Alumni & Supporter Privacy Notice

Introduction

King Edward VI School (“the School”) understands that you care about the privacy and security of your personal information and the School takes that seriously.

The School undertakes fundraising and alumni relations activity via its Development Office. The overarching purpose of these activities is to develop a mutually beneficial relationship between the School and you, our alumni, friends and supporters.

This Privacy Notice sets out how the School processes personal data specifically for those fundraising and alumni relations purposes for the ultimate objective of supporting our pupils through bursaries and careers work.

Who and What is this Privacy Notice for?

Alumni: As a pupil or former pupil, when you leave us, you are automatically welcomed into our Alumni community.

Supporters: You will be regarded as one of our “Supporters” if you are not a former pupil but have made a donation to us, volunteered or fundraised on our behalf, advocated for our work or otherwise provided support for our aims. Supporters can, on occasion include current and former parents and carers of pupils, Governors, current and former staff, and Fellows of the School.

When you become a member of our Alumni or Supporter communities, we will collect, use and sometimes share, personal information relating to you. Our aim is to handle your personal information openly and transparently.

The purpose of this Privacy Notice is to explain who we are, what personal information we collect, why and how it is used. It explains our legal basis for handling your personal information and your legal rights and choices over the way it is used.

This Privacy Notice applies in addition to any other Privacy Notice that we may provide on certain occasions and, where relevant, any contract between us and any relevant data protection policy.

This Privacy Notice only applies to the processing of personal data of our Alumni and Supporters for the purposes of fundraising and alumni activity and similar processing. It does not cover the processing of personal information of pupils and their parents or carers that is processed by the School for its main functions, such as providing an education and fulfilling its obligations under the Parent Contract etc. The School’s main Privacy Notice for Pupils, Parents and Carers can be accessed via this link.

Who are we?

For the purposes of the UK General Data Protection Regulation (“the UK GDPR”), Data Protection Act 2019 (“DPA 2018”) and any subsequent UK legislation covering data protection, the School is the Controller of your personal information or “personal data”. This means that the School is legally responsible for deciding how and why personal information relating to you is used.

The School is registered with the Information Commissioner’s Office (“ICO”) as the Controller under registration number Z9114564.

Contact us

If you have any questions about this Privacy Notice or the use of your personal data by the School, please contact the School’s Data Protection Lead using the following contact details: dataprotection@kes.school

Understanding the types of Personal Data we collect and use about you

The type of personal data we collect, and process will depend on our relationship and the purpose for which it will be used.

“Personal Data” means any information which can be used to directly or indirectly identify a living individual.

By way of example, we may collect the following types of personal data:

Alumni – Types of Personal Data Held

On leaving the School, we will transfer the following basic pupil information into our dedicated Alumni and Supporter Management Information System.

Identity Data such as name, date of birth, gender, pupil roll number, nationality.
Basic Pupil Information such as House, roles and responsibilities you held, details of any prizes, scholarships or bursaries you received.
Relatives such as Personal Data relating to your parents or carers and any siblings.

In addition, and subject to your consent or the School having complied with an alternative lawful basis under UK GDPR, we may collect and process the following personal data:

Contact Details such as address, email address, telephone numbers, mobile number.
Employment/career Data: e.g. information about your occupation, roles, employers and work address.
Biographical and Social Information such as your interests, social circumstances, marital status and hobbies.
Financial Information, for example if you made a donation, we may process your bank details, payment card data etc. Gift Aid Declarations (if relevant), Gift Agreements for larger donations.
Philanthropic and Legacy Information, for example, history of donations made to the School (including both financial and of your time), your philanthropic interests, any legacy intentions and assessment of your financial capacity to donate to the School.
Images such as photographs and video recordings taken at events or in publications or from professional networking platforms such as LinkedIn.
Correspondence such as notes of phone calls or meetings, emails and letters between you and the School’s Development Office.
Engagement information such as a record of your attendance at Alumni events, volunteering or fundraising on behalf of the School.
Names of Family/Partner/Spouse.
Relationships with other Alumni or other associated constituents.
Technical information such as your computer’s IP address, MAC address and device information may be collected when you use our communication systems or Alumni Portal. For example, when you use the Alumni Hub.

