Effective date: 17 September 2024.
This policy sets out a clear explanation of Embley’s website data processing practices and how we safeguard your personal data. It explains what data we collect, why we collect it and what we do with it. We are committed to preserving your privacy. Any data you provide will be held securely and in accordance with the UK General Data Protection Regulations and The Data Protection Act 2018 from 25 May 2018.
Who we are
Within this notice, whenever you see the words ‘we’, ‘us’ or ‘our’, it refers to Embley and our website address is www.embley.org.uk.
The proprietor of Embley is United Church Schools Trust (UCST). UCST is the data controller of personal data held by the school. UCST is registered with the Information Commissioner’s Office (ICO). The registration number is Z533407X. The Company Secretary, Alison Hussain, is responsible for ensuring that UCST complies with the Data Protection Law. She can be contacted on company.secretary@unitedlearning.org.uk or 01832 864538.
We may make changes to this notice from time to time. If we do, we will update the ‘Effective date’ at the top of this policy. We recommend that our users periodically review our Privacy Policy to ensure that they are notified of any updates.
Your consent
By using our website, you are giving us your consent to gather and process information about you in accordance with this policy. For certain types of information or processing, we may request further consent.
When the legal basis for processing your personal data is that you have provided your consent to that processing, you may withdraw your consent at any time by contacting the School’s Data Protection Lead (lisa.johnson@embley.org.uk). If you withdraw your consent, it will not make processing which we completed before you withdrew your consent unlawful.
Lawful basis for processing data
We collect and process personal data about users in the EU when we have a legal basis for doing so under Article 6 of the General Data Protection Regulation (GDPR). We rely on the following legal bases to collect and process personal data in the EU:
- Individual content: Users have provided their specific consent to the processing of their personal data and specific sensitive data for one or more specific purposes. Consent can be withdrawn at any time where personal data is processed for a processing purpose related to this lawful basis.
- Legitimate interest: Processing of personal data is required for purposes of legitimate interests pursued by Embley. Our legitimate interests are to ensure that the school complies with its legal obligations as an education provider and its contractual obligations as set out in our Admissions Policy. Our legitimate interest is not overridden by the interests or fundamental rights and freedoms of users.
The information we collect and why we collect it
Personal information we collect: We only collect data that helps us achieve the purpose set out in this policy. We will not collect any additional data through the website beyond the data listed below without notifying you first. If you do not provide us with certain information, we may not be able to fulfil the requested purpose of collection.
Data collected automatically: When you visit the website, some information is automatically collected. This may include but is not limited to IP addresses, clicked links, content viewed and pages visited. This is used for statistical data gathering and analysis, and may be used to tailor your experience to the website.
Data collected in a non-automatic way: We may collect and process personal data when you perform certain functions on our website, such as the completion of forms. We will only collect the data shown in the form along with the time and date the form was submitted. The data collected will only be used in accordance with the transparency notice attached to the form.
We may ask for personal identifiers (e.g. parent’s name, child’s name, parent’s contact details, child’s date of birth) in the registration form. In limited circumstances, we may also process a limited amount of sensitive personal data (‘special category data’). This is done in line with the ICO guidance and may include information about a child’s medical or learning support needs so that we can offer appropriate support for entrance assessments and during the admissions process where necessary. We always ask for explicit consent to process and hold personal information about an individual, including sensitive information, for the purposes of assessment and, if a place is later offered, to safeguard and promote the welfare of a child.
If you are an existing family of the school, we will combine this information with information we collect on the Site and use it for the purposes described below.
We may use your information to help you with information and services that you request from Embley. This could be to provide customer service and respond to user queries; supporting new applicants through our admissions process or staff recruitment; communicating with you about events and other marketing communications; to comply with our policies, procedures and legal obligations; and as otherwise consented to you and as required by applicable law.
How long we store personal data
We will retain your information for the period necessary to fulfil the purposes outlined in this policy and as otherwise needed to comply with applicable law and internal company policies.
