PRIVACY NOTICE
- Introduction
1.1 The Independent Schools' Bursars Association
(ISBA) supports and advises the bursars and senior
management staff of more than 1000 independent schools across the
UK and overseas. Our services are designed to assist school staff
in the successful administrative, financial and operational
management of their school, in particular through their membership
of the ISBA (Members/Membership).
1.2 This Privacy Notice (Notice) explains
how ISBA collects, uses and discloses
your personal data, and your rights in relation to the personal
data it holds.
1.3 ISBA may change this Notice from time to time. However,
any major changes will be notified directly to those affected
wherever practicable. This Notice is effective from February 2019,
when it was last updated.
- Data controller
2.1 ISBA is the data controller of your personal data and is
subject the Privacy and Electronic Communications Regulations 2003,
EU Regulation 2016/679 (the GDPR) and the UK
Data Protection Act 2018 and any successor legislation. This
privacy notice also covers the data processing activities of ISBA
Enterprises Limited (company number 04334495) which is a wholly
owned trading subsidiary of ISBA.
2.2 In this
Notice, us, we and
our all refer to the ISBA and ISBA
Enterprises Limited.
- Contact details
3.1 If you have any questions about how we use your
personal data, or you wish to exercise any of the rights set out
above, please contact us below by using the following
details:
3.1.1. By post - Privacy Officer, Bluett House, Unit 11-12 Manor
Farm, Cliddesden, Hampshire, RG25 2JB
3.1.2 By email - johnmurphie@theisba.org.uk
3.1.3 By telephone - 01256 330369
- How we collect your data
4.1 We may collect your personal data in a number of ways,
for example:
4.1.1 From the information you provide to us when you meet
with one of our employees or representatives;
4.1.2 When you communicate with us by post, telephone, fax,
email or other forms of electronic communication;
4.1.3 When you complete (or we complete on your
instructions) conference, seminar or training booking forms or
webinar registration forms;
4.1.4 When you (or your school bursar) completes an ISBA
Membership application form;
4.1.5 When you provide delivery and subscription details for
the ISBA magazine, The Bursar's Review;
4.1.6 When you make an enquiry via the ISBA website or
contribute to online forums;
4.1.7 When you provide bank details by cheque, BACS, direct
debit form or over the telephone in relation to ISBA membership or
our products and services; and
4.1.8 When you complete our surveys and questionnaires
including at an event.
- The categories of the data we collect
5.1 We may collect the following categories of personal data
about you:
5.1.1 Your name, job title, qualifications, and contact
information such as address, email address and telephone
number;
5.1.2 A record of your ISBA Membership, where
applicable;
5.1.3 Bank details and other financial information;
5.1.4 Technical information collected through the use of
cookies about your use of the ISBA website including details of
your domain name, location and internet protocol (IP) address,
operating system, browser version, the content you view, and how
long you stayed on a page. For full details, see our Cookies Notice
which is available at www.theisba.org.uk/cookie-usage-for-this-website.aspx;
5.1.5 Information concerning your engagement with the ISBA,
including records of communications between you and us (including
details contributed to online forums) and your attendance at ISBA
events, seminars and meetings (including images); and
5.1.6 Your opinion and feedback in relation to any ISBA
surveys or questionnaires that you complete such as feedback on our
seminars and events.
- The basis for processing your data, how we use that
data and with whom we share it
Where we have a contractual relationship with you
6.1 We may process your personal data because it is
necessary for the performance of a contract to deliver the services
you have engaged us for, including under the terms of ISBA
Membership, or in order to take steps at your request prior to
entering into a contract. In this respect, we use your personal
data for the following:
6.1.1 To correspond with you about services, including
subscriptions and event details, that you have requested from us;
6.1.2 To process applications you have made to attend
an ISBA event and provide you with the services you have requested;
6.1.3 To maintain internal records of ISBA Membership, and
enquiries about Membership; and
6.1.4 If you are an ISBA Member, to send you expected
Membership benefits or subscriptions, and keep you informed with
updates relevant to governance and administration of your ISBA
Membership. This will include forthcoming events and new resources,
news we consider is relevant to Members or other recipients, and
administration or renewal of your Membership.
