Privacy Policy

1. Who we are and the purpose of this Privacy Notice

WASHINGTON AMERICAN HIGH SCHOOL

This Privacy Notice is intended to provide information about how the School will collect, use and hold (or “process“) personal data about individuals including: current, past and prospective pupils; and their parents, carers or guardians (referred to in this policy as “parents“). Please note that the School has a separate Privacy Notice applicable to its employees and other staff. This Privacy Notice applies alongside any other information the School may provide about a particular use of personal data. This Privacy Notice also applies in addition to the Schoolʼs other relevant terms and conditions and policies, including:

Any contract between the School and the parents of pupils.
The Schoolʼs policy on taking, storing and using images of children.
The Schoolʼs and/or Groupʼs Data Retention Policy.
The Schoolʼs Data Protection Rights Policy.
The Schoolʼs Cookies Policy;

The Schoolʼs safeguarding, pastoral, or health and safety policies, including as to how concerns or incidents are recorded; and the Schoolʼs or the Groupʼs (as applicable) IT policies.

This Privacy Notice may be updated from time to time to ensure continued compliance with applicable laws and to reflect best practice.

2. What information is collected about pupils and parents/carers

The types of personal data the School may process include:

Name and contact information such as the address, email and telephone number of the pupil, parent, guardian, fee payer and next of kin.
Pupil date and country of birth, ethnicity, gender and country of domicile, passport number or national identity card details.
Information relating to pupil education history such as previous schools, courses completed, dates of study, attendance, disciplinary and safeguarding records and examination results and transcripts.
Pupilsʼ academic data including examination and assessment results, reports and curriculum timetables.
Information about pupilsʼ health and medical conditions, special educational needs and family.
Circumstances / living arrangements.
Safeguarding information.
Assessment of suitability to receive a bursary; and images of pupils (and occasionally other individuals) engaging in School activities (in accordance with the Schoolʼs policy on taking, storing and using images of children).

Please note that the School will routinely anonymize and/or aggregate personal data, such that it is no longer considered “personal data” under applicable data protection law or otherwise apply appropriate data minimization procedures such as pseudonymization. We use this data set for evaluation and analytical purposes, and we may also share it with third parties for these purposes.

3. How the School collects information

Generally, the School receives personal data from the individual directly (including, in the case of pupils, from their parents). However, in some cases personal data will be supplied by third parties (for example another school, or other professionals or authorities, or third party service providers who credit and identity check parents and their source of funds); or collected from publicly ainfvormaailable rtion presouro ces.vided during the admission process and when the pupil is attending the School; With the above in mind, the following are the primary ways the School collects personal data about pupils and parents:s oftware including the Groupʼs Global Study Platform.

4. Why the School needs to process personal data

The primary use of the personal data we collect is to support the learning and development of pupils during their time at the School, whilst ensuring the wellbeing and safeguarding of the pupils. In order to do so, the School needs to process a wide range of personal data about our community as part of our daily operations. Some of this activity the School will need to carry out is because it is necessary for the performance of a contract with our staff, or parents of our pupils. Other uses of personal data will be made in accordance with the Schoolʼs legitimate interests, or the legitimate interests of others, provided that these are not outweighed by the impact on individuals. The School expects that the following uses will fall within that category of our (or our communityʼs) “legitimate interests”:

For the purposes of pupil admissions, to confirm the identity of prospective pupils and their parents, and to retain a record (if appropriate) for the purposes of future applications or openings.
To carry out credit, identity and source of funds checks, whether with previous schools and/or third party sources or service providers, including for the purposes of verifying that parents are not subject to (or within the purview of) sanctions.
For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as tax, diversity or gender pay gap analysis); To promote diversity and equality.
To promote diversity and equality.
To monitor and evaluate the performance and effectiveness of the School, and to maintain and improve the academic, corporate, financial, estate and human resource management of the School.
To enable relevant authorities to monitor the Schoolʼs performance and to intervene or assist with incidents as appropriate.
To give and receive information and references about past and current pupils, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend; and to provide references to potential employers of past pupils.
For debt collection purposes.
To enable pupils to take part in national or other assessments, and to publish the results or other achievements of pupils of the School.
To safeguard pupilsʼ health and welfare and provide appropriate pastoral care.
To monitor (as appropriate) use of the Schoolʼs IT and communications systems in accordance with the Schoolʼs Acceptable Use Policy.
To make use of images (including photographs and videos) of pupils for administrative and day to day internal uses such as newsletters and year books, in accordance with the Schoolʼs policy on taking, storing and using images of children.
For the prevention and detection of crime, and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.
To carry out or cooperate with any School or external complaints, disciplinary or investigation process.
To contact parents or pupils to promote the Groupʼs services on matters such as openings on waiting lists at sister schools, opportunities within the Parent Teacher Associations or friends of the School, or for Alumni events and activities.
To promote the School to prospective parents and pupils.
Where otherwise reasonably necessary for the Schoolʼs purposes, including to obtain appropriate professional advice and insurance for the School.
The School may also process your personal data for our compliance with our legal obligations. In this respect, we may use your personal data for the following:
To meet our compliance and regulatory obligations, including in order to comply with any requirement of any applicable statute, regulation or regulatory rule, such as compliance with anti- money laundering laws and safeguarding requirements.
For the prevention, detection and investigation of crime.
To assist with investigations, including criminal investigations carried out by the police and other competent authorities.
To administer and maintain such records as may be required by applicable laws and regulations from time to time.

