Privacy Notice for our School Based Programmes
Right to Succeed CIO is an organisation which runs a number of programmes in schools and education settings, such as the Reach, KS3 Literacy, Every Child and Cradle to Career programme. The aim of our programmes is to give extra help for your child’s education.
We will treat any information about your child with respect. The point of this notice is to give you some more information about how we do that. Please read it carefully to understand how we use your child’s personal information.
You don’t have to give us all the information we ask for but if you do not then your child will not be able to benefit from the services we provide.
We collect personal information when:
a. When you give it to us directly
For example, when you or child registers with us or contacts us by phone or email.
b. When we obtain it indirectly
For example, your child’s school may share your child’s personal information with us so we can assess how to help your child.
We may combine your personal information from these different sources for the purposes set out in this Notice.
We may collect, store and otherwise process the following kinds of personal information:
a. your name and contact details (including emergency contacts), including postal address, telephone number and email address;
b. your child’s name and contact details (only where appropriate and, if necessary, with your or your child’s consent);
c. your child’s date of birth and gender;
d. details of your child’s school and your child’s records there, for example details about his or her performance or attendance, or teacher’s opinions of him or her;
e. personal descriptions or opinions about your child (for example as part of assessments / reviews);
f. information about our services which you or your child use/ which we consider may be of interest to you; and/ or;
g. any other personal information which you choose to share with us.
Do we process special categories of data?
The EU General Data Protection Regulation (“GDPR”) recognises certain categories of personal information as sensitive and therefore requiring more protection, for example information about an individual’s health, racial/ethnic background or religious beliefs.
In certain situations, RTS may need to collect and/or use these special categories of data (for example, we may need to know a bit more about your or your child’s ethnic background when conducting a literacy assessment / providing assistance with English language teaching). We will only process these special categories of data if there is a valid reason for doing so and where the GDPR allows us to do so.
For the purposes of our programmes, personal information will only be used for the purposes set out in this Notice. In particular, we may use personal information:
a. to provide your child with our services in general;
b. to assess your child’s educational needs so that we can tailor our services accordingly;
c. to provide further information about our work, services or activities (where we need it, we will not do so unless we have your consent);
d. to answer your questions/requests and communicate with you in general;
e. to manage relationships with our partners;
f. to further our aims of improving education for lower-income communities;
g. to analyse and improve our work and services (including our website), or for our internal records;
h. to report on the impact and effectiveness of our work;
i. for training and/ or quality control;
j. to audit and/ or administer our accounts;
k. to satisfy our legal obligations for example in relation to regulatory or law enforcement bodies (such as when they need information for tax or anti-money laundering purposes);
l. for the prevention of fraud or misuse of services; and/or
m. for legal claims (where we may be making a claim or defending one).
The GDPR requires us to rely on one or more lawful bases to use personal information. We consider the grounds listed below to be relevant:
a. Where you have provided your consent for us to use your or your child’s personal information in a certain way (for example, where you give us your consent to receive our newsletter).
b. Where necessary so that we can comply with a legal obligation (for example, where we are ordered by the police to disclose personal information as part of a criminal investigation).
c. Where it is in somebody’s vital interests (for example, in case of medical emergency).
d. Where there is a legitimate interest in us doing so.
We can collect and process personal information if it is reasonably necessary to achieve our or others’ legitimate interests (as long as that processing is fair, balanced and does not unduly impact your or your child’s rights).
Most of the data we use will be where it is in our “legitimate interests” so that we can run our programmes in order to help improve education in lower-income communities.
When we process personal information to achieve our legitimate interests, we balance any potential impacts on you or your child (both positive and negative). We will not use personal information for activities where our interests are outweighed by an adverse impact on you or your child, for example where it would be unnecessarily intrusive (unless, for instance, we are otherwise required or permitted to by law).
e. Where there is a legitimate interest in us doing so.
The GDPR allows us to collect and process your personal information if it is reasonably necessary to achieve our or others’ legitimate interests (as long as that processing is fair, balanced and does not unduly impact your rights).
In broad terms, our “legitimate interests” means the interests of running RTS as a charitable entity and pursuing our aims and ideals; for example ensuring that young people in lower-income communities receive access to a good education, and working out how to improve interaction between local schools and young people in their catchment area.
When we process your personal information to achieve such legitimate interests, we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal information for activities where our interests are overridden by the impact on you, for example where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law).
We are legally obliged to exercise more caution when we collect and use children’s personal information. Your child’s right to privacy is very important to us – we will always have in place appropriate safeguards to ensure that children’s personal information is handled with due care.
Usually, we only keep your or your child’s personal information as long as is required to provide your child with the programme’s services and to comply with our legal obligations.
However, sometimes we may need to keep your or your child’s personal information longer, for example in case there is an ongoing complaint which needs to be handled, or in case a legal issue arises. In such situations, as a guideline, we remove personal information from our records six years after the date it was collected.
However, if before that date, (i) personal information is no longer required in relation to the purposes we continue to use it, (ii) we are no longer lawfully entitled to keep or use it or (iii) you or your child validly exercises the right of erasure (please see section 11 below), we will remove it from our records at the relevant time.
