PRIVACY NOTICE
- Introduction
1.1 The Independent Schools' Bursars Association (ISBA) supports and advises the bursars and senior management staff of more than 1000 independent schools across the UK and overseas. Our services are designed to assist school staff in the successful administrative, financial and operational management of their school, in particular through their membership of the ISBA (Members/Membership).
1.2 This Privacy Notice (Notice) explains how ISBA collects, uses and discloses your personal data, and your rights in relation to the personal data it holds.
1.3 ISBA may change this Notice from time to time. However, any major changes will be notified directly to those affected wherever practicable. This Notice is effective from February 2021, when it was last updated. - Data controller
2.1 ISBA is the data controller of your personal data and is subject the Privacy and Electronic Communications Regulations 2003, the UK GDPR and the UK Data Protection Act 2018 and any successor legislation. This privacy notice also covers the data processing activities of ISBA Enterprises Limited (company number 04334495) which is a wholly owned trading subsidiary of ISBA.
2.2 In this Notice, us, we and our all refer to the ISBA and ISBA Enterprises Limited. - Contact details
3.1 If you have any questions about how we use your personal data, or you wish to exercise any of the rights set out above, please contact us below by using the following details:
3.1.1. By post - Privacy Officer, ISBA, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.
3.1.2 By email - johnmurphie@theisba.org.uk
3.1.3 By telephone - 01256 330369
- How we collect your data
4.1 We may collect your personal data in a number of ways, for example:
4.1.1 From the information you provide to us when you meet with one of our employees or representatives;
4.1.2 When you communicate with us by post, telephone, fax, email or other forms of electronic communication;
4.1.3 When you complete (or we complete on your instructions) conference, seminar or training booking forms, an ISBA Business Directory application or reference, or webinar registration forms;
4.1.4 When you (or your school bursar) completes an ISBA Membership application form;
4.1.5 When you provide delivery and subscription details for the ISBA magazine, The Bursar's Review;
4.1.6 When you make an enquiry via the ISBA website or contribute to online forums;
4.1.7 When you provide bank details by cheque, BACS, direct debit form or over the telephone in relation to ISBA membership or our products and services; and
4.1.8 When you complete our surveys and questionnaires including at an event. - The categories of the data we collect
5.1 We may collect the following categories of personal data about you:
5.1.1 Your name, job title, qualifications, and contact information such as address, email address and telephone number;
5.1.2 A record of your ISBA Membership, where applicable;
5.1.3 Bank details and other financial information;
5.1.4 A client reference if you have submitted an ISBA Business Directory application;
5.1.5 Technical information collected through the use of cookies about your use of the ISBA website including details of your domain name, location and internet protocol (IP) address, operating system, browser version, the content you view, and how long you stayed on a page. For full details, see our Cookies Notice which is available at www.theisba.org.uk/cookie-usage-for-this-website.aspx;
5.1.6 Information concerning your engagement with the ISBA, including records of communications between you and us (including details contributed to online forums) and your attendance at ISBA events, seminars and meetings (including images and audio/video footage); and
5.1.7 Your opinion and feedback in relation to any ISBA surveys or questionnaires that you complete such as feedback on our seminars and events.
- The basis for processing your data, how we use that data and with whom we share it
Where we have a contractual relationship with you
6.1 We may process your personal data because it is necessary for the performance of a contract to deliver the services you have engaged us for, including under the terms of ISBA Membership, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following:
6.1.1 To correspond with you about services, including subscriptions and event details, that you have requested from us;
6.1.2 To process applications you have made to attend an ISBA event and provide you with the services you have requested;
6.1.3 To maintain internal records of ISBA Membership, and enquiries about Membership; and
6.1.4 If you are an ISBA Member, to send you expected Membership benefits or subscriptions, and keep you informed with updates relevant to governance and administration of your ISBA Membership. This will include forthcoming events and new resources, news we consider is relevant to Members or other recipients, and administration or renewal of your Membership.
