Privacy Policy for Alumni

St Peter's School, York

September 2022

This privacy notice describes how we collect and use personal information about you as you are an alumnus with us, in accordance with the UK General Data Protection Regulation (UK GDPR).

Following Brexit, Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) is retained EU law and known as UK GDPR. The UK GDPR sits alongside an amended version of the Data protection Act 2018 that relate to general personal data processing, powers of the Information Commissioner and sanctions and enforcement. The GDPR as it continues to apply in the EU is known as EU GDPR.

This privacy notice applies to all alumni.

Who Collects this Information?

St Peter’s School, York is a “data controller.” This means that we are responsible for deciding how we hold and use personal information about you.

We are required under data protection legislation to notify you of the information contained in this privacy notice. This notice does not form part of a contract to provide services and we may update this notice at any time.

It is important that you read this notice, with any other policies mentioned within this privacy notice, so you understand how we are processing your information and the procedures we take to protect your personal data.

Data Protection Principles

We will comply with the data protection principles when gathering and using personal information, as set out in our data protection policy. Every organisation that processes data must have a valid lawful basis for doing so. The basis we use for processing your data will depend on your relationship with us.

Former pupils and staff

It is reasonable to expect that any individual who has been a pupil or member of staff at our School will be interested in receiving occasional news updates and will have interest in hearing about events that are relevant to them - for example, a reunion of their former classmates. It is also reasonable to expect that former pupils and staff will be supportive of our activities in pursuing our charitable purpose. We will, therefore, rely on the basis of legitimate interest to contact former pupils or staff who have never been asked for permission to stay in touch.

However, we wish to ensure all communications are in line with the wishes of the individual, and we therefore prefer to secure your consent, and ascertain your communication preferences, as the opportunity arises. In addition, where an individual has not given any indication that contact is welcome for a period of five or more years (for example, by responding to a communication from us), and where we can therefore no longer be confident of the accuracy of the contact details that we hold, we shall make one final attempt to make contact with you and secure your consent to stay in touch, after which time we shall await direct contact from you.

Pupils who have left the Upper Sixth on or after July 2015 are asked to give their consent to future communications when they leave us. These pupils will not be contacted unless we have this consent.

Former parents

We rely on consent to process your data. We shall seek permission to stay in touch when your child leaves the School. If we do not have your permission, we shall not contact you from the Development & Alumni Office.

Donors

Where a donor does not fall into any other category, we will process your data on the basis of legitimate interest, to ensure we meet all legal requirements for donations.

Friends of the School

Friends of the School may fall into two main categories:

·       Those who have a previous direct and personal connection with the School (for example, as a former Governor)

·       Those who are likely to have an interest in the School because of their own current

or former position (for example, as Chief Executive of the Local Authority)

We will process the data for these individuals on the basis of legitimate interest.

 Categories of Alumnus Information we Collect, Process, Hold and Share

We process data relating to alumni. Personal data that we may collect, process, hold and share (where appropriate) about you includes, but not restricted to:

·       Contact information such as name, Previous names, gender, dob, address, email

address, contact numbers, Marital status.

·       Relationship with the school.

·       Other institutes of study and what was studied.

·       Friends and family who have a connection with the school.

·       Historical records of your time in school, including records of your achievements

and interests, photos and videos.

·       Records of contributions you have made to the school since leaving, such as your

time, expertise, or financial contribution.

·       Records of how you have engaged with our alumni network, including emails you

have opened, events attended, mailing lists you have signed up to and other interactions.

·       Bank details.

·       Records associated with Gift Aid claims on donations.

·       Donations made to the school.

·       Records of your consents and contact preferences.

·       Information required to manage your attendance at alumni events, including access

arrangements and dietary requirements which may include health conditions and

CCTV footage when attending our school site.

·       Medical information such as allergies and access arrangements to help the school meet your needs when attending events attend events.

