Privacy Notice

Wolsey Hall Privacy Notice

This Notice sets out how Wolsey Hall Oxford International Ltd, trading as Wolsey Hall for Schools, (the “Company”) collects, uses, processes and shares personal information of students when you use our website and services. This Global Privacy Notice (“Notice”) explains how we manage and protect your personal data (referred to as “data”) when you visit our website (“Visitor”) or use our services either as a representative of a School to which we provide services (“School User”) or a student or parent of a School which uses our services (a “Service User”). If you are a Service User, for the majority of personal data we process about you, we are a processor and act on your School's behalf and as directed by them. We recommend that you review your School’s privacy notice to understand how your School manages your personal data.

This Notice tells you who we are, what data about you we collect in connection with our website and services, and what we do with it. This Notice is subject to regular updates and significant changes will be communicated to Users.

Who are we?

Wolsey Hall for Schools (“Wolsey Hall”, “we”, “us”) has a mission to provide high-quality education to students wherever they happen to be in the world at a time and pace which suits their individual needs. For more information about Wolsey Hall for Schools please visit our website https://www.wolseyhallforschools.org.uk, which sets out our services (“Services”).

Details of how to contact us if you have questions can be found below.

What data about you do we collect?

We use several types of data about you for purposes connected with the management of our website or the delivery of our Services.

Visitor

We may collect and process the following information about you in order to provide you with our website or Services:

• We will collect and process the information you provide to us if you register for a demonstration, blog, or webinar, which includes your name, email address, phone number, School name, information regarding the curriculum your School offers, and other information collected to provide the website or Services. We will also process your name and email address to send you email messages about our newsletters, product updates and other marketing materials. We will only send you such email messages as permitted under applicable law and in line with your marketing preferences which you can update at any time as described below.
• We will collect information through cookies, including analytics information about your use of our website and information about your device, internet connection, browser, location, page, and search terms used, etc. Learn more about how we use cookies and similar technologies in our Cookie Policy.

School User

We may collect and process the following information to provide your School with our Services:

• your name, title, business telephone number, details about the School you represent, details about your position at the School (eg subjects you teach or how long you have worked at the School) and email address used during our registration process in order to communicate with you in relation to the provision of Services to your School.
• responses to our surveys you choose to take.
• your email address to send email marketing to you, including our newsletters and updates as permitted under applicable law and in line with your preferences.
• details of your interactions with us when you contact us with enquiries through our online customer support or via telephone or email.

Service User

We may collect and process the following information:

• information captured in your student account, provided by you or your parents or your School including information such as your name, email address, nationality, date and place of birth, gender, language, and parents’ names and contact details, in order to conduct statistical analyses for our own reporting.
• email address to request survey responses or feedback from you.
• feedback and responses to our surveys you choose to take.
• details of your interactions with us when you contact us with enquiries through our customer support system online, or via telephone or email.

For what purposes do we use data about you, and on what legal basis?

Throughout your use of our website and/or our provision of Services to you or a School, we use data about you for various purposes. The purposes for which we use data about you, with corresponding legal basis for use, are set out below: 

Visitors

School Users

Service Users

Please note that we do not process any special category data about Service Users (eg information on race or ethnicity) for our own purposes. You may be requested by your School to provide such information which may be passed to us for processing, but we do not use it for any other purpose.

In some instances, we may use your personal data in ways not described above. Where this is the case, we will provide a supplemental privacy notice that explains such use and consent if required. You should read any supplemental notice in conjunction with this Notice.

Who do we share your data with, and for what purposes?

We share data within our parent group, Faria Education Group, for various purposes such as:

• Customer support activities (eg our online support or contacting us via our email or telephone) may be undertaken by colleagues in the UK.
• Management of our services (eg bulk process requests, importing curriculum standards, importing users) may be processed in the UK or India.
• Billing inquiries (eg receiving a purchase order, handling invoices, etc) will be processed by our offices in the UK.
• System usage and platform hosting for the group is cloud-based in the UK, USA, Taiwan and Hong Kong, and data centres in Canada, USA Hong Kong, Singapore, Ireland, and UK. We ensure that appropriate data transfer mechanisms to protect School personal data are always implemented.

