PRIVACY NOTICE
- Introduction
1.1 The Independent Schools' Bursars Association
(ISBA) supports and advises the bursars and senior
management staff of more than 1000 independent schools across the
UK and overseas. Our services are designed to assist school staff
in the successful administrative, financial and operational
management of their school, in particular through their membership
of the ISBA (Members/Membership).
1.2 This Privacy Notice (Notice) explains
how ISBA collects, uses and discloses
your personal data, and your rights in relation to the personal
data it holds.
1.3 ISBA may change this Notice from time to time. However,
any major changes will be notified directly to those affected
wherever practicable. This Notice is effective from February 2019,
when it was last updated.
- Data controller
2.1 ISBA is the data controller of your personal data and is
subject the Privacy and Electronic Communications Regulations 2003,
EU Regulation 2016/679 (the GDPR) and the UK
Data Protection Act 2018 and any successor legislation. This
privacy notice also covers the data processing activities of ISBA
Enterprises Limited (company number 04334495) which is a wholly
owned trading subsidiary of ISBA.
2.2 In this
Notice, us, we and
our all refer to the ISBA and ISBA
Enterprises Limited.
- Contact details
3.1 If you have any questions about how we use
your personal data, or you wish to exercise any of the rights set
out above, please contact us below by using the following
details:
3.1.1. By post - Privacy Officer, Bluett
House, Unit 11-12 Manor Farm, Cliddesden, Hampshire,
RG25 2JB
3.1.2 By email - johnmurphie@theisba.org.uk
3.1.3 By telephone - 01256 330369
- How we collect your data
4.1 We may collect your personal data in a number
of ways, for example:
4.1.1 From the information you provide
to us when you meet with one of our employees or
representatives;
4.1.2 When you communicate with us by
post, telephone, fax, email or other forms of electronic
communication;
4.1.3 When you complete (or we complete
on your instructions) conference, seminar or training booking forms
or webinar registration forms;
4.1.4 When you (or your school bursar)
completes an ISBA Membership application form;
4.1.5 When you provide delivery and
subscription details for the ISBA magazine, The Bursar's
Review;
4.1.6 When you make an enquiry via the
ISBA website or contribute to online forums;
4.1.7 When you provide bank details by
cheque, BACS, direct debit form or over the telephone in relation
to ISBA membership or our products and services; and
4.1.8 When you complete our surveys and
questionnaires including at an event.
- The categories of the data we collect
5.1 We may collect the following categories of
personal data about you:
5.1.1 Your name, job title,
qualifications, and contact information such as address, email
address and telephone number;
5.1.2 A record of your ISBA Membership,
where applicable;
5.1.3 Bank details and other financial
information;
5.1.4 Technical information collected
through the use of cookies about your use of the ISBA website
including details of your domain name, location and internet
protocol (IP) address, operating system, browser version, the
content you view, and how long you stayed on a page. For full
details, see our Cookies Notice which is available
at www.theisba.org.uk/cookie-usage-for-this-website.aspx;
5.1.5 Information concerning your
engagement with the ISBA, including records of communications
between you and us (including details contributed to online forums)
and your attendance at ISBA events, seminars and meetings
(including images); and
5.1.6 Your opinion and feedback in
relation to any ISBA surveys or questionnaires that you complete
such as feedback on our seminars and events.
- The basis for processing your data, how we use that
data and with whom we share it
Where we have a contractual relationship with
you
6.1 We may process your personal data because it is
necessary for the performance of a contract to deliver the services
you have engaged us for, including under the terms of ISBA
Membership, or in order to take steps at your request prior to
entering into a contract. In this respect, we use your personal
data for the following:
6.1.1 To correspond with you about
services, including subscriptions and event details, that you have
requested from us;
6.1.2 To process applications you have
made to attend an ISBA event and provide you with the services you
have requested;
6.1.3 To maintain internal records of
ISBA Membership, and enquiries about Membership; and
6.1.4 If you are an ISBA Member, to send
you expected Membership benefits or subscriptions, and keep you
informed with updates relevant to governance and administration of
your ISBA Membership. This will include forthcoming events and new
resources, news we consider is relevant to Members or other
recipients, and administration or renewal of your Membership.