We do not share, sell or rent your personal information to third parties for marketing purposes. However, we may disclose your personal information to selected third parties in order to achieve the purposes set out in this Notice.
Non-exhaustively, those parties may include:
a. your child’s school;
b. GL Assessment, a specialist organisation which helps us to carry out the programme;
c. our partners, who provide us with the funding to carry out our programmes;
d. suppliers and sub-contractors that help us deliver our programmes, for example IT service providers such as website hosts or cloud storage providers;
e. professional service providers such as accountants and lawyers;
f. others who assist us with research to monitor the impact/ effectiveness of our services; and/or
g. regulatory authorities, such as tax authorities.
In particular, we reserve the right to disclose your personal information to third parties:
- in the event that we sell or buy any business or assets, in which case we will disclose your personal information to the (prospective) seller or buyer of such business or assets;
- if substantially all of our assets are acquired by a third party, personal information held by us may be one of the transferred assets;
- if we are under any legal or regulatory duty to do so; and/or
- to protect the rights, property or safety of RTS, its personnel, users, visitors or others.
Right to Succeed is committed to keeping personal information safe and secure and we have appropriate and proportionate security policies and organisational and technical measures in place to help protect all personal information which we collect and use.
Your personal information is only accessible by appropriately trained staff, volunteers and contractors, and stored on secure servers with features enacted to prevent unauthorised access.
Given that we are a UK-based operation and that our programme is only available to schools in the UK, we will normally only transfer personal information within the UK or European Economic Area (“EEA”), in which all countries have the same level of data protection law as the UK.
However, (as explained in section 8 above) we need to share personal information with other parties to offer the programme’s services, and that information might be transferred to or stored in a location outside the EEA by such other parties.
Please note that some countries outside of the EEA have a lower standard of protection for personal information, including lower security requirements and fewer rights for individuals.
Where personal information is transferred, stored and/or otherwise processed outside the EEA in a country that does not offer an equivalent standard of protection to the EEA, we will take all reasonable steps necessary to ensure that the recipient implements appropriate safeguards (such as by entering into standard contractual clauses). Unfortunately, no transmission of personal information over the internet can be guaranteed to be 100% secure – however, once we have received your or your child’s personal information, we will use strict procedures and security measures to try and prevent unauthorised access.
Where we rely on your consent to use personal information, you have the right to withdraw that consent at any time. This includes the right to ask us to stop using personal information for marketing or fundraising purposes or to unsubscribe from our email list at any time. You also have the following rights:
a. Right of access – you or your child can write to us to ask for confirmation of what personal information we hold on you or your child and to request a copy of that personal information. Provided we are satisfied that you are / your child is entitled to see the personal information requested and we have successfully confirmed your identity, we will provide you / your child with your / his or her personal information, subject to any exemptions that apply.
b. Right of erasure – at your / your child’s request we will delete your / his or her personal information from our records as far as we are required to do so.
c. Right of rectification – if you believe / your child believes our records of your / his or her personal information are inaccurate, you have the right to ask for those records to be updated. You can also ask us to check the personal information we hold about you / your child if you are unsure whether it is accurate/up to date.
d. Right to restrict processing – you have / your child has the right to ask for processing of your / his or her personal information to be restricted if there is disagreement about its accuracy or legitimate usage.
e. Right to object – you have / your child has the right to object to processing where we are (i) processing personal information on the basis of the legitimate interests ground, (ii) using personal information for direct marketing or (iii) using personal information for statistical purposes.
f. Right to data portability – to the extent required by the GDPR, where we are processing personal information (that you have or your child has provided to us) either (i) by relying on your / your child’s consent or (ii) because such processing is necessary for the performance of a contract to which you are party / your child is a party or to take steps at your / your child’s request prior to entering into a contact, and in either case we are processing using automated means (i.e. with no human involvement), you / your child may ask us to provide the personal information to you – or another service provider – in a machine-readable format.
g. Rights related to automated decision-making – you have / your child has the right not to be subject to a decision based solely on automated processing of your / your child’s personal information which produces legal or similarly significant effects on you / your child, unless such a decision (i) is necessary to enter into/perform a contract between you and us/another organisation; (ii) is authorised by EU or Member State law to which RTS is subject (as long as that law offers you/ your child sufficient protection); or (iii) is based on your / your child’s explicit consent.
Please note that some of these rights only apply in limited circumstances. For more information, we suggest that you contact us using the details below.
You are / your child is further entitled to make a complaint about us or the way we have processed personal information to the Information Commissioner’s Office – www.ico.org.uk. For further information on how to exercise this right, please contact us using the details below.
We may update this Notice from time to time. We will notify you of significant changes by contacting you directly where reasonably possible for us to do so and by placing an update notice on our website. However, we also recommend you check it from time to time. This Notice was last updated on 23rd November 2020.
Please let us know if you have any questions or concerns about this Notice or about the way in which RTS processes your personal information by contacting us at the following channels:
Phone: 020 8099 5171
Letter: Right to Succeed CIO, Finsbury Business Centre, 40 Bowling Green Lane, London EC1R 0NE.