
• Support activity for the School e.g., mentoring, careers advice, membership of alumni associations;
• Information shared publicly on social media;
• Information on participation in School events, communication engagement, responses to surveys and general correspondence with the Foundation Office;
• Images of individuals engaging in School events, and images captured by the School's CCTV system (in accordance with the School’s Policy on CCTV as set out in Appendix 3 below); and
• information regarding donation(s), records of payments made via the website and, and any anti-money-laundering information the School is required to collect by law.
2.2 The Foundation Office may acquire this personal data in a number of ways. For example:
• Some information you provide to the School generally, such as contact details, will also be held by the Foundation Office. In relation to parents and pupils, this may occur at various times before, during and after a pupil attends the School.
• Staff and pupils (on leaving) can register through the Foundation Office on the School’s alumni database.
• Data may also be collected when you attend an event, make a donation (to the Fitzwygram Foundation or to the School’s Archives), engage with the School’s social media channels or simply in the ordinary course of interaction or communication (such as email).
• The Foundation Office is committed to fundraising ethically and through prudent use of charitable resources in line with the Fundraising Code of Practice. The Foundation Office may use AI-driven analysis tools as well as credible and verifiable sources of information (including publicly available sources such as LinkedIn or Companies House) as part of its due diligence checks, data analysis and research activity.
3. Why the Foundation Office Processes Personal Data
3.1. Together with the uses outlined in the School’s Privacy Notice (see section entitled “Why the School Needs to Process Data”), the School expects that the following uses will fall within the category of its “legitimate interests”:
• To keep parents (current/former), alumni and other members of the School community updated about the activities of the School, including fundraising activities, by sending updates including magazines and newsletters etc. by email, telephone, and by post;
• Event management;
• Processing of donations;
• Acting as an intermediary to connect alumni with each other, with each party’s agreement;
• The provision of careers and mentoring services, with a data subject’s agreement;
• Undertaking data analysis, research and prospect identification in order to gain a better understanding of the School community, inform and optimise its fundraising strategy and target its communications (including approaching and engaging with former, current and prospective donors) effectively and appropriately;
• Undertaking donor due diligence, including carrying out identity and source of funds checks regarding donations or gifts.
3.2 The Foundation Office may also share personal data with other departments within the School (e.g. Careers Department). In addition, in accordance with data protection law, some of the School’s processing activity is outsourced and carried out on its behalf by third parties, such as IT systems, or cloud storage providers. The School also uses high-quality Artificial Intelligence administrative and data analysis tools, which it believes will enhance the experience of pupils, parents and staff and facilitate efficient use of resources. Wherever possible, this is always subject to contractual assurances that personal data will be kept securely and only in accordance with the School’s specific directions.
3.3 From time to time the Foundation Office may ask for your consent to processing your personal data. Should you wish to limit or object to any such use, or would like further information, please contact the Development Director at alumni@hamptonschool.org.uk (see below).
4. How The Foundation Office Keeps Personal Data
4.1. The Foundation Office will retain personal data securely; the Foundation Office uses a separate database from other departments at the School. The Foundation Office will only retain the data to the extent necessary for the relevant activity.
4.2 Data will not be disclosed to external organisations other than those with which the School is required to share information (such as HMRC) or suppliers or service providers who provide services for the School/Foundation Office. Wherever possible, all data sharing and data transfers with third parties will be carried out under a written agreement, setting out the scope and limits of the sharing in accordance with legal requirements. Any disclosure of personal data will follow approved procedures.
4.3. Please note that the School does not store any credit/debit card details after processing payments.
5. Your Rights
5.1 Should you wish to limit or object to any such use of your data, or would like further information, please contact the Development Director at alumni@hamptonschool.org.uk. You always have the right to withdraw consent, where given, or otherwise object to direct marketing or fundraising and you can update your communication preferences by contacting the Foundation Office. However, as set out above, the School is nonetheless likely to retain some of your details (not least to ensure that no more communications are sent to that particular address, email or
telephone number). The School will also need to retain some information to comply with statutory requirements e.g. Gift Aid declarations.
5.2 Please refer to the School’s Privacy Notice above for information on individuals’ rights under data protection law. If you have any comments or queries on this notice, or should you wish to exercise any of your rights, please contact either the Development Director at alumni@hamptonschool.org.uk or the Bursar at data@hamptonschool.org.uk.