How we collect this Information

We may collect this information from you in a number of different ways. The main data will be from the school Management Information System such as names, address, dob, gender, email address, contact details and names of parents. In addition, we will collate information that you give to the school during communication including attendance at events and or when you donate to the school. We may carry out background research using publicly available sources of information. And noting data volunteered by your peers. We use analytical tools (such as Google Analytics) to track use of our website, and to monitor the electronic communications that we send out (for example, by tracking whether emails are being opened, and which stories are most likely to be read, to help us work out which kinds of information are most interesting to alumni). We may also collect data through our signing in system, our websites and other technical systems such as our computer networks and connections, CCTV and access control systems, remote access systems, email and instant messaging systems, intranet and internet facilities.

How we use your Information

We will only use your personal information when the law allows us to. Most commonly, we will use your information in the following circumstances:

·       Where we need to comply with a legal obligation (such as health and safety legislation, under statutory codes of practice and employment protection legislation).

·       Where it is necessary for our legitimate interests (or those of a third party) and your interests, rights and freedoms do not override those interests.

·       When you have provided us with consent to process your personal data.

We need all the categories of information in the list above primarily to allow us to perform our contract with you, with your consent and to enable us to comply with legal obligations. The situations in which we will process your personal information are listed below:

·       Alumnus management including retention.

·       Complying with legal obligations.

·       Carry out necessary administration functions.

·       Health and safety obligations.

·       Prevention and detection of fraud or other criminal offences.

·       To defend the School in respect of any investigation or court proceedings and to

comply with any court or tribunal order for disclosure.

·       Help us build a community around our school.

·       Offer enrichment and career development opportunities to current students.

·       Raise money so that we can continue to improve the experience students get from

School.

·       Asking for your help, perhaps by providing careers advice to current pupils, or

hosting an Old Peterite event in your area.

·       Notify you of alumni events you may be interested in.

·       Keep you up to date with school news.

·       Help us promote our events.

·       Maintain a record of visitors to our school.

·       Tailor the communications we send to you, to ensure they are appropriate and

relevant.

·       Carry out analysis of our community to help us ensure our activities are relevant. For example, working out which geographical areas are home to large numbers of Old Peterites, so that we can arrange events in those areas, or finding out which proportion prefer to be contacted by a certain means, so that we can adapt our communications programme

·       Carry out research (sometimes known as profiling) on an individual, and storing the

results. We may typically do this before we approach someone that we hope may

be able to make a significant donation to the School. We will not carry out

automated profiling, known as  “wealth screening”.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information. We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. 

How we use Particularly Sensitive Information

Sensitive personal information (as defined under the UK GDPR as “special category data”) require higher levels of protection and further justification for collecting, storing and using this type of personal information. We may process this data in the following circumstances:

·       In limited circumstances, with your explicit written consent.

·       Where we need to carry out our legal obligations in line with our data protection

policy.

·       For legitimate interests.

·       Where it is needed to assess your working capacity on health grounds, subject to

appropriate confidentiality safeguards. Less commonly, we may process this type of

information where it is needed in relation to legal claims or where it is necessary to

protect your interests (or someone else’s interests) and you are not capable of giving

your consent.

Sharing Data

We may need to share your data with third parties, including third party service providers where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so. These include the following:

·       Professional advisors such as lawyers and consultants.

·       The School finance/accounting teams; and Support services (including insurance, IT support and information security).

·       A mailing house to send newsletters.

·       A fundraising consultancy contracted to run a fundraising campaign e.g. telephone campaign.

Information will be provided to those agencies securely or anonymised where possible. The recipient of the information will be bound by confidentiality obligations, we require them to respect the security of your data and to treat it in accordance with the law. We will not sell your data or pass it to any organisation for any purpose other than for assisting us in delivering our development and alumni activities. We will satisfy ourselves that their data processing is secure and will transfer the data to them by secure means.