6.2 In this respect, we may also provide your personal data
to the following (but only for purposes connected with our
fulfilling contracts with you):
6.2.1 Third party service providers who
we may engage to assist in delivering the services to you: for
example, conference and seminar organisers, speakers and
instructors;
6.2.2 Our bank to whom payment details
are provided in order to process a payment;
6.2.3 Our website provider, who may
store details such as name and email address to enable member
login;
6.2.4 Our professional advisers where it
is necessary for us to obtain their advice or assistance, or if you
have specifically requested your details or queries are passed on
to our professional advisers as part of our fulfilling a Member
request (but otherwise advice requests are by policy carried out
without identifying you or your school);
6.2.5 Professionals who assist us in
putting together, printing and delivering the ISBA magazine, The
Bursar's Review; and
6.2.6 Our IT support and any data
storage provider.
Legal obligations and legitimate
interests
6.3 We may process your personal data because it is
necessary for our or a third party's legitimate interests. This
will always be weighed against your rights, interests and
expectations.
6.4 Examples of where we process personal data in accordance
with our legitimate interests include:
6.4.1 processing technical information
about your use of the ISBA website to ensure that content on our
site is presented in the most effective manner;
6.4.2 processing enquiries, complaints
and analysing our services;
6.4.3 sharing attendees of our events'
name, position and school with other attendees, sponsors and
exhibitors (for example, when creating and sharing a delegate
list);
6.4.4 researching our market, including
being aware of appointments and changes in position at schools
(whether or not ISBA Members); and
6.4.5 marketing our goods, services,
events and resources by post, telephone and electronic mail -
except where we provide material directly to our Members or others
under contract, or in situations where it is required or
appropriate to seek your specific consent.
6.5 We may also process your data for our compliance with
our legal obligations. In this respect we may use your personal
data to comply with subject access requests of others, tax
legislation, safeguarding requirements, for the prevention and
detection of crime, and in order to assist the police and other
competent authorities with investigations (including criminal
investigations).
Consent
6.6 In some circumstances the ISBA may seek your
specific consent to process your personal data: for example, if we
wish to use your likeness or an attributed quote in our marketing
materials, or if we wish to name you as part of an article or case
study for use in our materials, including for example, in The
Bursar's Review.
6.7 ISBA Members primarily receive communications as part of
their Membership, which in accordance with your Membership rights
may include information about ISBA resources, services and events.
However
6.7.1 if you are not an ISBA Member;
or
6.7.2 if you are a Member but we wish to
process your data for a purpose that falls outside your
Membership,
then we may also request your consent to process your personal
data in this way. An example may be in order to provide you with
information of a marketing nature (whether concerning the ISBA or a
third party) to your personal email account, if you have provided
your email address for those purposes.
6.8 If you have given your consent and you wish to withdraw
it, please contact us using the contact details at section 3.1
above. Please note that where our processing of your personal data
relies on your consent and you then withdraw that consent, we may
not be able to provide some aspects of our services to you.
Equally, where our processing of your personal data does not rely
on your consent, we may not be able to fulfil your request (please
see Your Rights section below).
7 Profiling
We may use personal characteristics such as role, your expressed
interests, your previous interactions with ISBA or geographical
location to target our communications to a specific audience. If
you wish to tailor the communications you receive from us then
please contact us using the details provided at section 3.1
above.
8. Retention of your data
8.1 We may retain your personal data only for so
long as is necessary to deliver our services to you, and to protect
our legal interests (for example where required by relevant
authorities, or for a reasonable legal limitation period after we
have ceased providing services to you) or as otherwise stated to
you when your data is collected.
8.2 We may keep certain limited details about you for longer
for archiving or statistical purposes, or for suppression purposes
(if you have requested not to hear from us). If you have any query
about retention of your data, please see Your Rights below.
9 Your rights
9.1 You have the following rights:
9.1.1 To require us not to send you
marketing communications;
9.1.2 To obtain access to, and copies
of, the personal data that we hold about you;
9.1.3 To request that we erase your
personal data;
9.1.4 To request that we restrict our
data processing activities in relation to the personal data that we
hold about you;
9.1.5 To receive from us the personal
data we hold about you which you have provided to us, in a
reasonable format specified by you, including for the purpose of
you transmitting that personal data to another data controller;
and
9.1.6 To require us to correct the
personal data we hold about you if it is inaccurate.
9.2 Please note that the above rights are not absolute, and
we may be entitled to refuse requests where exceptions apply: for
example, if we have reason to believe the personal data we hold is
accurate or we can show our processing is necessary for a lawful
purpose set out in this notice.
9.3 You can find out more about your rights under data
protection legislation at www.ico.org.uk.
9.4 If you are not satisfied with how we are processing your
personal data, you can make a complaint to the supervisory
authority, which in the UK is the Information Commissioner's Office
(www.ico.org.uk).
February 2019