Appendix 3: CCTV Policy
1. Introduction
Hampton School Trust (the “School”) uses CCTV to view and record pupils, parents, staff and visitors on and around its premises. The School recognises that the images of individuals recorded by CCTV cameras are personal data which must be processed in accordance with data protection laws. The CCTV system is administered and managed by the School, which is the controller in respect of personal data collected by its CCTV cameras. The School will review the ongoing use of CCTV cameras regularly to ensure that their use remains necessary and appropriate, and that the system is continuing to address the needs that justified its introduction. If you have any questions about this policy, please contact the Bursar via data@hamptonschool.org.uk
2. Purposes of Processing
The School's purposes for using the CCTV system are set out below and, having fully considered the privacy rights of individuals, the School believes these purposes are all in its legitimate interests. Data captured for the purposes below will not be used for any commercial purpose.
• To protect pupils, parents, staff and visitors with regard to their personal safety and to act as a deterrent against crime.
• To protect the School buildings and equipment, and the personal property of pupils, parents, staff and visitors from damage, disruption, vandalism and other crime.
• To prevent and detect crime, and support law enforcement bodies in the prevention, detection and prosecution of crime as well as the identification and apprehension of offenders.
• To monitor the security and integrity of the School site and deliveries and arrivals, including car parking.
• To monitor staff and contractors when carrying out work duties.
• To monitor and uphold discipline among pupils in line with the School’s Code of Conduct.
• To assist in day-to-day management, including ensuring the health and safety of pupils, parents, staff and visitors.
• To assist in the effective resolution of disputes which arise in the course of disciplinary or grievance proceedings.
• To assist in civil litigation, including employment tribunal proceedings.
Please note that this list is not exhaustive and other purposes may become relevant from time to time.
3. Positioning
Locations for the CCTV cameras have been selected, both inside and outside the School premises, that the School reasonably believes require monitoring to address the above purposes. These include outside areas, internal communal areas and internal rooms containing high value items.
Adequate signage has been placed in prominent positions around the premises to inform pupils, parents, staff and visitors that they are entering a monitored area, including contact details for further information regarding the CCTV system.
These locations have been chosen to minimise viewing of spaces not relevant to the legitimate purposes of the School’s monitoring. As far as practically possible, CCTV cameras will not focus on private property; and no images of public spaces will be captured except to a limited extent at site entrances. In addition, surveillance systems will not be used to record sound and no images will be captured from areas in which individuals would have a heightened expectation of privacy, including medical, changing and washroom facilities.
4. Maintenance
The CCTV system will be operational 24 hours a day, every day of the year.
The School’s Facilities department will check and confirm that the CCTV system is properly recording and that cameras are functioning correctly, on a regular basis.
The Estates Manager will arrange for the System to be checked and serviced regularly by a competent contractor.
5. Supervision
The School will ensure that recorded images are only viewed by the following approved members of staff whose roles require them to have access to such data.
Staff authorised by the School to download, view past footage and view live cameras:
The Bursar (the System Manager)
The Deputy Bursar
Estates Manager
The Facilities Manager
The Bursar’s PA
IT Manager as nominated by The Headmaster or the Bursar
IT Systems Manager
IT Systems Administrator
CCTV Service Provider
Staff authorised by the School to view past footage and live cameras are:
The Headmaster and all members of the Senior Leadership Team (SLT)
Heads of Year and Heads of Department
Other staff as necessary, at the discretion of a member of SLT
School Keepers (live stream only)
School Porters (live stream only)
School Electricians (live stream only)
Images will only be viewed and/or monitored in a suitably secure and private area to minimise the likelihood of or opportunity for access to unauthorised persons. Moreover, footage can only be viewed on School devices.
Locations of viewable CCTV screens at the School:
The Bursary
School Keepers’ Room
School Porters’ Building
The Hammond Theatre (stage only)
School Keeper at HPP&P
Staff using the CCTV system will be given appropriate training to ensure that they understand and observe the legal requirements related to the processing of relevant data.
6. Storage
In order to ensure that the rights of individuals recorded by the CCTV system are protected, the School will ensure that data gathered by CCTV cameras is stored in a way that maintains its integrity and security. Given the large amount of data generated by the CCTV system, the School may store video footage using a cloud computing system. The School will take all reasonable steps to ensure that any cloud service provider maintains the security of its information, in accordance with industry standards. The School may also engage data processors to process data on its behalf. The School will ensure appropriate contractual safeguards are in place to protect the security and integrity of the data.
