What personal data we collect and why we collect it

Data Protection Policy and PRIVACY NOTICE

Updated 31/01/2024

WHO WE ARE

We are the Alliance française d'Oxford, the charity whose mission is to promote French language and culture in Oxford situated at

30 Polstead Rd,

1st Floor, Oxford, OX2 6TN

www.af-oxford.org

Charity Registration No. 1163206

WHAT THIS PRIVACY NOTICE IS FOR

This Privacy Notice is intended to cover activities of the Alliance française d'Oxford during French teaching activities and our various events/cultural programme.

This policy is intended to provide information about how we will use (or "process") personal data about individuals including: staff and teachers; current, past and prospective students and their parents, carers or guardians (referred to in this policy as "parents"); and the wider public subscribing to our mailing list to stay in touch with our cultural programme which is open to all.

This information is provided because data protection law gives individuals rights to understand how their data is used. Staff, teachers, parents and students are all encouraged to read this Privacy Notice and understand the Association’s obligations to its community.

The UK’s Data Protection Act 2018 (DPA) and General Data Protection Regulation (GDPR) (EU) 2016/679 describe how organisations, including ours, must collect, handle and store personal information.

We are registered with Information Commissioner's Office (ICO) to meet our responsibilities under the Data Protection Act

This Privacy Notice applies alongside any other information the Alliance française d’Oxford may provide about a particular use of specific categories of personal data, for example when collecting data via an online or paper form.

This Privacy Notice also applies in addition to the Alliance française d’Oxford’s other relevant terms and conditions and policies, including:

                 Our Child protection Policy and Procedure including online code of conduct

                 Internal rules handbook

                 Complaints Policy & Procedure

 

The information in this document applies regardless of whether the personal data is stored electronically, on paper or on other materials.

This Policy will be regularly reviewed and updated as necessary.

RESPONSIBILITY FOR DATA PROTECTION 

The Alliance française d’Oxford has appointed the manager as the responsible person for Data Protection and is the point of contact for all your requests and enquiries concerning Data Protection.

The Alliance française d’Oxford uses of your personal data (see section on Your Rights below) and endeavours to ensure that all personal data is processed in compliance with this policy and data protection law.

The manager can be contacted via email at director@af-oxford.org

Anyone who works for, or acts on behalf of, the Alliance française d’Oxford (including staff, volunteers, trustees and service providers) must also be aware of and is required to comply with this Privacy Notice. 

WHY THE ALLIANCE FRANCAISE D’OXFORD NEEDS TO PROCESS PERSONAL DATA

In order to carry out our ordinary activities, we need to process a wide range of personal data about individuals (including current, past and prospective staff, students or parents of students) as part of our daily operation.

TYPES OF PERSONAL DATA PROCESSED BY THE ALLIANCE FRANCAISE D’OXFORD

•       To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.
•       There are various legal grounds on which we are permitted to process personal data:
•       Processing necessary to enter into a contract with you, or for the performance of the contract
•       Processing necessary to comply with our legal obligations
•       Processing necessary for our (or a third party’s) legitimate interests, such as managing and administering our activities effectively
•       Where you have given specific consent to processing your data – in which case we will ask specifically if you consent to the particular processing.
•       The types of personal data we process, what we use the data for, and our legal grounds for processing differ depending on our relationship with the individual in question.
•       For students and their parents/guardians – please see further detail in Appendix 1.
•       For staff, teachers and contractors – please see further detail in Appendix 2.
•       For mailing list subscribers and attendees at our events – please see further detail in Appendix 3.
•       For trustees – please see further details in Appendix 4.

HOW THE ALLIANCE FRANÇAISE D'OXFORD COLLECTS DATA

Generally, we receive personal data from the individual directly (including, in the case of students, from their parents). This may be via a webform, or simply in the ordinary course of interaction or communication (such as email or written assessments).

However, in some cases personal data will be supplied by third parties (for example another school, or other professionals or authorities working with that individual); or collected from publicly available sources.