6.2 In this respect, we may also provide your personal data to the following (but only for purposes connected with our fulfilling contracts with you):
6.2.1 Third party service providers who we may engage to assist in delivering the services to you: for example, conference and seminar organisers, speakers and instructors;
6.2.2 Our bank to whom payment details are provided in order to process a payment;
6.2.3 Our website provider, who may store details such as name and email address to enable member login;
6.2.4 Our professional advisers where it is necessary for us to obtain their advice or assistance, or if you have specifically requested your details or queries are passed on to our professional advisers as part of our fulfilling a Member request (but otherwise advice requests are by policy carried out without identifying you or your school);
6.2.5 Professionals who assist us in putting together, printing and delivering the ISBA magazine, The Bursar's Review; and
6.2.6 Our IT support and any data storage provider.
Legal obligations and legitimate interests
6.3 We may process your personal data because it is necessary for our or a third party's legitimate interests. This will always be weighed against your rights, interests and expectations.
6.4 Examples of where we process personal data in accordance with our legitimate interests include:
6.4.1 processing technical information about your use of the ISBA website to ensure that content on our site is presented in the most effective manner;
6.4.2 processing enquiries, complaints and analysing our services;
6.4.3 sharing attendees of our events' name, position and school with other attendees, sponsors and exhibitors (for example, when creating and sharing a delegate list);
6.4.4 obtaining a client reference to support an application for the ISBA Business Directory;
6.4.5 researching our market, including being aware of appointments and changes in position at schools (whether or not ISBA Members); and
6.4.6 marketing our goods, services, events and resources by post, telephone and electronic mail - except where we provide material directly to our Members or others under contract, or in situations where it is required or appropriate to seek your specific consent.
6.5 We may also process your data for our compliance with our legal obligations. In this respect we may use your personal data to comply with subject access requests of others, tax legislation, safeguarding requirements, for the prevention and detection of crime, and in order to assist the police and other competent authorities with investigations (including criminal investigations).
Consent
6.6 In some circumstances the ISBA may seek your specific consent to process your personal data: for example, if we wish to use your likeness or an attributed quote in our marketing materials, or if we wish to name you as part of an article or case study for use in our materials, including for example, in The Bursar's Review.
6.7 ISBA Members primarily receive communications as part of their Membership, which in accordance with your Membership rights may include information about ISBA resources, services and events. However
6.7.1 if you are not an ISBA Member; or
6.7.2 if you are a Member but we wish to process your data for a purpose that falls outside your Membership,
then we may also request your consent to process your personal data in this way. An example may be in order to provide you with information of a marketing nature (whether concerning the ISBA or a third party) to your personal email account, if you have provided your email address for those purposes.
6.8 If you have given your consent and you wish to withdraw it, please contact us using the contact details at section 3.1 above. Please note that where our processing of your personal data relies on your consent and you then withdraw that consent, we may not be able to provide some aspects of our services to you. Equally, where our processing of your personal data does not rely on your consent, we may not be able to fulfil your request (please see Your Rights section below).
7 Profiling
We may use personal characteristics such as role, your expressed interests, your previous interactions with ISBA or geographical location to target our communications to a specific audience. If you wish to tailor the communications you receive from us then please contact us using the details provided at section 3.1 above.
8. Retention of your data
8.1 We may retain your personal data only for so long as is necessary to deliver our services to you, and to protect our legal interests (for example where required by relevant authorities, or for a reasonable legal limitation period after we have ceased providing services to you) or as otherwise stated to you when your data is collected.
8.2 We may keep certain limited details about you for longer for archiving or statistical purposes, or for suppression purposes (if you have requested not to hear from us). If you have any query about retention of your data, please see Your Rights below.
9 Your rights
9.1 You have the following rights:
9.1.1 To require us not to send you marketing communications;
9.1.2 To obtain access to, and copies of, the personal data that we hold about you;
9.1.3 To request that we erase your personal data;
9.1.4 To request that we restrict our data processing activities in relation to the personal data that we hold about you;
9.1.5 To receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller; and
9.1.6 To require us to correct the personal data we hold about you if it is inaccurate.
9.2 Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply: for example, if we have reason to believe the personal data we hold is accurate or we can show our processing is necessary for a lawful purpose set out in this notice.
9.3 You can find out more about your rights under data protection legislation at www.ico.org.uk.
9.4 If you are not satisfied with how we are processing your personal data, you can make a complaint to the supervisory authority, which in the UK is the Information Commissioner's Office (www.ico.org.uk).
February 2021