Images will be stored for a maximum of 28 days (dependent upon storage space as the CCTV system overwrites the data on a loop), and automatically over-written unless the School considers it reasonably necessary for the pursuit of the objectives outlined above, or if lawfully required to retain such data (for example, by an appropriate third party such as the police or local authority). Access to stored CCTV images will only be given to the authorised persons listed above (under Supervision).
Where personal data collected by the CCTV system is retained, it will be held in accordance with data protection law and the School’s Privacy Notice and Data Protection Policy. Information including the date, time and length of the recording, as well as the locations covered and groups or individuals recorded, will be logged in the System logbook. Data deletion will also be noted within this log.
7. Requests for disclosure
Individuals have the right to request access to personal data that the School holds about them (otherwise known as a “subject access request” - please see the School’s Privacy Notice to which this Policy is appended for further information), including information collected by the CCTV system, if it has been retained.
In order to respond to a subject access request, the School will require specific details including (as a minimum) the time, date and camera location before it can properly respond to any such requests. This right is subject to certain exemptions from access, including in some circumstances where others are identifiable.
The School must also be satisfied as to the identity of the person wishing to view stored images and the legitimacy of their request.
No images from our CCTV cameras will be disclosed to a third party without express permission being given by the School. The following are examples of circumstances in which the School may authorise disclosure of CCTV images to third parties:
• Where required to do so by the police or any relevant local or statutory authority;
• To make a report regarding suspected criminal behaviour or a safeguarding incident;
• To enable the Designated Safeguarding Lead or his/her appointed deputies to examine behaviour which may give rise to any reasonable safeguarding concern;
• To assist the School in establishing facts in cases of unacceptable pupil behaviour, in which case, the pupil’s parents/guardian will be informed as part of the School’s management of a particular incident;
• To individual data subjects (or their legal representatives) pursuant to a subject access request (as outlined above);
• To the School's insurance company where required in order to pursue a claim (for example for damage to insured property); or
• In any other circumstances required under law or regulation.
Where images are disclosed, a record will be made in the system logbook including the name of the person viewing the images, the time of access, the reason for viewing the images, the details of images viewed and a crime incident number (if applicable).
The School reserves the right to obscure images of third parties when disclosing CCTV footage, where it considers it necessary to do so.
8. Other CCTV / video recording systems
The School does not own or manage third party CCTV or video recording systems but may be provided by third parties with images of incidents in line with the objectives of the School's own CCTV Policy and/or the School Code of Conduct / Parent Contract. The School reserves the right to use these images in establishing the facts in cases of alleged unacceptable behaviour. In such cases, the parents/guardian will be informed as part of the School’s investigation of the incident.
9. Complaints and queries
Any complaints or queries in relation to the School's CCTV system, or its use of CCTV, or requests for copies, should be referred to the Bursar via data@hamptonschool.org.uk
For any other queries concerning the use of personal data by the School, please see the School’s applicable Privacy Notice.
10. CCTV Footage Access Request
The following information is required before the School can provide copies of or access to CCTV footage from which a person believes they may be identified.
Please note that CCTV footage may contain the information of others that needs to be protected, and that the School typically overwrites CCTV recordings after a maximum of one month.
Name and address: (proof of ID may be required)
Description of footage (including a description of yourself, clothing, activity etc.)
Location of camera
Approximate time (give a range if necessary)
Signature*……………………………………
* NB if requesting CCTV footage of a child under 12, a person with parental responsibility should sign this form. For children over that age, the child's authority or consent must be obtained except in circumstances where that would clearly be inappropriate and the lawful reasons to provide footage to the parent(s) outweigh the privacy considerations of the child.
Appendix 4 : Policy on Taking, Storing and Using Images of Pupils
1. Introduction
This policy relates to all schools within the Hampton School Trust (the “School”) and is intended to provide information to pupils and their parents, carers or guardians (referred to in this policy as “parents”) and the wider school community about how images and audio recordings of pupils are normally used by the School. It also covers the School's approach to the use of cameras and filming equipment at School events, in a sporting context and on School premises by staff, parents, pupils and the media.