WHO HAS ACCESS TO YOUR DATA

The only people able to access data covered by this Policy will be those who need it in order to administer the activities of the Alliance française d'Oxford.

We do not share personal data with third parties.

Data must not be shared informally. If access to confidential information is required, teachers can request it from the manager.  Personal data must not be disclosed to unauthorised people either within the Alliance française d'Oxford or externally. 

• Teachers are given email addresses of students and telephone numbers and medical conditions if provided to us by the students or parents of the students for normal communication of homework and progression.  Teachers are required to delete email addresses and other personal data as soon as their contractual arrangements with the Alliance française d'Oxford come to an end or they cease to teach the student(s) in question.

• The Manager as person responsible for data protection should be contacted by the teachers about any aspect of data protection.                   

Some of Alliance française d'Oxford processing activity is carried out on its behalf by third parties, such as IT systems, web developers or cloud storage providers (e.g. ONCORD, OneDrive, Intuit Quickbooks).  Where this involves a transfer of data outside the EEA, appropriate steps will be taken to safeguard the data (eg for data processing by external providers in the USA, Alliance française d'Oxford has verified that those providers have signed up to the Privacy Shield.)  Please refer to the privacy notices of the providers referred to above for further details.

Personal data collected by us will remain within the Alliance française d'Oxford, and will be processed by appropriate individuals only in accordance with access protocols (i.e. on a ‘need to know’ basis). Particularly strict rules of access apply in the context of medical records and any safeguarding files.

The Alliance française d'Oxford is under duties imposed by law and statutory guidance (including Keeping Children Safe in Education) to record or report incidents and concerns that arise or are reported to it, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness in their nature or regularity. This is likely to include file notes on personnel or safeguarding files, and in some cases referrals to relevant authorities such as the police.

HOW LONG DO WE KEEP YOUR DATA?

We will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason. Typically, we will keep ordinary staff and student records for up to 7 years following departure from the Alliance française d'Oxford. However, incident reports and safeguarding files will need to be kept much longer, in accordance with specific legal requirements. 

If you have any specific queries about how our retention policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact the Manager, who is the appointed person responsible for overseeing data protection at the school. However, please bear in mind that the we may have lawful and necessary reasons to retain some personal data even following such a request.

WHAT ARE YOUR RIGHTS?

We recognise all the rights individuals have under the GDPR regarding their personal data held by us, including:

•       be informed about how we use your personal data;
•       request access to the personal data that we hold about you;
•       request that your personal data is amended if it is inaccurate or incomplete;
•       request that your personal data is erased where there is no compelling reason for its continued processing;
•       request that the processing of your data is restricted;
•       object to your personal data being processed; and
•       where we rely on consent as a means to process personal data such as certain types of uses of images, withdraw this consent at any time.
•       any requests or objections should be made to the Manager in writing.

HOW DO WE KEEP YOUR DATA SECURE?

The Alliance française d'Oxford will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies relating to use of technology and devices, and access to our  systems. All staff will be made aware of this Notice and their duties under prevailing data protection laws and receive relevant training.

If a security incident takes place which affects the confidentiality, integrity or availability of data, the Alliance française d'Oxford will investigate the matter and establish whether a data breach has occurred and, if so, promptly take steps to address it, including telling the Information Commissioner’s Office (ICO) if required.

 

HOW CAN YOU MAKE A COMMENT OR A COMPLAINT?

Any comments or queries on this Notice should be directed to the Manager: director@af-oxford.org.

If you are unhappy with the way in which your personal data has been processed, or if you believe that the Alliance française d'Oxford has not complied with this Notice or acted otherwise than in accordance with data protection laws, you may, in the first instance, contact the Manager and or follow the Alliance française d'Oxford’s complaints procedure.

If you remain dissatisfied, you can apply to the Information Commissioner for a decision. You also have the right to directly make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO) at any stage but please be aware that the ICO recommends that steps are taken to resolve the matter with the school before involving the regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office,

Wycliffe House,

Water Lane,

Wilmslow,

Cheshire,

SK9 5AF

For full Privacy Policy, please contact trustees@af-oxford.org