6.2 In this respect, we may also provide your personal data
to the following (but only for purposes connected with our
fulfilling contracts with you):
6.2.1 Third party service providers who we may engage to
assist in delivering the services to you: for example, conference
and seminar organisers, speakers and instructors;
6.2.2 Our bank to whom payment details are provided in order
to process a payment;
6.2.3 Our website provider, who may store details such as
name and email address to enable member login;
6.2.4 Our professional advisers where it is necessary
for us to obtain their advice or assistance, or if you have
specifically requested your details or queries are passed on to our
professional advisers as part of our fulfilling a Member request
(but otherwise advice requests are by policy carried out without
identifying you or your school);
6.2.5 Professionals who assist us in putting together,
printing and delivering the ISBA magazine, The Bursar's Review; and
6.2.6 Our IT support and any data storage provider.
Legal obligations and legitimate
interests
6.3 We may process your personal data because it is
necessary for our or a third party's legitimate interests. This
will always be weighed against your rights, interests and
expectations.
6.4 Examples of where we process personal data in accordance
with our legitimate interests include:
6.4.1 processing technical information about your use of the
ISBA website to ensure that content on our site is presented in the
most effective manner;
6.4.2 processing enquiries, complaints and analysing our
services;
6.4.3 sharing attendees of our events' name, position and
school with other attendees, sponsors and exhibitors (for example,
when creating and sharing a delegate list);
6.4.4 researching our market, including being aware of
appointments and changes in position at schools (whether or not
ISBA Members); and
6.4.5 marketing our goods, services, events and resources by
post, telephone and electronic mail - except where we provide
material directly to our Members or others under contract, or in
situations where it is required or appropriate to seek your
specific consent.
6.5 We may also process your data for our compliance with
our legal obligations. In this respect we may use your personal
data to comply with subject access requests of others, tax
legislation, safeguarding requirements, for the prevention and
detection of crime, and in order to assist the police and other
competent authorities with investigations (including criminal
investigations).
Consent
6.6 In some circumstances the ISBA may seek your specific
consent to process your personal data: for example, if we wish to
use your likeness or an attributed quote in our marketing
materials, or if we wish to name you as part of an article or case
study for use in our materials, including for example, in The
Bursar's Review.
6.7 ISBA Members primarily receive communications as part of
their Membership, which in accordance with your Membership rights
may include information about ISBA resources, services and events.
However
6.7.1 if you are not an ISBA Member; or
6.7.2 if you are a Member but we wish to process your data
for a purpose that falls outside your Membership,
then we may also request your consent to process your personal
data in this way. An example may be in order to provide you with
information of a marketing nature (whether concerning the ISBA or a
third party) to your personal email account, if you have provided
your email address for those purposes.
6.8 If you have given your consent and you wish to withdraw
it, please contact us using the contact details at section 3.1
above. Please note that where our processing of your personal data
relies on your consent and you then withdraw that consent, we may
not be able to provide some aspects of our services to you.
Equally, where our processing of your personal data does not rely
on your consent, we may not be able to fulfil your request (please
see Your Rights section below).
7 Profiling
We may use personal characteristics such as role, your expressed
interests, your previous interactions with ISBA or geographical
location to target our communications to a specific audience. If
you wish to tailor the communications you receive from us then
please contact us using the details provided at section 3.1
above.
8. Retention of your data
8.1 We may retain your personal data only for so long as is
necessary to deliver our services to you, and to protect our legal
interests (for example where required by relevant authorities, or
for a reasonable legal limitation period after we have ceased
providing services to you) or as otherwise stated to you when your
data is collected. 8.2 We may keep certain limited details
about you for longer for archiving or statistical purposes, or for
suppression purposes (if you have requested not to hear from us).
If you have any query about retention of your data, please see Your
Rights below.
9 Your rights
9.1 You have the following rights:
9.1.1 To require us not to send you marketing
communications;
9.1.2 To obtain access to, and copies of, the personal data
that we hold about you;
9.1.3 To request that we erase your personal data;
9.1.4 To request that we restrict our data processing
activities in relation to the personal data that we hold about you;
9.1.5 To receive from us the personal data we hold about you
which you have provided to us, in a reasonable format specified by
you, including for the purpose of you transmitting that personal
data to another data controller; and
9.1.6 To require us to correct the personal data we hold
about you if it is inaccurate.
9.2 Please note that the above rights are not absolute, and
we may be entitled to refuse requests where exceptions apply: for
example, if we have reason to believe the personal data we hold is
accurate or we can show our processing is necessary for a lawful
purpose set out in this notice.
9.3 You can find out more about your rights under data
protection legislation at www.ico.org.uk.
9.4 If you are not satisfied with how we are processing your
personal data, you can make a complaint to the supervisory
authority, which in the UK is the Information Commissioner's Office
(www.ico.org.uk).
February 2019