It applies in addition to the School's Parent Contract, any other information the School may provide about a particular use of pupil images (e.g. signage about the use of CCTV), and more general information about use of pupils' personal data (e.g. the School's Privacy Notice). Images of pupils in a safeguarding context are dealt with under the School's Safeguarding (Child Protection) Policy and the Staff Behaviour Policy.
2. General points to be aware of
• Certain uses of images, including pupil images, are necessary for the ordinary running of the School (for example, for administration, identification, educational and curricular purposes, and security). It may not be possible to object to such uses, although any concerns in this regard will be duly considered by the School.
• Other uses are considered to be in the legitimate interests of the School and its community and unlikely to cause any adverse impact on pupils. The School is entitled lawfully to process such images and take decisions about how to use them, although objections may be raised and the School will seek to accommodate any reasonable concerns.
• It is hoped that that parents will feel able to support the School in using video and still images of pupils to celebrate Hamptonians’ achievements, including extra-curricular, sporting and academic; to promote the work of the School; and for important administrative purposes such as identification and security. However, for certain uses of images which are less routine, for example significant projects such as high-level marketing videos and professional photo shoots, the School will inform parents in writing (and give them the opportunity to opt-out) and will seek specific adhoc consent from the pupils involved (on an age-appropriate basis – see below).
• Hampton Pre-Prep & Prep School (HPP&P): Parents who accept a place at HPP&P are invited to indicate that they agree to the School using images of their child as set out in this policy via the Parental Consent Form for the Use of Images which is issued to parents of new joiners (and, when updated consent is required, to existing parents).
• Hampton School: Parents who accept a place for their child at Hampton School are asked (in the Parent Contract) to read and acknowledge the School’s Privacy Notice and to acknowledge the School’s use of pupil images for online and print marketing and communication purposes.
• Any parent who wishes to limit the use of images of a pupil for whom they are responsible should contact the School via the email address: data@hamptonschool.org.uk; this ability to opt out is set out in the Parent Contract. The School will respect the wishes of parents (and indeed pupils themselves) wherever reasonably possible, and in accordance with this policy. However, parents should be aware that certain uses of their child’s images may continue to be necessary (for example, administration, education or security) or will be unavoidable (for example if they are included incidentally in CCTV footage).
• Parents should be aware that, from around the age of 12 and upwards, the law recognises pupils' own rights to have a say in how their personal information is used – including images. Where possible, pupils are regularly informed as to use of images and given the opportunity not to be featured if they so wish.
• Staff, parents and pupils should note that images can be scraped from websites and public social media accounts by third parties. Once this occurs, images are no longer within the control of the School and it may not be possible to remove them from circulation.
3. Use and Publication of Pupil Images
In accordance with any consents, notices or objections as may be applicable from time to time, the School will use images (and audio recordings) of its pupils to keep the School community updated on its activities, and for marketing and promotional purposes, including:
• internal displays (including clips of moving images) on digital and conventional notice boards within the School premises;
• as part of the School’s email system and intranet and in appropriate communications by whatever means with the School community (parents, pupils, staff, Governors and alumni);
• as part of curricular activities (for example physical education, music or drama), or as a teaching aid;
• on the School's website and, where appropriate and in line with relevant policies, via the School's social media channels, e.g. X, Instagram, LinkedIn, Facebook and YouTube. Such images would not normally be accompanied by the pupil's full name without permission;
• in podcasts hosted on Acast;
• in printed material, such as school magazines and printed marketing material, including the School's prospectus, and exceptionally in online, press and other external advertisements for the School. Such external advertising would not normally include pupils’ names and in some circumstances the School will seek the parent or pupil's specific consent, depending on the nature of the image or the use.
The source of these images will predominantly be the School's staff (who are subject to policies and rules on how and when to take such images), or a professional photographer/videographer used for marketing and promotional purposes, or occasionally pupils. The School will only use images of pupils in suitable dress.
The School also retains some images of its activities within the School Archive (for further detail please see Appendix 5).
The School’s policy in respect of the above uses is as follows:
• Legitimate interests will be relied upon for any uses which are either essential (for example, security, administration and education) or which are considered as reasonably expected uses.
• The key effect of the School relying on legitimate interests is that parents and pupils may be entitled to object to such uses, although their specific consent will not be sought beforehand. Any objections will be duly considered by the School, but objections can be overridden by other factors.