“The Social Archive”

The alumni department manages a system called “The Social Archive” which allows OPs to view and upload St Peter’s archival material. This website will also allow you to share information about yourself with other OPs and staff.

Any information that you choose to share or upload with the Social Archive website will be visible by other Old Peterites and school staff.

Photos of extra-curricular activities from your time at school may also be visible on this website.

The website has a feature which would allow you or other people to ‘tag’ the photo with your name to allow users to easily search for photos of an individual.  If you wish you can switch this functionality out.

If you have questions about photos that have been uploaded, or if you wish to have a photo removed or redacted, please contact:  development@stpetersyork.org.uk.

Storing Data

Your data is held on the Raisers Edge database, a product supplied by Blackbaud. This database is protected. Access is restricted to individuals who need to see the data to carry out their duties, and to our IT support team for essential technical support. Although most of the information we store and process stays within the UK, some information may be transferred to countries outside the European Economic Area (EEA). This may occur if, for example, the servers used by a trusted supplier are located in a country outside the EEA. Where these countries do not have similar data protection laws to the UK, we will take steps to make sure they provide an adequate level of protection in

accordance with UK data protection law. Data may also be held in hard copy format, within the Development and Alumni Office and the School Archives. Some records are held long term (for example, admissions registers compiled prior to the introduction of computer systems) and some may be temporary or short term (for example, details of event attendees during planning for an event). These records are kept under direct supervision or in secure locked storage at all times.

Retention Periods

Except as otherwise permitted or required by applicable law or regulation, the School only retains personal data for as long as necessary to fulfil the purposes they collected it for, as required to satisfy any legal, accounting or reporting obligations, or as necessary to resolve disputes. We will retain your data for as long as you remain a member of our alumni and up to a year afterwards (or longer if the law requires us to, e.g. for financial records). In line with the UK GDPR and the storage limitation principle, the school likes to retain personal data for longer periods. This is because we keep this data for the sake of public interest archiving, scientific or historical research, or statistical purposes. Due to the long-standing history of the school, there are a number of items that we may retain for longer than usual. These items include year group photos, videos, pupil listings, (this list is non exhaustive).

Security

We have put in place measures to protect the security of your information (i.e. against it being accidentally lost, used, or accessed in an unauthorised way). In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

Your Rights of Access, Correction, Erasure and Restriction

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

Under certain circumstances by law you have the right to:

·       Access your personal information (commonly known as a “subject access request”). This allows you to receive a copy of the personal information we hold about you and to check we are lawfully processing it. You will not have to pay a fee to access your personal information. However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

·       Correction of the personal information we hold about you. This enables you to have any inaccurate information we hold about you corrected.

·       Erasure of your personal information. You can ask us to delete or remove personal data if there is no good reason for us continuing to process it.

·       Restriction of processing your personal information. You can ask us to suspend processing personal information about you in certain circumstances, for example, if you want us to establish its accuracy before processing it.

·       To object to processing in certain circumstances (for example for direct marketing purposes).

·       To transfer your personal information to another party.

If you want to exercise any of the above rights, please contact our Data Manager in writing. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).

Right to Withdraw Consent

In the circumstances where you may have provided your consent to the collection, processing, and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our Data Manager. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

We hope that our Data Manager can resolve any query you raise about our use of your information in the first instance.

We have appointed a data protection officer (DPO) to oversee compliance with data protection and this privacy notice. If you have any questions about how we handle your personal information which cannot be resolved by our Data Manager, then you can contact the DPO on the details below:

Data Protection Officer: Judicium Consulting Limited

Address: 72 Cannon Street, London, EC4N 6AE

Email: dataservices@judicium.com

Web: www.judiciumeducation.co.uk

Lead Contact: Craig Stilwell

How to Raise a Concern

You have the right to make a complaint at any time to the Information Commissioner’s

Office, the UK supervisory authority for data protection issues.

·       Report a concern online at https://ico.org.uk/concerns/

·       Call 0303 123 1113

·       Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF