Who we are
Any reference to "we", "us" and "our" is to Christian Schools (Scotland) Limited trading as Hamilton College.
Christian Schools (Scotland) Limited is a registered company in Scotland (registered number SC107480) with registered office at Hamilton College, Bothwell Road, Hamilton, ML3 0AY.
Christian Schools (Scotland) Limited is also an educational charity registered in Scotland (charity number SC006206) with registered office at Hamilton College, Bothwell Road, Hamilton, ML3 0AY.
We are registered on the Data Protection Public Register. Our Data Protection Registration Number is Z7559218. To find out more information about the Data Protection Register, visit the Information Commissioner's Office website at https://ico.org.uk/.
About this Privacy Notice
Your information is very important to us and we look after your information carefully in line with data protection and privacy laws. This Privacy Notice is intended to provide information about how we may use (or ‘process’) personal data about individuals, including staff; current, past and prospective pupils; and parents, carers or guardians of pupils (referred to hereafter as ‘parents’).
By accessing and using our services, you are agreeing to the terms of this privacy notice.
This Privacy Notice applies alongside any other information we may provide about the use of personal data, for example when collecting data via an online or paper form.
This Privacy Notice also applies in addition to Hamilton College’s other relevant terms and conditions and policies, including:
- Any contract between Hamilton College and their staff or parents of pupils
- The Information Security Policy
- The Child Protection Policy
- The Social Media Policy
- The Website Disclaimer
- The Data Retention Periods Table
- Any applicable Acceptable Use Policies
We may update this Privacy Notice at any time and will post any changes on our website at www.hamiltoncollege.co.uk so it's a good idea to come back and read through them again from time to time. This Privacy Notice was last updated on 11 May 2018.
Why we need to process personal data
As part of our daily operations and in order to carry out our ordinary duties to pupils, parents and staff, Hamilton College may process a wide range of personal data about individuals (including current, past and prospective staff, pupils or parents). Some of this activity is carried out so that we can fulfil our legal rights, duties or obligations, including those under contract with staff or parents of pupils. Other uses of personal data will be made in accordance with our legitimate interests, or the legitimate interests of others.
We expect that the following uses may fall within the category of legitimate interests:
- For the selection and admission of pupils;
- The provision of education and related services to pupils, including musical education, physical training or spiritual development, the administration of the school curriculum and timetable, monitoring pupil progress and educational needs, reporting on the same internally and to parents, administration of pupils’ entries to examinations, reporting upon and publishing results and other achievements of pupils, providing references for pupils (including after a pupil has left), careers services and wider-curricular activities;
- The provision of educational support and related services to pupils (and parents) including the maintenance of discipline, provision of careers and library services, administration of sports fixtures and teams, school trips and the provision and monitoring of the school’s IT and communications systems in accordance with our IT policies;
- The safeguarding of pupils’ welfare and provision of pastoral care, welfare and health care services by school and staff and designated visitors/professionals;
- Compliance with legislation and regulation;
- To make use of photographic and video recorded images of pupils internally in school publications, and on the school’s Management Information System;
- Operational management including the compilation of pupil records, the administration of invoices, fees and accounts, the management of Hamilton College’s property, the management of security and safety arrangements (including the use of CCTV), management planning and forecasting, research and statistical analysis, the administration and implementation of the school’s rules and policies for pupils and staff, the maintenance of historic archives and other operational purposes;
- Staff administration including the recruitment of staff/engagement of contractors, administration of payroll, pensions, review and appraisal of staff performance, conduct of any grievance, capability or disciplinary procedures, and the maintenance of appropriate human resources records for current and former staff, including provision of references;
- The promotion of Hamilton College through its own websites, the prospectus and other publications and communications (including through our social media channels);
- Maintaining relationships with alumni and the school community, including direct marketing or fundraising activity;
- To give and receive information and references about past, current and prospective pupils, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend, and to provide references to potential employers of past pupils;
- Where otherwise reasonably necessary for the School’s purposes, including to obtain appropriate professional advice and insurance.