• Consent will be sought for certain external uses of pupil images online, including where these are not considered to be part of daily school life (see examples of significant projects above). In such cases the School will discuss the use with the pupil or parents (as appropriate) in advance, and seek specific, ad hoc consent. See also above for information on consent to use of images at HPP&P.
• The School will take reasonable steps following any objection or withdrawal of consent but may not be able to recall or destroy printed materials. Any particular concerns or vulnerabilities relating to a pupil or their family should be drawn to the School’s attention in advance. The safeguarding and best interests of pupils will remain the School’s priorities at all times.
4. Use of Pupil Images for Identification and Security
• Pupils at HPP&P are photographed every year. Pupils at Hampton School are photographed on entering the School and, thereafter in the Third Year and Lower Sixth), for the purposes of internal identification. These photographs identify the pupil by name, year group, form group and admission number.
• CCTV is in use on School premises and will sometimes capture images of pupils. Images captured on the School's CCTV system are used in accordance with the School’s Privacy Notice (to which this Policy is appended) and CCTV Policy (see Appendix 3 above), together with any other information or policies concerning CCTV which may be published by the School from time to time.
5. Use of Pupil Images in the Media
• Where practicably possible, the School will always notify parents in advance when the media is expected to attend an event or School activity in which pupils are participating. The School will make every reasonable effort to ensure that any pupil whose parent or carer has refused permission for images of that pupil, or themselves, to be made in these circumstances are not photographed or filmed by the media, nor such images provided for media purposes.
• The media may ask for the names of the relevant pupils to go alongside the images. It is not the School’s policy to provide full names in this scenario, and these will only be provided where parents have been informed about the media organisation’s visit and either parent or pupil (as ageappropriate) has specifically consented to the sharing of their name, for an appropriate and necessary purpose.
6. Security of Pupil Images
• Professional photographers and the media are always accompanied by a member of staff when on School premises. The School uses only reputable professional photographers/ videographers and makes every effort to ensure that any images of pupils are in suitable dress and held by such persons securely, responsibly and in accordance with the School's instructions.
• The School takes appropriate technical and organisational security measures to ensure that images of pupils held by the School are kept securely on school systems and protected from loss or misuse.
• Any external processors of pupil images are engaged only for lawful purposes consistent with those set out in this policy, and subject to proper due diligence and contractual protections.
• All staff are given guidance on the School's Policy on Taking, Storing and Using Images of Pupils, and on the importance of ensuring that images of pupils are made and used responsibly, only for School purposes, and in accordance with school policies and the law.
• Pupils are also given age-appropriate training on their own privacy online and with their peers, including image use and social media safety.
7. Use of Cameras and Filming Equipment (including mobile phones) by Parents
Unless otherwise indicated by the School, parents or close family members (hereafter, parents) are welcome to take photographs of (and where appropriate, film) their own children taking part in School events, subject to the following guidelines, which the School expects all parents to follow:
• When an event is held indoors, such as a play or a concert, parents should be mindful of the need to use their cameras and filming devices with consideration and courtesy for cast members or performers on stage and the comfort of others. Flash photography can disturb others in the audience or even cause distress for those with medical conditions; the School therefore asks that it is not used at indoor events.
• Parents are asked not to take photographs of other pupils, except incidentally as part of a group shot, without the prior agreement of that pupil's parents.
• Parents are reminded that such images are for personal use only. Images which may, expressly or not, identify other pupils should not be made accessible to others via the internet (for example on social media), or published in any other way.
• Parents are reminded that copyright issues may prevent the School from permitting the filming or recording of some plays and concerts. The School will always print a reminder in the programme of events where issues of copyright apply.
• Parents may not film or take photographs in changing rooms or backstage during School productions, nor in any other circumstances in which photography or filming may embarrass or upset pupils, by reference to their dress or activity or any other factor
• The School reserves the right to refuse or withdraw permission to film or take photographs (at a specific event or more generally), either for all attendees/parents (where a safeguarding risk to an individual child has been identified) or for any individual parent who does not follow these guidelines or is otherwise reasonably felt to be making inappropriate images.
• The School sometimes records plays and concerts professionally (or engages a professional photographer or film company to do so) for archive purposes and for the personal use only of cast and crew. Parents of pupils taking part in such plays and concerts will be consulted if it is intended to make such recordings available more widely.