How we protect your data
To protect your security, we use the strongest available browser encryption and store all of our data on servers in secure facilities. All data is only accessible to our employees. Our employees are bound by strict confidentiality agreements and a breach of this agreement would result in the employee's termination.
While we take all reasonable precautions to ensure that user data is secure and that users are protected, there always remains the risk of harm. The Internet as a whole can be insecure at times and therefore we are unable to guarantee the security of user data beyond what is reasonably practical.
How we store your data
Our hosting operations are based in the UK and we store most of our data within the European Union (EU). Some organisations which provide services to us may transfer data outside the European Economic Area but we'll only allow this if your data is adequately protected.
Who we share data with
We may disclose your data to other employees of the school who reasonably need access to the data to achieve the purposes set out in this policy. We do not share your information with third parties, except where it is permitted or required by any applicable law, regulation or legal process; to defend the interests, rights, and/or property of the School or others; or to respond to emergencies. We may otherwise share your information as directed by you or subject to your consent.
Your rights as a user
We will always respect your rights. We fully observe your right to access your personal data, to object to the processing of personal data, or to erase, restrict, rectify or port your personal data. Relevant requests can be made to the School’s Data Protection Lead (lisa.johnson@embley.org.uk).
How to opt out of data collection
If you do not want to receive marketing and promotional emails from Embley you may click on the ‘unsubscribe’ link in the email to unsubscribe and opt-out of marketing email communications. Alternatively, to the extent that applicable law requires your prior opt-in consent to receive marketing and promotional emails, you can choose not to opt-in. Please note that even if you opt-out of receiving marketing communications from the website, we may need to send you service-related communications, such as confirmations of any future reservations to our events.
How to access, modify, delete or challenge the data collected
If you would like to know if we have collected your personal data, how we have used your personal data, if we have disclosed your personal data and to who we disclosed your personal data, if you would like your data to be deleted or modified in any way, or if you would like to exercise any of your other rights under the GDPR, please contact the School’s Data Protection Lead (lisa.johnson@embley.org.uk).
Cookies
A cookie is a small file, stored on a user's hard drive by a website. Its purpose is to collect data relating to the user's browsing habits. You can choose to be notified each time a cookie is transmitted. You can also choose to disable cookies entirely in your internet browser, but this may decrease the quality of your user experience. We use the following types of cookies on our website:
- Functional cookies: Used to remember the selections you make on our website so that your selections are saved for your next visits.
- Analytical cookies: These allow us to improve the design and functionality of our website by collecting data on how you access our website, for example data on the content you access, how long you stay on the website, etc.
Complaints
If you are not happy, in the first instance please talk to us directly so we can resolve any problem or query. If you feel we have not addressed your concern in a satisfactory manner you may contact a supervisory authority. You also have the right to directly make a complaint to a supervisory authority. You can lodge a complaint with a supervisory authority by contacting the Information Commissioner's Office in the UK via their helpline 0303 123 113 or at www.ico.org.uk.
Contact information
If you have any questions, concerns or complaints, please contact the School’s Data Protection Lead (lisa.johnson@embley.org.uk). We will aim to respond to all queries within 30 days.
Disclaimer
Whilst we take care to ensure the accuracy of the content on our website, to the extent permitted by law, Embley assumes no legal liability for and does not warrant that the information contained on this website is accurate or complete, or that these web pages will be free from errors or that its availability will be uninterrupted and Embley hereby expressly disclaims and excludes all express and implied warranties terms or conditions not stated herein, so far as such exclusion or disclaimer is permitted under the applicable law. Embley excludes all liability to any person for any loss or damage caused by any errors or omissions, whether such errors or omissions result from negligence, accident or any other cause but this disclaimer is without prejudice to any claims for fraudulent misrepresentation, personal injuries or death.
Restrictions on use of content
The content of this website and all copyright and other intellectual property rights therein belong to Embley or its content providers. You are hereby granted permission to access the website and print a copy of the content as a record of your visit. All other use of the website and its content, including modification, publication, transmission, creation of derivative works, incorporation into another website or reproducing our website or its content (whether by linking, framing or any other method) is not permitted without our prior express written consent.