WHO WE ARE
COUNCIL OF BRITISH INTERNATIONAL SCHOOLS is a private limited company by guarantee incorporated and registered in England and Wales with the company number 07348782 whose registered office is 55-56 Russell Square, London, WC1B 4HP (“COBIS”)
For the purposes of the Data Protection Act 2018, the UK General Data Protection Regulations Retained Regulation (EU) 2016/679), the EU General Data Protection Regulations (to the extent that processing occurs outside of the EU) and any other applicable data protection and privacy laws and regulations (“Data Protection Legislation”), COBIS will be the ‘data controller’ for all personal information we determine the means and purpose of processing and has registered with the Information Commissioners Office under registration number ZA363214.
HOW DO YOU USE MY DATA?
We gather information from you in the following circumstances:
When you register with us as a member
When your school joins COBIS, we require personal information from the staff at the school to create an account and provide our services. We will need to collect personal information for specific purposes from each of the groups below:
School administration: We require the contact details of finance managers and those responsible for school finance administration to allow us to collect membership fees.
Head teachers/Senior leaders: we collect the professional contact details of head teachers and senior school leaders to inform you of the membership benefits COBIS offers once your school has subscribed to our service.
We may also retain these contact details once membership has lapsed, and with your permission, may contact you with information about current benefits of our membership and services. We rely on our legitimate interests as a business to enable us to do this and you can opt-out of any of these data uses at any time by emailing email@example.com
Pupils on the school roll: If your school is a member of COBIS we may have received your pupil numbers. This is used to calculate your school’s membership fees.
Supporting members: If you or your organisation sign up as a supporting member of COBIS, we will be required to collect the name and contact details of the relevant individuals within the organisation responsible for processing payments and receiving information regarding the benefits we provide to supporting members.
We may collect additional information you volunteer to us when calling our support staff regarding any elements of the membership service. We will only retain the personal information pertinent to delivering your services.
When you engage with our accreditation services
To enable us to run the accreditation processing services we require you to provide contact details for the following individuals. Please note that if you qualify under these headings, we may have received your information from your employing school:
• School administrators
• School staff
This information will be used to undertake the accreditation services the school have requested from us. The information collected will usually be the work contact details of the individuals listed above and those applying for accreditation as well as the payment details of the school to enable us to invoice for our services.
When we perform Safeguarding Services
If you are a teacher (or are intending to become a teacher), if you (or your current employer / future potential employer) engages COBIS to provide its Safeguarding Service, COBIS may use your personal data (which has been provided to COBIS via your current /future / potential employer) to conduct Prohibition Checks on you to verify your suitability for the relevant teaching role. The information that COBIS will process will be: teacher name, teacher registration number, date of birth and whether you have any decision, prohibition, restriction or alert against you in relation to teaching in England.
When you register with COBIS as a Lead Improvement Partner or Peer Accreditor to provide our services
When you register with COBIS to provide our accreditation services, we are required to collect your contact details (as provided by you) to enable us to maintain a list of potential consultants we may engage to issue services to our customers.
We will also have to collect information relating to your professional qualifications and experience (usually in the application information provided to us by you) and any other supplementary information we request that you volunteer to us regarding your skill and suitability for specific roles. We may also record and store your bank details for processing any payments to you.
We will only hold your professional and contact details in line with our retention policies for this class of personal data unless you request otherwise.
When you register for our conferences, webinars, pupil events or training events
If you choose to register as an attendee, delegate, speaker, sponsor, supplier or other partner of COBIS for the purposes of delivering our CPD, conference, training, or other services we will need to collect specific Personal Information from you.
We will always need to receive your preferred contact details to enable us to communicate with you regarding the details of these services and we will notify you at the time that we may contact you regarding future events of this type. you will always receive the option to adjust your preferences for receiving such content at any time.
We collect financial and invoicing information from sponsors and suppliers to provide payment for their services.
We also need to collect additional information from attendees to allow us to cater for dietary requirements. This information is voluntary and allows us to make adjustments to cater for your needs.
It is also necessary for us to collect financial information from attendees to facilitate payment for our services.
If you are a pupil who has been entered into a COBIS student competition or event we may be required to collect passport details to facilitate entry into COBIS games events and other services provided by COBIS. If you provide us with this information we will only use it for the purpose specified on each collection event and will erase the information immediately after we have ascertained the details we need for the purpose specified.
When you use our services or website functionality
We may also collect technical information about you when you visit the Website. This information may include the Internet protocol (IP) address used to connect your computer to the Internet, your browser type and version, time zone setting, operating system and platform, browser plug-in types and version, the full URL clickstream to, through and from the Website, page response times, download errors, length of visits to certain pages, page interaction (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page.
The collected information is used to provide an overview of how people are accessing and using the Website. It is not used for any additional purpose, such as to profile those who access the Website.
When we receive a complaint
If you make a complaint pursuant to our Complaints process, we will use your Personal Data to identify correspondence relating to the matter. Likewise, if a complaint is made about you to COBIS, we will use your Personal Data to identify correspondence relating to the matter. Further information in relation to our Complaints process can be found here.
When you have expressed an interest in or engaged in any of our other our services:
If you have opted in via our website to receive marketing communications from us, we will handle your personal information for example (your name, email address and postal address and telephone number) to provide you with marketing communications and membership information in line with any preferences you have told us about. In this case, we rely on consent.
If you have engaged with COBIS service or support, then we may send you marketing emails that are related to the service or support you have previously engaged in, for this we rely on legitimate interest.