Supporters – Types of Personal Data Held

If you are a Supporter of our School (but not part of our Alumni community), for example, if you have made a donation or volunteered on our behalf, we may collect and process the following types of Personal Data relating to you:

Identity Data such as name, date of birth, gender, nationality.
Contact Details such as postal and email address, telephone and mobile number.
Employment/career Data such as information about your occupation, roles, employers and work address.
Biographical and Social Information such as your interests, social circumstances and hobbies.
Financial Information, for example if you made a donation, we may process your bank details, payment card data etc. Gift Aid Declarations (if relevant), Gift Agreements for larger donations.
Philanthropic and Legacy Information, for example, history of donations made to the School (including both financial and of your time), your philanthropic interests, any legacy intentions and assessment of your financial capacity to donate to the School.
Images such as photographs and video recordings taken at events or in publications or from professional networking platforms such as LinkedIn.
Correspondence such as notes of phone calls or meetings, emails and letters between you and the School’s Development Office.
Engagement information such as a record of your attendance at School events, volunteering or fundraising on behalf of the School.
Names of Family/Partner/Spouse.
Relationships with School Alumni or other associated constituents.

Parents – Types of personal Data Held

If you are a parent of a current or former pupil, the School holds a limited amount of data in its Alumni and Supporter Management Information System for rare occasions where we deem it necessary to contact you:

Identity Data such as name.
Contact Details such as an email address.
Relationships with others, primarily your child(ren) who are attending or attended the School.

There may be rare occasions where we may contact parents or former parents about opportunities to support the School, or to meaningfully engage with the School’s fundraising and careers work. If a Parent becomes a Supporter, for example by making a donation or helping with careers talks to existing pupils, then subject to our relationship we may also hold and process the types of Personal Data identified above relating to Supporters.

Special Categories of Personal Data

When carrying out fundraising and alumni activities, the School does not expect to routinely collect or process any special categories of personal data*. However, on occasion, we may collect and process the following special categories of personal data where data protection law permits:

*Special Category Personal Data relates to information about racial or ethnic origin, trade union membership, health and medical conditions, genetics, biometric information (but only where this is used for identification purposes), political opinions, sex life, sexual orientation and religious beliefs.

Information about your racial or ethnic origin, religious or philosophical beliefs, and political opinions;

The School does not aim to collect and process these special categories of personal data. However, they may be indirectly processed from other information we hold about you such as your occupation, memberships, your interests and your donations to other causes.

Information relating to physical or mental health or condition;

We may collect and process information about your health or medical conditions, if you provide it to us. For example, if you book onto one of our events, you may tell us about a disability you have in order for us to make reasonable adjustments to seating arrangements or visual displays. Or you may tell us about dietary requirements from which a medical condition can be inferred, e.g. Gluten allergy/Coeliac.

Criminal Offence Data

We may also collect and process information about criminal convictions and offences (including allegations) (Criminal Offence Data) but only if the law allows us to do this. For example, if you volunteer for us, because we are a school and you may come into contact with children, the law may require us to carry out background checks with the Disclosure and Barring Service (“DBS”).

If you donate, we may access and process Criminal Offence Data such as money laundering or bribery offences when carrying out due diligence on our donors or prospective donors which we are required to do.

The source of your personal data

The personal data we collect, and process is primarily collected directly from you. For example:

If you studied here, the Development Office will process the contact and education details collected by the School during your time as a pupil, and when you leave us, via the Year 11 and 13 Leavers Forms.
If you support us, such as volunteering or making a donation.
When you interact with us, for example, when you use our online Alumni Hub and create an online profile or when you communicate with us in writing, via email or over the telephone.
If you subscribe to our Alumni magazine or register for one of our Alumni or Fundraising events.

We may also collect and process your personal data when you give it to us indirectly, for example:

If you are fundraising on behalf of the School, your personal data may be shared with us by other organisations such as fundraising platforms like Just Giving or Virgin Money. However, we will only collect your data in this way if their own Privacy Policy permits it, which you should check when you give them your details.