8. Use of Cameras and Filming Equipment by Pupils
• All pupils are encouraged to look after each other, and to report any concerns about the misuse of technology, or any worrying issues to a member of the pastoral staff.
• The use of cameras or filming equipment (including on mobile phones) is not allowed in toilets, washing or changing areas, nor should photography or filming equipment be used by pupils in a manner that may offend or cause upset.
• The misuse of images, cameras or filming equipment in a way that breaches this policy, or the School's Anti-Bullying Policy, Data Protection Policy, eSafety Policy, Pupil IT Acceptable Use Policy, Safeguarding (Child Protection) Policy or the School Code of Conduct is always taken seriously and may be the subject of disciplinary procedures or dealt with under the relevant policy as appropriate.
9. Use of Filming Equipment in Sport
• Hampton School uses specialist video camera recording devices and software to record some of its sports events. On rare occasions, matches in which Hampton School pupils are playing may be livestreamed by a third-party provider. Such video recordings / live-streams will show images of individuals playing or watching sports; such images are personal data which must be processed in accordance with data protection laws.
• In the case of recordings, the video systems are administered and managed by the School which is the controller in respect of the personal data collected. The equipment is operated by authorised members of staff. No images will be captured from areas in which individuals would have a heightened expectation of privacy.
• The data processors / providers which process and store this personal data on the School’s behalf are engaged subject to appropriate contractual safeguards which are put in place to protect the security and integrity of the data.
• The School’s purposes for using such systems are set out below:
▪ As an educational tool - to facilitate game analysis and coaching;
▪ To ensure compliance with sporting rules as well as the School’s Code of Conduct, policies and procedures;
▪ In the case of live-streaming, to enable other pupils as well as parents to watch important matches (particularly where the distance to travel is prohibitive);
▪ To safeguard players; and
▪ To ensure the health and safety of everyone present.
• With the possible exception of live-streaming and having fully considered the privacy rights of individuals, the School believes that the purposes set out above are all in its legitimate interests.
• The key effect of the School relying on legitimate interests is that parents and pupils may be entitled to object to such uses, although their specific consent will not be sought beforehand. Any objections will be duly considered by the School, but objections can be overridden by other factors.
• Consent may be sought in the case of live-streaming; the need for consent will be considered in light of the relevant circumstances, e.g. the nature of the intended audience.
• Data captured for the purposes set out above will not be used for any commercial purpose.
• Signage will be placed in proximity to the match sites to inform pupils, parents, staff and visitors that filming is taking place, identifying (as appropriate) the School as the controller operating the video recording system and signposting further information. Parents will also be given information on sports match recordings via the Director of Sport’s annual sports update.
• Recordings will not normally include any commentary or use of pupil names.
• Images will be stored for one season and then deleted unless the School considers it reasonably necessary for the pursuit of the objectives outlined above, or if it is lawfully required to retain such data (for example, by an appropriate third party such as the police).
• Any queries in relation to the School’s use of sports recording equipment should be addressed to data@hamptonschool.org.uk.
10. Limitation of Image Use
If parents make a request to limit use of pupil images (and unless the request is unreasonable or handling it would be too difficult or costly compared to the request itself), the School shall take the following actions:
• For School marketing publications, requests can be made at any time and, if possible, the images can be replaced if there is a further publication.
• For the School website, requests can be made at any time and the digital media replaced within 14 days.
• For the School-managed social media accounts, requests can be made at any time and the digital media removed within 30 days.
1. Introduction
1.1 As an independent school with a long-standing history and community, the School maintains certain records about its pupils, alumni, current and former parents, current and former members of staff/Governors and other individuals connected with the School for archival and historical purposes. The School stores such data in order to preserve its history and identity, to support research, and to maintain a record of the School’s activities, achievements and development.
1.2 The purpose of this notice is to explain in more detail how the School stores, manages and protects the personal data contained in the School Archive.
2. Types of Personal Data held in the School Archive and How it is Collected
2.1 The following is a non-exhaustive list of the types of information the School may preserve as part of its permanent archive:
• Documents relating to the School’s foundation and history;
• Lists of past staff and pupils;
• Records of academic performance including prize lists, public examination results and notable achievements;
• Records of sporting activities;
• School publications such as magazines, newsletters, yearbooks and prospectuses;
• Photographs, videos and records of the School, its community, its events, sports fixtures and performances;
• Records of clubs, societies, awards and trips;
• School Inspection reports;
• Governance, development and estate-related documents;
• News cuttings relating to the School;
• Minutes of meetings of the Old Hamptonians’ Society;
• Ephemera relating to the School and its activities;
• Other official, legal and administrative records;
• Other documents considered historically or culturally significant to the School community.
