Privacy Notice

WELLINGTON COLLEGE EDUCATIONAL ENTERPRISES LTD

PRIVACY NOTICE

Wellington College Educational Enterprises Ltd is registered at Companies House with registered number 06578707 (“WCEE”). WCEE is a trading subsidiary of The Wellington College (the “College”).

WCEE is a data controller for the purposes of data protection legislation as we process personal data. This notice is designed to give you information about how we process that data. Our duties in respect of personal data are very important to us and we are committed to using the personal data we hold in accordance with the law. The College’s Legal & Compliance Director is responsible for data protection at WCEE and will endeavour to ensure that WCEE complies with its responsibilities. Any queries should be directed to her by email at data@wellingtoncollege.org.uk or by post at The Bursary, Wellington College, Duke’s Ride, Crowthorne, RG45 7PU.

This notice applies alongside any other information WCEE or any of its businesses may provide about a particular use of personal data, for example when collecting data via an online or paper form. The notice should be read in conjunction with our other policies and contracts which apply to you and which make reference to personal data. This includes any contract you have entered into with WCEE, our or, where relevant, the College’s safeguarding, pastoral, health & safety policies and IT policies. Separate privacy notices apply to the College and to our staff.

It should be noted that the College also has safeguarding and child protection duties and that, if there is a potential conflict between these duties and those under data protection legislations, the welfare of the child is paramount.

WHAT TYPE OF PERSONAL DATA DOES WCEE PROCESS?

We process personal data about prospective, current and past: pupils, staff directors and volunteers of WCEE, the College and Eagle House; suppliers and contractors; staff and directors of the companies with whom we enter into commercial contracts and negotiations regarding the operation of schools outside of England; staff, pupils and governors of the schools operated by such companies.

The personal data we process takes different forms (it may be factual information, opinion, images or other recorded information) and the type of data processed will depend on your relationship with WCEE. Examples of the personal data we process include:

names;
addresses, telephone numbers, email addresses and other contact details;
education and employment information;
in respect of those who access the College site, images and video footage;
bank details and other financial information;
audio and video recordings;
courses, activities meetings or events attended;
car details; and
correspondence with and concerning individuals.

We may also need to process special category personal data (for example, regarding physical or mental health, ethnicity, religion or biometric data) and criminal records information about some individuals (particularly staff). Where we process this type of data, we will either rely on rights or duties imposed on us by law (for example, in respect of safeguarding, health and safety or employment) or on explicit consent.

HOW DOES WCEE COLLECT PERSONAL DATA?

Most of the personal data processed by WCEE is provided by the individual. This may be provided via a form or simply in the ordinary course of interaction or communication. However, in respect of those who are directors or staff of the companies with whom we enter into contracts or staff, governors or pupils of the schools operated by them, the personal data may have been provided by the company or school; in respect of all of those subject to this notice, some personal data may be provided to us by third parties (for example, referees, the Disclosure & Barring Service, professionals or authorities working with the individual), with the consent of the individual or from publicly available resources.

WHO HAS ACCESS TO PERSONAL DATA?

The College provides administrative, financial, HR, IT and legal services to WCEE as well as guidance on the educational services and operational support being provided by WCEE. In order to provide these services, certain personal data has to be shared with the College subject to appropriate controls.

We have taken appropriate technical and organisational steps to protect your personal data and have implemented policies addressing use of technology and devices and access to the College’s IT systems. Particularly strict rules of access apply in the context of medical records and pastoral or safeguarding files although, in certain circumstances, some personal data will need to be disseminated more widely in order to provide the necessary care for an individual.

Some of the College’s systems are provided by third parties with some being hosted by the College and others externally. The organisations providing these systems are aware of the requirements of current data protection legislation and our contracts with them contain assurances that personal data will be kept securely and only in accordance with our specific directions. We do not transfer personal data outside of the European Economic Area unless we are satisfied that the personal data will be afforded an equivalent level of protection, for example, through our contractual arrangements with those operating Wellington College international schools.

In certain circumstances, we share personal data (including, where necessary, special category personal data) with third parties in order to further the objectives and interests of WCEE and to facilitate the efficient operation of WCEE. Examples of the third parties with whom we share personal data are Wellington College, Eagle House School, schools within our international network and the operators of those schools, relevant government authorities and regulatory bodies (such as the Local Children Safeguarding Board, the Police DBS, HMRC, the Home Office, DWP, Companies House, the Information Commissioner), the emergency services, those supplying goods and services to WCEE and WCEE’s professional advisers.

WHY DO WE PROCESS PERSONAL DATA?

We process personal data to support WCEE’s operations, objectives and interests. This broad purpose encompasses the following:

the provision of licensing rights, educational guidance and operational support to companies with whom it has entered into contracts in respect of the operation of schools outside the United Kingdom and the schools operated by such companies;
the safeguarding of children’s welfare and provision of pastoral and medical care, and to take appropriate action in the event of an emergency, incident or accident;
compliance with legislation and regulation, including that relating to safeguarding, health and safety, employment and companies;
operational management including the compilation of records, the administration of invoices, fees and accounts, the management of WCEE’s or the College’s property, the management of security and safety arrangements (including the use of CCTV in accordance with the College’s CCTV policy, to run any of its systems that run off biometric data in accordance with our Biometrics Policy and monitoring of the College’s IT and communication systems), management planning and forecasting, research and statistical analysis and other operational purposes;
staff administration, including the recruitment of staff, directors and other volunteers and engagement of contractors (including compliance with DBS procedures), administration of payroll, pensions, sick leave and other benefits, review and appraisal of performance, conduct of any grievance, capability or disciplinary procedures, the maintenance of appropriate human resources records for current and former staff and providing references;
the promotion of WCEE and its businesses including the exploration of opportunities to open additional international schools and other development opportunities;
compliance with any internal or external complaints, disciplinary or investigation process;
for legal and regulatory purposes and to comply with its legal obligations and duty of care;
obtaining appropriate professional advice and insurance for WCEE; and
where specifically requested by the individuals concerned.