We may collect and process your personal data from third parties, such as those listed below. To understand why we do this and how it helps our fundraising and build stronger connections with our Alumni and Supporters, see “What is the Purpose of Processing your Personal Data?” below:

Third party publicly available sources including professional social networking platforms like LinkedIn.
Third party fundraising and data agencies who undertake research and collect personal data on our behalf, all of which is collected from publicly available sources.
If you are actively considering making a gift to the School we carry out due diligence to understand more about the source of the gift and you as our donor. Due diligence checks may involve us collecting and processing your personal data from sources such as Thomson Reuters World-Check.

What is the Purpose of Processing your Personal Data?

Your Personal Data is only collected and processed for specified purposes and its use is strictly within the terms of this Privacy Notice and data protection law.

The primary purpose of processing your Personal Data is to undertake successful fundraising and alumni relations activities. Such activities benefit both the School’s existing community of pupils, for example through the provisions of bursaries and careers talks, and the wider community of Alumni and Supporters by maintaining and creating connections which would otherwise be lost.

More specifically, the purposes for which your personal data may be processed include the following:

To keep in touch with Alumni and Supporters: For example:

Helping keep you up to date with School news by sending you updates for example via the Alumni Hub, Alumni Magazine and depending on your preferences, other communications.
Inviting you to events specifically tailored for your interests such as Alumni events, reunions and donor gatherings.

Fundraising and to generate philanthropic support for School charitable projects such as bursaries (which may include both monetary donations and volunteering your time.) For example:

Letting you know about opportunities to engage with and give back to the School through volunteering and donating.
Subject to your consent where required, sending you information which amounts to direct marketing including via electronic means such as via email and telephone.
Asking you if you would like to support the School, for example by making a donation, volunteering your time or taking part in a survey.
Wealth Screening: We may occasionally undertake research about some Alumni and some Supporters and their capacity to provide financial support to the School (sometimes called “wealth screening”). This exercise helps ensure that our fundraising efforts are conducted as efficiently as possible and enables us to focus our conversations and requests for support with those best able to support the School. We only use reputable third party partners for wealth screening who source personal data exclusively from information in the public domain (such as Companies House, FTSE100 directorships, Forbes, company websites, ‘rich lists’, social networks such as LinkedIn, political and property registers and news archives.) The output from the research is used, sometimes together with other information we hold, such as a record of previous engagement with the School, previous donations etc. to identify if that person may be interested in supporting the School. Wealth screening helps us identify and contact only those individuals whose interests we believe align with our charitable fundraising mission and may have the capacity to help. This activity is carried out strictly in compliance with UK GDPR and you have the right to object to us processing your information in this way. Should you wish to exercise that right please notify our Data Protection Lead: dataprotection@kes.school

To carry out necessary research for our due diligence: For example, where you are considering making a donation to the School, in order to comply with Money Laundering Regulations and where we are required or empowered to by statute or guidance to do so, we process your personal data as part of our due diligence research.

Administration and record keeping. For example, processing your donation or administering an event you are attending or responding to your correspondence.

Network Security: For the purposes of ensuring the security of our information and network, and related services offered, including preventing unauthorised access to electronic communications networks and malicious code distribution and stopping “denial of service” attacks and damage to our computer and electronic communication systems.

To publish photographs and video of you from our events and activities, for example an Alumni reunion, on our website, in our publications and on our social networking platforms. We will tell you this is happening at the time or as soon as possible afterwards. You have the legal right to object to your image being published in this way. If you have any questions or concerns or wish to object, please contact our Data Protection Lead: dataprotection@kes.school

What is our legal basis for processing your Personal Data?

The School will only process your personal data for the purposes identified above where data protection law permits or requires it. When processing your personal data for the various Alumni and Supporter activities, we rely on the corresponding data protection legal reasons (legal bases) identified in the table below.

Where we rely on your consent, you can withdraw that consent at any time. Where we rely on the legal basis of “legitimate interests”, the School has made it simple for you to quickly and easily amend your communication preferences and you can object to your information being used in this way. For example, you have the right to tell us to stop sending you direct marketing emails.