5. We may also process your personal data for additional reasons where:

It is necessary to protect the vital interests of the pupil or another person.
It is necessary for the establishment, exercise or defence of legal claims (for example, to protect
and defend the Schoolʼs rights, property, or those of any affiliates, including the Group).
We have the consent of the data subject to do so (for example, we seek parental and/or pupil
consent for certain external marketing uses of pupil images).

In addition, the School will on occasion need to process more ʻsensitiveʼ types of data (sometimes referred to as special category personal data) (concerning health, ethnicity, religion or sexual life) or criminal records information in accordance with rights or duties imposed on us by law, including as regards safeguarding, or from time to time by explicit consent where

To provide educational services in the context of making reasonable adjustments for a pupilʼs disability and/or any special educational needs of a pupil.
As part of any School or external complaints, disciplinary or investigation process that involves such data, for example if there are SEND, health or safeguarding elements.
For legal and regulatory purposes (for example child protection, diversity monitoring, attendance / absence reporting, health and safety compliance) and to comply with its legal obligations and duties of care.

6. Who personal data may be shared with

Processing by third parties. For the most part, personal data collected by the School will remain within the School, and will be processed by appropriate individuals only in accordance with access protocols (i.e. on a ʻneed to knowʼ basis). However, we use data processors who are third parties who assist us with some functions, including accounting, IT, cloud storage / records management, monitoring, mailing, and to support our delivery of the curriculum and associated education services to pupils (including via AI systems). This type of external data processing is subject to contractual assurances that personal data will be kept securely and used only in accordance with the Schoolʼs specific directions.

Data sharing. The School will from time to time, need to share personal information relating to its community of pupils and parents/guardians with third parties, such as:

External health professionals such as educational psychologists and speech therapists.
Appropriate contractors and third-party suppliers, such as visiting music teachers.
Federal and State authorities, statutory agencies and/or regulatory bodies.
Bursary and scholarship funding organizations.
The Group, other entities within the Group, or other schools in the Group.
Exit/destination schools (including in the form of confidential references).
Professional advisers (e.g. lawyers, insurers, PR advisers and accountants).
Third parties and their advisers in the event of a possible or actual sale, merger or other restructuring or financing of the School / Group; and Courts or debt collections agencies in the event of non-payment of

International data transfers. Where data is transferred internationally, we will put in place appropriate measures to ensure the adequate protection of your personal data when it is transferred to countries that do not provide the same level of protection for personal data, and ensure that international transfers are carried out in accordance with applicable data protection laws. Marketing activity. The School may use parentsʼ email addresses to create lookalike audiences in Social Media Platforms for marketing purposes. This involves using email addresses in an encrypted format to match users on the platform and to create a Custom Audience or Lookalike Audience. Emails are not shared in a readable format (i.e. the data is pseudonymised) and will be deleted by the platform after the matching process.

The primary purpose of using lookalike audiences is to support our marketing activities by reaching potential parents who may be interested in our educational services. This is done by leveraging information such as demographics, interests and behaviours for matching purposes. We process your personal data for lookalike audiences based on our legitimate interests. We have assessed that this processing is necessary for our marketing activities and does not override your rights and freedoms.

The School will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason, including to meet regulatory and legal requirements or for archiving purposes.
For further information on data retention, please see the Schoolʼs Data Retention Policy which is available upon request.

We may retain certain academic data for longer periods for archiving, research and statistical purposes.
Where we do so, we will put in place suitable data minimization procedures. This will include removing the data from day-to-day processing and putting in place access restrictions.

7. Keeping in touch and supporting the School

On leaving the School, pupils will also become members of the Alumni community. Where applicable some personal data from pupil records will be transferred to the Alumni database.
This may include items such as contact details, sporting interests, and academic details.
The School will use the contact details of parents, alumni and other members of the school community to keep them updated about the activities of the School, or alumni and parent events of interest, including by sending updates and newsletters, by email and by post.
You always have the right to withdraw consent, where given, or otherwise object to direct marketing or fundraising. However, the School is nonetheless likely to retain some of your details (not least to ensure that no more communications are sent to that particular address, email or telephone number).

8. Your personal data rights

You have a number of rights in relation to your personal data. These are:

The right of access: You may request a copy of the personal data that the School holds about
The right to rectification: You may ask the School to correct any information we hold about you if it is incorrect. The right to erasure: You may ask the School (in certain circumstances) to delete information that the School holds on you.
The right to restrict processing: You may ask the School to restrict our data processing activities (and, where the Schoolʼs processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal).
The right to data portability: You may ask the School (in certain circumstances) to transfer your personal data to another data controller in a format that makes it easy for them to use.
The right to object: You may object, on grounds relating to your particular situation, to any of the