Sharing data with third parties

• We ensure that appropriate data transfer mechanisms to protect School personal data are always implemented. If data is transferred to third parties outside the EU, this is based on a European Commission adequacy decision, Binding Corporate Rules, or the EU Model Clauses (Standard Contractual Clauses). End user data (parent, student, and teacher) is not transferred outside of the EEA at any point except in specific circumstances when using some Subprocessors. These transfers are covered in the data processing agreements and are subject to appropriate safeguards as per the UK GDPR and DPA 2018. Data transfers to the US require Standard Contractual Clauses.
• We may share data about Service Users with education partners, such as exam awarding bodies for exam registration, or integration partners, such as other school systems providers.
• We may share data about you with our third-party service providers, such as IT providers or customer support services.
• We may share anonymised data, feedback, and survey results with third-party service providers, such as other school systems for research purposes.
• We may share data about you with other third parties, where required or permitted by law, for example: regulatory authorities; government departments; in response to a request from law enforcement authorities or other government officials;
• We may share data when we consider disclosure to be necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal purpose; and
• We may share data in the context of organisational restructuring.

If you would like to learn more about the parties with which we share data, please contact us using the details below at: Who should you contact with questions?

Where might your data be processed?

As a result of the global nature of our Services, we are often required to transfer data internationally as described above. We always ensure that any such transfers are carried out in compliance with applicable data protection laws and with appropriate safeguards in place.

For transfers subject to EU GDPR, this may include:

• an adequacy decision from the European Commission,
• the European Commission’s Standard Contractual Clauses (SCCs, 2021), or
• approved Binding Corporate Rules (BCRs).

For transfers subject to UK GDPR, this may include:

• an adequacy regulation from the UK Government,
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, or
• approved Binding Corporate Rules (BCRs).

Where we transfer personal data to the United States, this will be on the basis of the EU–US Data Privacy Framework (for EU GDPR), the UK-US Data Bridge (for UK GDPR), or appropriate contractual safeguards.

Wolsey Hall in the United Kingdom is registered with the ICO and any transfers to our internal group offices are governed by Binding Corporate Rules or standard contractual clauses.

How do we protect your data?

We implement appropriate technical and organisational measures to protect personal data that we hold from unauthorised disclosure, use, alteration, or destruction. Our standard protocols include:

Application security: traffic encryption, strongly hashed passwords, multifactor authentication, safeguards against vulnerabilities such as cross site scripting, SQL injections, phishing, and others.

Network security: firewalls and systems to detect suspicious behaviour, stop malicious attempts to gain access, or compromise the resilience of the service (e.g. DDOS attacks).

Organisational security: access policies, audit logs, risk assessments and confidentiality agreements.

How long will data about you be kept?

The period for which we may retain data about you will depend on the purposes for which the data was collected, whether you have requested the deletion of the data, and whether any legal obligations require the retention of the data (for example, for regulatory compliance).

We will not retain data about you for longer than is necessary to fulfil the purposes for which the data was collected.

What rights do you have over your data?

Depending on where you are resident, you may have some or all of the following rights under applicable law in respect of data about you which we hold:

• request us to give you access to it, and have us provide you with a copy of any data we hold about you
• request us to rectify or update it
• request us to erase it in certain circumstances
• request us to restrict our using it, under certain circumstances
• object to our using it, in certain circumstances
• withdraw your consent to our using it, where our processing is based on consent
• data portability, in certain circumstances
• opt out from our using it for email marketing. You may opt out by clicking on the unsubscribe link in the email marketing messages we send you or by contacting us as set out below and we will always comply with this request; and
• lodge a complaint with the supervisory authority in your country (if there is one).

You can exercise these rights, or learn more about them, by contacting us using the details below at: Who should you contact with questions?

We may be required to confirm your identity before we act on any request from you in connection with your data. This may involve asking you to provide identification documents.

Who should you contact with questions?

For any data compliance or data privacy questions, please contact our Data Compliance Officer at dataprivacy@wolseyhalloxford.org.uk

If you have any GDPR questions, or wish to exercise any of your rights, you can also contact our external Data Protection Officer SchoolPro TLC at GDPR@schoolpro.uk

If your country has a relevant (data protection) supervisory authority, you have a right to contact it with any questions or concerns. If we cannot resolve your questions or concerns, you also have the right to seek judicial remedy before a national court. 

Additional Information for Schools we work with

This Notice provides an overview of how Wolsey Hall processes personal data in connection with the website and Services we provide to Schools. For Schools we work with, additional data protection provisions (including details of roles, responsibilities, subprocessors, and international data transfer mechanisms) are set out in the Data Processing Agreement (DPA) between Wolsey Hall and the School.

If you would like a copy of the DPA Addendum, Appendix or Subprocessor list, please contact us at: dataprivacy@wolseyhalloxford.org.uk

Changes to this notice

We may update this Notice (and any supplemental privacy notice) from time to time, as shown below. We will notify Users of the changes where required by applicable law to do so.