Type of activity	Whose Personal Data?	Legal basis under UK GDPR	Details
Keeping you in touch with the School as a former pupil – electronically or via post - through our Edwardian magazine, event invites, and volunteering opportunities.	Alumni	Legitimate interest	The processing is necessary for the School’s legitimate interests in maintaining a lifelong relationship with our former pupils. We notify all pupils when they leave that the School plan to stay in touch in these ways.
Requests to meet in person to understand how alumni would like to engage with our School, which may include discussions about whether you would like to opt in to hear more about fundraising.	Alumni Supporters (including prospective Supporters)	Legitimate interest	The processing is necessary for the School’s legitimate interests in maintaining a lifelong relationship with our former pupils. We notify all pupils when they leave that the School plan to stay in touch in these ways.
Fundraising, development and direct marketing carried out by post.	Alumni Supporters (including prospective Supporters)	Legitimate interest	The processing is necessary for the School’s legitimate interests in fundraising for bursaries, which is for the overall benefit of current and future pupils.
Fundraising, development and direct marketing carried out by email and telephone (This activity may be regulated by both UK GDPR and the Privacy and Electronic Communications Regulations 2003 (“PECR”)).	Alumni	Consent	We will obtain consent at Years 11 and 13, via the KES Alumni Hub, or through 1:1 correspondence for this activity.
Alumni Hub: Personal Data that Alumni choose to upload to the Alumni Hub	Alumni	Legitimate interest	When you sign up for the KES Alumni Hub, you are notified that we will process any data you provide in line with this Privacy Notice.
Publishing names of Alumni, donors, Supporters internally, e.g. on Honours Boards, memorial plaques.	Alumni Supporters	Consent	We will ask your consent to publish your name, and you can choose to remain anonymous if you prefer, or not be included at all.
Images (digital and manual format) and video recordings	Alumni Supporters (including prospective Supporters) Parents (including current and former Parents	Legitimate Interest	It is necessary for the School’s legitimate interest to record, mark and publish events including with images so as to further develop relationships with Alumni and Supporters, broaden interest in our activities and record events and certain individuals in pictures. We will always endeavour to give individuals an opportunity not to take part in photos at the time they are taken.
Network Security: E.g. when you are using the Alumni Hub, baseline data may be captured.	Alumni	Legitimate Interest	The processing is necessary for the School’s legitimate interests in ensuring the security of our information and network, and related services offered.
Wealth Screening	Alumni Supporters (including prospective Supporters)	Legitimate Interest	The processing is necessary for the School’s legitimate interests in making its fundraising activity more efficient; it helps us identify and speak to only those individuals whose interests align with our charitable fundraising mission and also may have the financial capacity to help the School.
Processing of Special Category Personal Data for events, such as health information including any medical conditions. e.g. dietary requirements or disability access arrangements	Alumni Supporters	Legal Obligation & Legitimate Interest	When you sign up for an event we may need to ask about access and dietary requirements. We use this information to make reasonable adjustments to the service we are offering you such as seating or access to an event. We store this data for the purpose of event administration and to provide you with the best experience.
Due Diligence research in respect of financial donations	Donors (including prospective donors)	Legal Obligation & Legitimate Interest	The School is subject to a legal requirement to ‘know our donor.’ It also has a legitimate interest in protecting its reputation from damage. Before we are able to receive donations, we will gather “light touch” personal information on the prospective donor. When we receive a gift, donors are informed of the due diligence details via a gift form or gift agreement, depending on the level of donation.
Details of a donation	Donors	Legal Obligation	The School is subject to a legal obligation to process and retain certain aspects of a financial donation. E.g. Gift aid and HMRC requirements.
Criminal offence data	Alumni Donors Supporters	Legal obligation	The School is subject to a legal obligation to perform due diligence in certain circumstances, for example, in relation to its donors, and such checks may (rarely) include criminal offence data.

Cookies

In addition to the personal information described above, we also collect certain information about your use of our online services such as our website and Alumni Hub. For example, we, or our partner, Toucan Tech, if you are visiting the Alumni Hub, may collect information about your IP address of the device you are using, the type of operating system and browser you use, and the parts of our online site or service that you access.

