Privacy

How We Use Your Information: Privacy Notice – Alumnae, Friends and Supporters

Introduction

This privacy notice is intended to provide information about how the School will use (or process) Personal data about individuals including alumnae, friends and supporters for the purposes of maintaining a lasting, life-long relationship with the School. This notice explains how and why the Engagement and Development office uses personal data about you when carrying out our engagement and fundraising activities. This notice also outlines what we do with your personal data and what decisions you can make about your personal data in relation to fundraising and development. If you have any questions about this notice please contact the Engagement, Development and Marketing Offices on externalrelations@theabbey.co.uk or 01189 872256. This policy includes use of data used and stored as part of the “AbbeyConnect” platform - a communications tool to keep in regular contact with alumnae including the sending of school news, newsletters, invitations to events and fundraising campaigns. As “AbbeyConect” is a communications platform operated by the School, the School is responsible for any data that is used and stored on there. To use data protection terminology, the School is the "data controller" or "controller". Whilst many people receive communication via “AbbeyConnect” because they have registered to do so, some data stored on the “AbbeyConnect” database has been transferred into this database. This notice only covers how the School uses your personal data for engagement and fundraising purposes. For more information about how the School uses your personal data more widely (for example, in relation to educating students) please see the Privacy Notices under the policies section of the School website – https://theabbey.co.uk/policies or contact the Data Protection Lead whose contact details are dpl@theabbey.co.uk.

What is personal data?

Personal data is information about you from which you can be identified (either directly or indirectly). This includes your contact details, your relationship with the School and financial information.

What personal data does the School hold about you and how is this obtained?

We receive information about you from other teams within the School but only where this is relevant to our work. When you leave the school we obtain information which includes your name, address, telephone number, email address, your interests, and the dates when you attended the School. We hold a separate specific database with information about alumnae, parents, staff, former parents, former staff and other supporters. You provide us with information about yourself during the course of our relationship with you. For example, when you sign up to receive communications from us or order tickets for events. In addition, we will obtain your personal data from other sources, such as friends and family which we use for the purposes described below. We will hold information such as:

▪ your name, gender, and date of birth;

▪ information about your family, for example, whether you have any sisters who attended the School;

▪ any connection you may have with other members of the School community such as other alumnae;

▪ the dates when you or your child attended the School (if applicable); if you are a former staff member the dates when you worked at the School;

▪ your contact details;

▪ Geo-location data (your geographical location based on your IP address)

▪ Log-ins and activity on the “AbbeyConnect” platform

▪ A record of payments made via the website (we do not store your credit/ debit card details)

▪ Consent options and communication preferences

▪ Content that you post on the “AbbeyConnect” platform such as announcements, stories, photos, documents, comments, events, jobs) or provide to us by other means;

▪ information about your achievements and interests e.g. which sports team you were part of as a pupil or any hobbies that you have now;

▪ where you attended university and your occupation (if applicable);

▪ how you like to hear from us e.g. whether you have signed up to receive emails from us;

▪ your involvement with us. This includes correspondence with you, your attendance at our events, and whether you carry out mentoring of current pupils;

▪ records of any donations and your Gift Aid status if applicable;

▪ information from articles in the media;

▪ medical information or information about a disability you have, e.g. to make adjustments for you or to help you if you are hurt whilst taking part in an activity;

▪ any dietary requirements for catering purposes; and

▪ any disability which you may have so that we may make reasonable adjustments for you.

Why do we use your personal data?

We use your personal data in the following ways:

▪ to keep you informed about events and activities and in relation to your attendance at those events (for example, so that we can accommodate you if you tell us about any special needs or dietary requirements);

▪ to facilitate interaction between members of the School community for example, we provide an online portal to allow alumnae to communicate. This can be found here: https://connect.theabbey.co.uk.

▪ to tell you about merchandise sold to benefit the School;

▪ to keep you informed about what is happening at the School, for example, by sending you a copy of the School’s newsletter / the ‘Magnolia’ magazine / details of events;

▪ campaigns to promote the development of the school including opportunities to support the school financially (including making donations to transformational bursaries and specific campaigns for facilities or events);

▪ in connection with the other ways in which you might support the School (such as when you volunteer);

▪ in connection with any research we carry out. For example, we may ask you to complete a survey, provide feedback or join one of our focus groups.

▪ We may contact you for the above purposes by email, telephone, social media, post or by text message but we will only do this where we are allowed to do so under data protection law (for example, we will usually need your consent before sending you an email about a fundraising opportunity). If you tell us that you do not want to be contacted for any of these purposes then we will of course respect that.