WCEE may process your data for the above purposes because:

it is necessary for the performance of a contract or in order to take steps at a contracting party’s request prior to entering into such a contract;
it is necessary for our compliance with our legal obligations. For example, we may use personal data to exercise or perform any right or obligation conferred or imposed by law in connection with employment and/or for the prevention and detection of crime and/or in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities;
it is necessary for our or a third party’s legitimate interests. Examples of our “legitimate interests” include our interests in providing licensing rights, educational guidance and operational support to third parties operating schools outside of England or protecting the College’s reputation;
it is necessary to protect an individual’s vital interests in certain limited circumstance;
it is necessary for the establishment, exercise or defence of legal claims;
it is necessary for the performance of a task carried out in the public interest (or carrying out public tasks).
it is necessary for reasons of substantial public interest, including safeguarding purposes;
it is necessary for medical purposes, including for assessing the working capacity of staff;
it is necessary for archiving, research or statistical purposes;
we have an individual’s specific or, where necessary, explicit consent to do so.

Where examples are given above, that basis is not limited to those examples.

In some cases, we will rely on more than one basis for a particular use of your information. In addition, we may move from one of the legal bases listed above to another as circumstances change.

As an alternative to relying on any of the bases listed above, we may rely on your consent to use your information in certain ways. If we ask for your consent to use your personal data, you may withdraw this consent at any time. Such withdrawal will not affect the lawfulness of our processing of any data on the basis of that consent prior to that date.

FOR HOW LONG DO WE KEEP PERSONAL DATA?

Personal data will be kept securely and for no longer than is necessary or required by law. This period will vary depending on the piece of personal data and the purpose for which it was collected. If you have any specific questions in respect of retention, please direct them to the College’s Legal & Compliance Director.

WHAT RIGHTS DO YOU HAVE IN RESPECT OF YOUR PERSONAL DATA?

If we process personal data about you, you have a number of rights in respect of that data. Subject to certain exemptions and limitations specified by law, you can:

require WCEE to change incorrect or incomplete data;
require WCEE to delete your data in certain circumstances;
withdraw your consent to WCEE processing certain personal data where WCEE is relying on your consent to do so;
object on grounds relating to your particular situation to WCEE processing your data where we are relying on our legitimate interests or public interest to do so where you feel that it has a disproportionate impact on your rights or where we are processing your data for direct marketing purposes;
require WCEE to transfer your personal data to another organisation if (a) such personal data has been provided by you; (b) the basis on which we are relying to process your data is consent or contract; and (c) the information is being processed by us on a computer; or
access and obtain a copy of your data on request.

If you would like to exercise any of these rights, please contact the College’s Data Information Officer by email at data@wellingtoncollege.org.uk or by post at The Bursary, Wellington College, Duke’s Ride, Crowthorne, RG45 7PU. We will respond to such written requests as soon as is reasonably practicable and in any event within the time limits permitted by law which is typically one month but may be extended if your request is complex.

WCEE will be better able to respond quickly to smaller, targeted requests for information. In circumstances where we consider a request to be manifestly unfounded or excessive and data protection law permits, we may ask you to reconsider or charge a proportionate fee.

You should be aware that certain data is exempt from the right of access. This may include information which identifies individuals or information which is subject to legal privilege. We are also not required to disclose any pupil examination scripts (thought examiners’ comments may fall to be disclosed) nor any confidential reference given or received by the College for the purposes of the education, training or employment of any individual.

DATA ACCURACY AND SECURITY

WCEE will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must please notify the Legal & Compliance Director of any significant changes to important information, such as contact information, held about them.

An individual has the right to request that incorrect information held about them is corrected and that any information held about them is erased. However, we will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing your personal data: for example, a legal requirement or where it falls within a proportionate legitimate interest identified in this Privacy Notice. Generally, if WCEE still considers the processing of the personal data to be reasonably necessary, it is entitled to continue. All such requests will be considered on their own merits.

WCEE will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around the use of technology and devices and access to our IT systems.

THIS NOTICE

WCEE will update this notice from time to time. Any substantial changes that affect your rights will be notified on our website and, as far as reasonably practicable, notified to you.

This privacy notice does not, and is not intended to, give you any rights which you did not already have. For example, it does not give you any additional contractual rights.

If you believe that WCEE has not complied with this notice or acted other than in accordance with data protection laws, you should notify the College’s Data Information Officer. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with WCEE before involving the regulator. You can also find out more about your rights under data protection law from the ICO website (www.ico.org.uk).

Legal & Compliance Director

August 2021

Reviewed and updated September 2022

Updated to reflect the change of name November 2022