The School’s Privacy Notice is available for download in full here.

Guidance on your individual rights is available for download here.

WHO WE ARE AND WHAT THIS NOTICE COVERS

Founded in 1480, Magdalen College School is a selective day school for pupils aged 7-18. Shaped by its Christian Collegiate foundation and links with the university city of which it is part, it aims to inspire in all its pupils a desire to learn, flourish and serve both now, in their time at school, and in the future.

For the purposes of relevant legislation, the school is the data controller for all areas of activity covered in this notice.

This notice has regard to data protection legislation from May 25 2018. It covers the UK General Data Protection Regulation (UK GDPR), tailored by the Data Protection Act 2018. Guidance on UK GDPR from the Information Commissioner’s Office can be found here.

WHAT THIS PRIVACY NOTICE IS FOR

This policy is intended to provide information about how the school will use (or “process”) personal data about individuals including: its staff; its current, past and prospective pupils; and their parents, carers or guardians (referred to in this policy as “parents”). It is structured accordingly.

This information is provided because data protection law gives individuals rights to understand how and why their data is used and for how long it is kept. Staff, parents and pupils are all encouraged to read this Privacy Notice and understand the school’s obligations to its entire community.

This Privacy Notice applies alongside any other information the school may provide about a particular use of personal data, for example when collecting data via an online or paper form.

Anyone who works for, or acts on behalf of, the school (including staff, volunteers, governors and service providers) should also be aware of this Privacy Notice, which also provides further information about how personal data about those individuals may be used.

 

Current pupils and parents
Prospective pupils
Staff
Old Waynfletes, current and former parents, supporters
Oxford Festival of the Arts
Website visitors

 

 

INTERNATIONAL TRANSFERS OF PERSONAL DATA

Data may be stored or processed outside the UK on third party systems or MCS cloud-based systems, or if we communicate with you when you are overseas, or if MCS is undertaking activities outside the UK. In relation to school trips some data may be stored overseas but this is destroyed once the trip is completed.

If electronic data is transferred outside the UK it may be stored or processed in the USA or European Union in compliance with current ICO guidance following the Schrems II judgement. The standard contractual clauses governing such data transfers will be considered, effective and relevant to the data processing involved. Due diligence will be performed on those bodies chosen for non-UK data processing to ensure adequacy and essential equivalency with UK data protection laws. If you require further information in respect of the protective measures undertaken, please contact the Data Protection Lead (the Compliance Officer).

HOW LONG WE KEEP PERSONAL DATA

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. A reasonable amount of information will be kept for archiving purposes, including in some cases as part of the public catalogue (which may include photographs and historical documents). Where you have requested we no longer keep in touch with you, we will need to keep a record of that fact in order to fulfil your wishes (called a “suppression record”).

Incident reports and safeguarding files will need to be kept for much longer, in accordance with specific legal requirements.

If you have any specific queries about how our retention policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact the School’s data protection lead on data@mcsoxford.org. Staff members may consult the School’s Retention Policy on the School’s intranet for more detailed information.

YOUR RIGHTS

You have the following rights:

  • To obtain access to, and copies of, the personal data that we hold about you;
  • to require us to correct the personal data we hold about you if it is incorrect;
  • to require us (in certain circumstances) to erase your personal data;
  • to request that we restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
  • to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller;
  • to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. The school will endeavour to respond to any such requests as soon as is reasonably practicable and in any event within statutory time-limits (which is generally one month, but actually fulfilling more complex or multiple requests, e.g. those involving third party information, may take 1-2 months longer).

DATA ACCURACY AND SECURITY

The school will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible.  Individuals must please notify the Usher’s Office, the Director of HR or the Waynflete Office of any significant changes to important information, such as contact details, held about them.

The school will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to school systems. All staff and governors will be made aware of these policies and their duties under data protection law and receive relevant training.

THIS POLICY

The school will update this Privacy Notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.

QUERIES AND COMPLAINTS

Any comments or queries on this policy should be directed to data@mcsoxford.org.

Formal written requests referred to in this policy should be addressed to

The Compliance Officer
Magdalen College School
Oxford
OX4 1DZ

If an individual believes that the school has not complied with this policy or acted otherwise than in accordance with data protection law, they should utilise the school complaints procedure and should also notify the Compliance Officer. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with the school before involving the regulator.