The School and some of its partners, including Toucan Tech, use cookies to collect and store this and other information about your visit to, or use of, our online services. We may later associate the usage and other information we collect online with personal information about you, as permitted or required by law.

If you are using the School website, then the School’s main Cookie Policy will apply. You can read the School website Cookie Policy here.

If you are using our Alumni Hub, there is a dedicated Cookie Policy on the Alumni Hub which explains which cookies are in use. You can read the Alumni Hub Cookie Policy here.

Consequences of your failure to provide us with your personal data

Some of the information we collect from you is required by law. If you fail to provide us with certain information when we request it from you, we may be prevented from complying with our legal or statutory obligations such as administering your donation, or other purposes of processing your personal and special categories of personal data as identified above.

Who might we share your personal data with?

We may share your personal data, including special categories of personal data, with those third parties listed below for the purposes set out above. We will only disclose your personal data to third parties where required or permitted by law. Where your information is disclosed, it is shared in a secure format and only the minimum information necessary is disclosed to meet the objectives of the exercise:

Third party service providers that provide a service to the School. Where this happens, your personal data is shared securely, in compliance with data protection law and where a GDPR-compliant data processing contractual arrangement has been entered into. Third party service providers may only process your personal data on our instructions and where they have contractually agreed to hold it confidentially and keep it secure. For example, Microsoft, (our internal systems provider), Stripe and GoCardless, (our Payment Providers), ToucanTech, (our Alumni and Supporter database provider), and Prospecting for Gold, (a reputable Wealth Screening organisation), mailing houses, printers, event organisers and due diligence service providers etc.
Third party professional advisors such as insurers, accountants, legal advisors and any organisation or individual appointed by the School to carry out an independent investigation.
External inspectors and auditors
Public authorities and regulators that may need to access your personal information in order to exercise their statutory functions. For example, we may need to share information with the Financial Conduct Authority, Information Commissioners Office, or and HMRC etc.
Third parties to whom we may sell, transfer or merge parts of the School or assets.

Transfers of your personal data outside the UK

Your personal data is primarily stored and processed here in the UK or in the E.U. For example, our Alumni and Supporter Management Information System, Toucan Tech, securely hosts your information on our behalf, on its systems in the E.U, which is regarded as having an equivalent level of protection for personal data as here in the UK. However, there may be occasion when we need to transfer your information outside the UK, or E.U, for example because a service provider we are using, is based there.

Where permitted by applicable law, we may transfer your personal data outside the UK, to the E.U, United States, and other countries.

Some of these destination countries may have different laws and data protection compliance requirements to the UK, with some providing more or less protection than others. The School will take appropriate steps to ensure your personal data is handled and protected as described in this Privacy Notice and UK data protection law.
Where appropriate or required, we will comply with applicable UK GDPR compliant data protection frameworks that relate to the transfer of personal data. For example, we may transfer personal data under UK data protection rules which are designed to protect personal data that is transferred to a country or organisation that is deemed to adequately protect personal information pursuant to determinations made by the UK Government or the U.S Federal Trade Commission (FTC).

Alternatively, we may transfer personal data by relying on appropriate safeguards such as standard data protection contractual clauses approved by the UK Secretary of State or the European Commission and other legally valid transfer mechanisms.

If you would like more information about the safeguards we rely on when we transfer your personal information outside the UK, please contact the Data Protection Lead: dataprotection@kes.school

How we store and protect data

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. The primary place we store your personal data is within a secure, purpose-built customer relationship database, provided by our trusted third party partner, ToucanTech. ToucanTech is trusted by hundreds of independent schools and other charitable organisations.

Keeping your personal data accurate and up to date

It is important that the information we hold relating to you, particularly your contact details (address, email address, postal address, phone numbers etc.), is accurate and up to date. Please keep us informed if your personal information changes during our relationship. For example, if your contact details need updating.

To update your personal details please contact edwardians@kes.school

How long we retain your Personal Data

The relationship between the School and its Alumni and Supporters is considered to be “life-long”, and so, unless you object, we retain some of your personal data indefinitely. Subject to that approach, when determining how long we must retain your personal data, we take into account factors such as any legal retention requirements, accounting or reporting rules and whether we need to retain your information because of an ongoing legal matter or complaint.