When you apply for an advertised role at COBIS
We will collect personal information from you required to process and validate your application and identity. The information we collect, with whom it is shared and how this is retained depends on the stage of the recruitment process.
We keep the personal information that we obtain about you during the recruitment process for no longer than is necessary for the purposes for which it is processed. How long we keep your information will depend on whether your application is successful and whether you become employed by us, the nature of the information concerned and the purposes for which it is processed.
LEGAL BASIS OF PROCESSING
We will only process your information for as long as we have a relevant legal basis to do so. This is usually in order to provide you with the contractual services you have requested from COBIS and unless stated, all of the above processing is conducted under the legal basis of performance of a contract.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we consider the new purpose to be incompatible with the original purpose of collection, we will conduct a Privacy Impact Assessment or contact you to request your consent for further processing. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at firstname.lastname@example.org
Any consent for processing you provide to COBIS can be withdrawn at any time by contacting the email address above.
SHARING YOUR INFORMATION WITH OTHERS
Please be assured that we will not share your information for any other reason unless we are required by law or permitted to do so under this Privacy Notice. The main circumstances in which we will be permitted or required to disclose this is by law will be by court order, to government bodies and law enforcement agencies. However, sometimes we may share your information with third parties in the following ways:
• we may use carefully selected sub-processors to help us collect, store or manage your information. This will always be managed under the terms of a written data processing agreement;
• we may be required to share personal information with host schools or venues? regarding our attendees at COBIS events;
• occasionally we enter into partnership agreements with other associations to share specified data, which we have a lawful grounds to do so and always under a data sharing agreement, which can be produced to the data subjects in question at anytime.
• analytics and search engine providers that assist us in the improvement and optimisation of the Website; and
• if COBIS is acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets. We process your personal information for this purpose because we have a legitimate interest to ensure our business can be continued by the buyer. If you object to our use of your personal information in this way, the relevant seller or buyer of our business may not be able to provide services to you.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer. We only use (and store) non-essential cookies on your computer's browser or hard drive if you provide your consent.
Please see our Cookies Policy for further information.
WHERE IS MY DATA STORED?
All information you provide to us is stored on our secure servers or those of our third party sub-contractors. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our sites, you are responsible for keeping this password confidential. you must not share your password with anyone.
TRANSFER OF DATA OUTSIDE OF THE UK
We shall not transfer any personal data to any country outside of the United Kingdom unless we ensure that such personal data is subject to an adequate level of protection and appropriate legal safeguards in accordance with Data Protection Legislation.
YOUR RIGHT TO OBJECT UNDER DATA PROTECTION LAWS
You have the right to object to us handling your personal information when:
• we are handling your personal information based on our legitimate interests (as described in the “How do you use my data” section above). If you ask us to stop handling your personal information in this way, we will stop unless we can show you that we have compelling grounds as to why our use of your personal information should continue
• for marketing purposes. If you ask us to stop handling your personal information on this basis, we will stop.
WHAT ARE MY RIGHTS UNDER DATA PROTECTION LAWS?
You can exercise the following rights to your data by contacting us at email@example.com
Right of access
You are entitled to receive confirmation as to whether your personal information is being processed by us, as well as various other information relating to our use of your personal information. you also have the right to a copy of the personal information which we are handling regarding you.
Right to rectification
You have the right to require us to rectify any inaccurate personal information we hold about you. you also have the right to have incomplete personal information we hold about you completed, by providing a supplementary statement to us.
Right to restriction
You can restrict our processing of your personal information where:
• you think we hold inaccurate personal information about you
• our handling of your personal information breaks the law, but you do not want us to delete it
• we no longer need to process your personal information, but you want us to keep it for legal reasons
• we are handling your personal information because we have a legitimate interest (as described in the “How We Use your Data” section above, and are in the process of objecting to this use of your personal information
Where you exercise your right to restrict us from using your personal information, we will then only process your personal information when you agree, except for storage purposes and to handle legal claims.
Right to data portability
You have the right to receive the personal information we hold about you in a structured, standard machine readable format and to send this to another organisation controlling your personal information.
Right to erasure
You have the right to require us to erase your personal information which we are handling in the following circumstances:
• we no longer need to use your personal information for the reasons we told you we collected it for
• where we needed your consent to use your personal information and you have withdrawn your consent
• you object to our use of your personal information and we have no compelling reason to carry on handling your personal information
• our handling of your personal information has broken the law
• we must erase your personal information to comply with a law we are subject to
Right to complain
You have the right to issue a complaint directly with the Information Commissioners Office, the data protection supervisory authority for England and Wales (https://ico.org.uk/concerns/).
CHANGES TO THIS PRIVACY NOTICE
We may change this Privacy Notice at any time to ensure it always accurately reflects the way we collect, use and safeguard your Personal Information.
Please check this notice from time to time to ensure you are aware of any updates we may have made to our Personal Data handling practices. The date of the changes will be listed in the 'Last updated' section below. We will endeavour to notify all of our current service users of any updates to this notice via email and we will post the relevant announcement on our website homepage.
We recommend that you print a copy of this page for your reference.
DATA PROTECTION OFFICER
To ensure we continue to monitor our obligations under Data Protection Legislation, COBIS has appointed a data protection officer (DPO). If you wish to contact the DPO regarding any specific elements of COBIS’s data handling, please send your enquiries for attention of the DPO to firstname.lastname@example.org.
Please contact us at email@example.com if you have any questions, comments or requests regarding this Privacy Notice.
This policy was last updated July 2021