2.2 The School may acquire this personal data in a number of ways, including:
• Through the School’s historic and ongoing record keeping and collection of material
• In relation to parents and pupils, the School collects and processes personal data before, throughout and after a pupil’s attendance at the School in the ordinary course of provision of education services and through the pupil’s / parent’s interactions with the School.
• Personal data relating to members of staff will be processed by the School during the course of employment or engagement with the School. The same is true for governors upon their appointment and during their term of governance.
• Data may also be collected when a member of the School community attends an event or makes a donation to the School’s Archives.
• Records may be donated from other external institutions.
3. Why the School Keeps this Personal Data
3.1 These archiving activities are carried out to document and maintain the School’s history, memory and legacy; support alumni engagement and the School's marketing and development function; provide curricular and extra-curricular opportunities / resources / activities for pupils; facilitate research; and preserve materials relating to the School’s heritage. The School expects that these uses will fall within the category of its “legitimate interests”. For the limited circumstances where archived material includes special category data (for example personal data contained in school publications revealing racial or ethnic origin, political opinions, religious or philosophical beliefs etc), the School expects that the uses outlined above will fall within the category of “archiving in the public interest” – ensuring the permanent preservation and usability of records of enduring value for general public interest. For further information, please see the School’s Archive and Acquisition Policies.
3.2 Where required, the School also retains certain records to comply with its legal obligations under legislation governing education and independent schools (e.g. admissions and attendance registers).
4. How Long we Keep and How We Store Archive Material
4.1 While most personal data is held by the School for a limited period, in line with how long it is necessary to keep for a legitimate and lawful reason (and in accordance with the School’s Records Management Policy and Records Retention Schedule), materials are retained permanently where they:
• form part of the School’s historical record;
• document significant events or achievements; or
• have long-term historical, cultural or research value.
4.2 The School has entered into an agreement with a third party for the provision of a secure digital Collection Management System (CMS) to hold the catalogue of its records. To protect archived digital data, the CMS employs access permissions such that the catalogue is managed by a small number of approved members of School staff. Other staff and verified members of the alumni community are granted access to selected catalogue areas (via a passwordprotected service). A more limited selection of the catalogue is made available to members of the public for research purposes. This third-party processing activity is subject to contractual assurances that personal data will be kept securely and only in accordance with the School’s specific directions.
4.3 Physical items are stored securely within locked cabinets or stores accessible only by approved members of staff.
4.4 The School uses reasonable endeavours to ensure that archival collections contain no more personal data than is necessary.
5. Your Rights in relation to Archived Information
Where personal data is held for the purposes of archiving in the public interest, some data protection rights may be restricted where exercising them would seriously impair the archiving purpose. These include:
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
The relevant exemptions are set out under data protection legislation. If an exemption applies, the School will explain this when responding to a request.
6. Safeguards and Security
To protect archived data, the School uses:
• secure physical and digital storage with controlled access (see above);
• procedures governing access by staff, alumni, researchers and third parties (see above and the School’s Archive and Acquisitions Policies);
• minimisation of personal data wherever feasible;
• pseudonymisation or anonymisation for research purposes where appropriate;
• a documented policy explaining how the School safeguards archived data and complies with data protection legislation (see the School’s Archive and Acquisitions Policies).
7. Who Can Access Archived Material?
7.1 Access to the School’s archive collections is carefully managed by the School’s Archivist in accordance with the School’s Archive and Acquisitions Policies.
7.2 Certain non-sensitive materials (e.g., historic photographs, magazines, event programmes) may be shared:
• with alumni and former staff;
• for School marketing and development activities; or
• with researchers or historians (where appropriate).
7.3 More sensitive or personal material is not released or published without a lawful basis and may only be accessed by approved members of staff.
8. Contact
8.1 Queries relating to the School Archive should be directed to the School’s Archivist via info@hamptonschool.org.uk
8.2 Should you have any comments or queries on this notice, or should you wish to exercise any of your rights under data protection law, please email data@hamptonschool.org.uk.