For supporters, where we have not had any contact with you for over five years, we will contact you to ask if you still wish us to consider you as a Supporter. If we do not hear from you, we will “cleanse” some of your personal data.

The School specifies its retention periods for your personal data in our Data Retention Policy and Schedule. Upon expiry of the applicable retention period, we will securely destroy your personal data in accordance with applicable laws and regulations.

Under some circumstances we may anonymise your personal data so that it can no longer be associated with you. We may use such anonymous data for our legitimate business purposes and at that point in time, data protection law ceases to apply to it. This means that we are able to use it without further notice to you or your consent.

If you want to learn more about our specific retention periods for your personal data established in our Data Retention Policy and Schedule, please contact the School’s Data Protection Lead: dataprotection@kes.school

Your legal rights in relation to your Personal Data

You have the following legal rights in relation to your personal data. Some of these rights do not apply in all circumstances. Also, the School may be able to refuse or partially refuse your request in some circumstances, for example, where a legal exemption applies.

If you would like to exercise one or more of your legal rights, or would like more information about them, please contact: dataprotection@kes.school

To be informed: You have the legal right to know what personal data we are processing about you, why and how. The information in this Privacy Notice is intended to facilitate that right.
Access to your personal data: You have the right to request a copy of the personal data we hold relating to you together with other information relating to how we use it. There are exemptions to this right which means that in some cases, you may not receive some or all of your personal data if an exemption is applied. For example, if providing you with your information would also reveal personal information relating to someone else. This right is sometimes referred to as the right of Subject Access.
Erasure: At your request, we will delete your personal information when it is no longer necessary for the purposes for which it was collected, or when, among other things, your personal data has been unlawfully processed, providing we do not have an overriding legitimate reason for retaining it.
Accuracy: Our objective is to ensure that your personal data is accurate, current, and complete. Please contact us to let us know if this is not the case. You have the legal right to ask us to rectify your personal data if it is inaccurate or incomplete.
Objecting: In certain circumstances, you have the right to object to processing of your personal data. For example, where we are processing your personal data on the legal basis of our legitimate interests, and we have no compelling reason that we can demonstrate which overrides the impact of the processing to your interests, rights and freedoms. You also have an absolute legal right to object to the processing of your personal data for purposes of direct marketing.
Automated Decision Making: You have the right to object to decisions that we may make based solely on the basis of automated processing (including profiling) of your personal information where those decisions have a significant legal effect on you or similar effect. NB. The School confirms that you will not be subject to decisions based solely on automated processing (Automated Decision Making) including profiling, where those decisions have legal or significant effects on you. If this position changes we will notify you in advance and ensure that the processing complies with data protection law.
Restriction of Processing: You have the right to ask us to restrict the processing of your personal data in certain circumstances, such as where you wish to suspend processing whilst we establish the accuracy or the legal reason for processing it.
To withdraw your Consent to processing: If we are processing your personal data on the legal basis of consent, you have the legal right to withdraw your consent (either fully or partly). The withdrawal of your consent will not affect the lawfulness of our processing prior to the withdrawal of your consent. We make it quick and easy to withdraw your consent (or amend your preferences). Simply follow the “unsubscribe” facility on relevant emails or alternatively follow the instructions in our other correspondence. If you experience any difficulty, please email: dataprotection@kes.school
Portability: In certain circumstances, you have the legal right to receive your personal information or have your personal information transmitted to another organisation in a structured, commonly used and machine readable format.

Complaints

The School has exceptionally high standards when it comes to your personal data. If we fail to meet those standards please contact our Data Protection Lead dataprotection@kes.school

If you are not happy with the way we handle your complaint, or the standard by which we handle your personal data, you can complain to the supervisory authority, the Information Commissioner’s Office (ICO).

Information Commissioner’s House

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

www.ico.org.uk

Changes to This Privacy Notice

The School will update this Privacy Notice from time to time to keep it accurate and up to date. We will publish the current version on our website and in the Alumni Hub. If we make significant amendments, we will notify you of the change, usually via email or post.