▪ If you wish to make a donation, particularly a donation of a substantial value, we may need to verify your identity and / or carry out financial due diligence on you. This may involve taking and retaining copies of your identification documents and obtaining your personal data from the following sources: internet search engines, 192.com, the Charity Commission, Zoopla, Business Week and related media articles. This is to comply with our legal obligations.

▪ We may take photos or videos of you to use in our publicity or on our social media platforms and website. If we consider that the photo or video is more privacy intrusive then we will speak to you about it first.

▪ We may use your personal data to build up a picture of your willingness to give and your net worth so that we can tailor our fundraising communications to you. As part of this we may use your personal data to inform how much you may be willing and able to give. We will use the following information for this purpose: your postal address and history of giving. We will also obtain information from sources outside of the School. These sources include LinkedIn, Bloomberg, The Times Rich-Lists, Facebook, Instagram, Twitter and media articles. We will only seek information that is publicly available and will date stamp and notate the source as and when we undertake any searches.

How and why does the School share your personal data with third parties?

▪ If you use a third party platform to donate then we will receive information about you from them.

▪ If you attend one of our events, then we will share your personal data with event booking platforms such as Eventbrite.

▪ In accordance with our legal obligations, we will share information with local authorities, the Independent Schools Inspectorate / Ofsted and the Department for Education, for example, where we have any safeguarding concerns.

▪ On occasion, we may need to share information with the police for the prevention and investigation of crime and the prosecution of offenders.

▪ We may also need to share information with our professional advisors. For example, we may share your personal data with our legal advisers for the purpose of obtaining legal advice.

▪ We will need to share information if there is an emergency, for example, if you are hurt whilst on School premises or at one of our events.

▪ We will share information with HMRC in connection with Gift Aid claims. 5

▪ We use contractors to help us with our work (e.g. a printing company for our literature) or where we store our database in the cloud.

▪ We may use third party data cleansing or validation services. Examples of companies that provide these types of services are buffalofc.co.uk and data-8.co.uk. These services check the personal data we hold against various third-party databases such as the Royal Mail PAF (Postcode Address File) to verify the details we have on file are accurate and up-to-date.

Our lawful bases for using your information

This section contains information about the lawful basis that we are relying on when handling your information. Legitimate interests This means that we are using your personal data when this is necessary for our legitimate interests, except when your interests and fundamental rights override our legitimate interests. We rely on legitimate interests to use your personal data for all of the purposes described except where we have asked you for your consent (in which case consent applies as the lawful basis). Specifically, we have a legitimate interest in:

▪ ensuring that there is an active community of supporters which will benefit the School and members of the School community, such as current and former students and parents;

▪ promoting the objects and interests of the School. This includes fundraising e.g. if we wish to raise money for the bursary fund or new buildings;

▪ using your personal data to administer our events;

▪ safeguarding and promoting the welfare of our current and former students with whom you may be in contact e.g. if you arrange work experience or mentor a student; and

▪ ensuring that we comply with our legal obligations. ▪ If you object to us using your personal data where we are relying on our legitimate interests as explained above please speak to the Data Protection Lead via dpl@theabbey.co.uk.

Public task

We rely on this basis (as well as legitimate interests) where we use personal data in order to look after those we are responsible for. For example, if we needed to carry out checks on someone before allowing them to mentor our students.

Consent

In some cases, we are processing your personal data because you have given us your consent to do so. If we ask for your consent to use your personal data you can take back this consent at any time. Any use of your personal data before you withdraw your consent remains valid. If you wish to discuss your consent preferences or withdraw consent, please contact the Data Protection Lead via email on dpl@theabbey.co.uk or by telephone on 01189 8932256

Updating your consent preferences on “AbbeyConnect”

If you have an online profile on the “AbbeyConnect” platform you can update your consent options by logging-in and clicking on “My Settings” in your profile. Scroll down to find your ‘Consent options’ where you will see a list of consents and the options “opt-in”, “opt-out” and “unspecified”. Via ‘My Settings’ you can also choose to hide your profile from Google, limit access to your profile so that it’s only viewable to your connections and adjust some of the automatic notifications that you receive from this website. Please note that your name (but not full profile) may appear in various places around the community website, such as a ‘Recent Joiners’ box and in ‘Search’ results irrespective of the privacy settings you have selected. If you click ‘unsubscribe’ at the bottom of one of our emails sent you will be automatically opted-out of these types of email communications in the future.

Necessary for a contract

We will need to use your personal data in order to perform our obligations under a contract with you, for example, if we need your name and contact details so that we can send you tickets for a concert that you have purchased tickets for.