Types of personal data we may process
We process personal data about prospective, current and past pupils and their parents, staff, suppliers and contractors, donors, friends and supporters, and other individuals connected to or visiting Hamilton College.
The personal data we process takes different forms – it may be factual information, expressions of opinion, images or other recorded information which identifies or relates to a living individual. Examples include:
- Names, addresses, telephone numbers, e-mail addresses and other contact details;
- Family details;
- Admissions, academic, disciplinary and other education related records, information about special educational needs, references, examination scripts and marks;
- Education and employment data;
- Images, audio and video recordings;
- Financial information (eg for bursary assessment, fund-raising or about parents who pay fees);
- Courses, meetings or events attended;
- References given or received by us about pupils and staff and information provided by previous educational establishments and/or other professionals or organisations working with individuals;
- Images of pupils (and occasionally other individuals including staff and parents) engaging in school activities, and images captured by the cctv system;
- Where appropriate, information about individuals’ health, and contact details for their next of kin;
- Car details (about those who use the car parking facilities);
As a school, we may also need to process special category personal data (eg concerning physical or mental health, race or ethnicity, sexual life, religion or biometric data) and criminal records information about some individuals (particularly pupils and staff). We do so in accordance with applicable law (including with respect to safeguarding or employment) or by explicit consent.
How we collect, handle and share personal data
We collect most of the personal data we process directly from the individual concerned (or in the case of pupils, from their parents). This may be via an online or paper form, or simply in the ordinary course of interaction or communication (such as email, in writing or simply through verbal discussion). In some cases, we collect data from third parties (for example, referees, previous schools, Disclosure Scotland, or professionals or authorities working with the individual) or from publicly available resources.
Personal data held by us is processed by appropriate members of staff for the purposes for which the data was provided. We take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to school systems.
All personal information you provide to us is stored on secure servers, either on our premises or with a trusted third party. Any online payment transactions will be encrypted using Secure Socket Layer/Transport Layer technology. Where we have given you (or where you have chosen) a password which enables you to access certain services (the School Portal for example), you are responsible for keeping this password confidential. We ask you not to share any such passwords with anyone.
Hamilton College provides its employees with access to various computer facilities for work and communication purposes. In order to ensure compliance with all applicable laws in relation to data protection, information security and compliance monitoring, we have adopted an Information Security Policy, to which all staff and third parties working for or on behalf of Hamilton College are subjected.
Unless we have the explicit consent of the data subject, we will not knowingly transfer personal data outside of the European Economic Area unless we are satisfied that the personal data will be afforded an equivalent level of protection.
Occasionally, Hamilton College will need to share personal information relating to their community with third parties such as the NHS, SQA and legal/government organisations. For the most part, personal data collected by the school will remain within the schools and will only be processed by appropriate individuals in accordance with access protocols (i.e. on a ‘need-to-know’ basis). Particularly strict rules of access apply in the context of:
- medical records held and accessed only by appropriate medical staff or those under their supervision, or otherwise in accordance with express consent; and
- pastoral or safeguarding files.
However, a certain amount of relevant information for any pupil with Special Educational Needs (SEN) will need to be provided to staff more widely in the context of providing the necessary care and education that the pupil requires.
Staff, pupils and parents are reminded that the Hamilton College is under duties imposed by law and statutory guidance, including that set out in the Children’s Hearings (Scotland) Act 2011 (implemented in 2013), the National Guidance for Child Protection in Scotland 2014 and the Children and Young People (Scotland) Act 2014, to record or report incidents and concerns that arise or are reported to them, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness in their nature or regularity. This is likely to include file notes on personnel or safeguarding files, and in some cases referrals to relevant authorities.
In accordance with Data Protection Law, some of the school’s processing activity is carried out on their behalf by third parties, such as IT systems, web developers or cloud storage providers. This is always subject to contractual assurances that personal data will be kept securely and in accordance with the relevant legal guidelines.