Legal obligation

On some occasions we will need your personal data to comply with a legal obligation. For example, we may need to keep a record of who is attending an event so that we can comply with our health and safety obligations.

Vital interests

For example, to prevent someone from being seriously harmed or killed.

Sending your personal data to other countries

When the School sends personal data outside of the UK, we have to consider if the other country has the same level of protection for personal data as there is in the UK. Some countries are considered by the UK Government to have adequate rules and this includes all of the European Union and some other countries, such as, New Zealand, Norway, Switzerland and Argentina. Our alumnae reach is global and therefore in certain limited circumstances, we may send information about you to recipients in countries which do not have the same level of protection for personal data as there is in the UK. For example, we may send the Magnolia magazine containing an article about you to alumnae overseas. In certain circumstances, we may send your personal data to countries which do not have the same level of protection for personal data as there is in the UK. For example, we may store your personal data in cloud computer storage with servers in the USA. We will provide you with additional details about where we are sending your personal data, whether the country has an adequacy finding and if not the safeguards which we have in place outside of this privacy notice. If you have any questions about the safeguards that are in place please contact the Data Protection Lead via dpl@theabbey.co.uk.

For how long do we keep your information?

We have an ongoing relationship with you and we would like you to be involved with the School for many years to come. For this reason, the Engagement and Development Office keeps the majority of the personal data it holds about you indefinitely. For example, we keep your contact details so that we can continue to stay in touch with you. Similarly, we will retain information 7 about your involvement with the School as this helps us tailor our communications to you both now and in future. We will also need to keep a record if you tell us that you do not want to hear from us anymore, so that we do not inadvertently add you to our mailing list in the future. We also keep some information indefinitely for archiving purposes (this is known as "archiving in the public interest" under data protection law) and for historical research purposes. This includes the School's legitimate interests in research; supporting long-term accountability; enabling the discovery and availability of the School's and the wider school community's identity, memory, culture and history; enabling the establishment and maintenance of rights and obligations and of precedent decisions; educational purposes; and commercial and noncommercial re-use. For example, we keep some old photos so that we have a record of what the School was like in the past. Information held in our archive may be made publicly available but this would only be done in compliance with data protection laws. The School will also keep information for a long time as part of its wider legal and regulatory obligations, even if that information is no longer needed for marketing, development or fundraising purposes. This is especially relevant to former staff, pupils and parents. For more information on how personal data is used by the School more widely please contact the Data Protection Lead via dpl@theabbey.co.uk Although the Engagement and Development Office keeps the majority of your personal data for a very long time, there are some exceptions to this. Further information can be found in our Information and Records Retention Policy which can be found under the policies section of the website. https://theabbey.co.uk/policies

What decisions can you make about your information?

Data protection law gives you a number of rights regarding your information. Your rights are as follows:

▪ Correction: if information held about you by the School is incorrect or incomplete you can ask us to correct it.

▪ Access: you can also ask what information we hold about you and be provided with a copy. We will also give you extra information, such as why we use this information about you, where it came from and who we have sent it to.

▪ Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.

▪ Portability: you can request the transfer of your personal data to you or to a third party in a format that can be read by computer in certain circumstances.

▪ Restriction: you can request that we restrict how we use your personal data.

▪ Object: you may object to us using your personal data where:

- we are using it for direct marketing purposes (e.g. to send you an email about a fundraising opportunity)

- the lawful bases on which we are relying is legitimate interests or public task. Please see the section "Our lawful bases for using your information" above;

- if we ever use your personal data for scientific or historical research purposes or statistical purposes.

The Data Protection Lead can give you more information about your data protection rights. To exercise any of your rights you can speak to the Data Protection Lead via email on dpl@theabbey.co.uk.

Further information and guidance

The Data Protection Lead is the person responsible at our school for managing how we look after personal data and deciding how it is shared in relation to fundraising and development. The Data Protection Lead can answer any questions which you may have. Like other organisations we need to keep your personal data safe, up to date, only use it for what we said we would, destroy it when we no longer need it and most importantly - treat the information we get fairly. If you fail to provide certain information when requested, we may not be able to provide the information or service you have requested. We may also be prevented from complying with our legal obligations. You have a right to lodge a complaint with the Information Commissioner's Office - ico.org.uk.

If you do have any concerns about how we have handled your personal data we would kindly ask that you contact us in the first instance before you speak to the ICO so that we have an opportunity to put things right.

The privacy policy according to which The Abbey operates may be viewed here. This is regulary reviewed and updated if necessary.