In some cases we may disclose information about you with select third-parties, such as:
- Debt collection agencies where you have breached a condition of any contract entered between us and you;
- If we or substantially all of our assets are acquired by a third party, in which case personal information held by us about you may be one of the transferred assets;
- If we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce any agreements with you, or to protect our rights, property, or safety of our pupils, our employees, or others;
- We may also anonymise and aggregate your information with other users (for example, we may track that 500 men aged under 20 have clicked on a specific page on our website on any given day). We may use such aggregate and anonymised information to help reach a particular target audience or understand who uses our site.
We will never sell your personal information to third parties for any purpose.
How long we keep personal data
Depending on how you engage with us and the nature of the information it may be necessary for us to store your personal data for shorter or longer periods of time. Either way, we will only store your personal information for a legitimate and lawful reason and only for as long as is necessary.
Typically, the legal recommendation for how long to keep ordinary pupil records and staff personnel files is up to 7 years following departure from the school. However, legal and/or operational requirements will often mean it is appropriate to retain some information for longer or shorter periods of time. Hamilton College have thought very carefully about the different types of data that we may retain at different times and for different purposes. We want be transparent about how long we expect to retain personal data and to this end have collated a list of the different data types and their associated retention periods here for your convenience. We will endeavour to keep this list accurate and up to date.
A limited and reasonable amount of information will be kept for archiving purposes. Where you have requested we no longer keep in touch with you this may also include a record of this fact in order to fulfil your wishes.
Keeping in touch and supporting us
Hamilton College will use the contact details of parents, alumni and other members of the school community to keep them updated about our activities, or alumni and parent events of interest, including by sending updates and newsletters, by SMS, email and by post.
Individuals have various rights under Data Protection Law to access and understand personal data about them held by Hamilton College, and in some cases, ask for it to be erased or amended or have it transferred to others, or for Hamilton College to stop processing it - but subject to certain exemptions and limitations.
Any individual wishing to access or amend their personal data, or wishing it to be transferred to another person or organisation, or who has some other objection to how their personal data is used, should put their request in writing to the Data Protection Team using the details provided in the ‘Contact Us’ section at the bottom of this policy.
We will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within the statutory time limits (30 days in the case of requests for access to information). Any information released to the requestor may be in hard copy or digital form, depending on the nature of the data. Hamilton College have full discretion as to the format in which the information is released.
We will be better able to respond quickly to smaller, targeted requests for information. If the request is manifestly excessive or similar to previous requests, we may ask you to reconsider or even refuse the request, where Data Protection Law allows it.
Please be aware that, even if we receive a request from you to delete your personal information, it may be that we cannot entirely remove all of it. This is usually because we have a legitimate interest to hold onto some of that personal information, for example, if you have an ongoing contract with us, there are outstanding payments due by you to us, the personal information relates to a third-party such as a pupil who attends our school, or we have a legal obligation to retain some or all of your personal information – but we’ll let you know.
If you previously consented to us collecting and/or processing your personal information but you change your mind this is not a problem - simply get in touch with us to let us know and we will take the necessary steps to update our systems.
Access to information and limitations
You should be aware that the right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information which identifies other individuals (and parents need to be aware this may include their own children, in certain limited situations – please see further details below), or information which is subject to legal privilege (for example legal advice given to or sought by the school, or documents prepared in connection with a legal action). With this in mind, in many cases we may be required to redact some of the documentation that you receive in order to comply with the legislation.
Hamilton College is not required to disclose any pupil examination scripts (or other information consisting solely of pupil test answers), provide examination or other test marks ahead of any ordinary publication, nor share any confidential reference given by for the purposes of the education, training or employment of any individual.
Sometimes, we will have compelling reasons to refuse specific requests to amend, delete or stop processing your (or your child's) personal data: for example, a legal requirement, or where it falls within a legitimate interest identified in this Privacy Notice. All such requests will be considered on their own merits.
In order to obtain a copy of any personal data we hold on an individual, a request must be submitted to the Data Protection Team – details on how to get in touch with them can be found at the bottom of this page.
Additionally, we can’t just release your personal information to anyone. We can only release your personal information to you or an authorised third party who can demonstrate that you consented to have your personal information released – this is a legal requirement. Therefore, it is important for us to ensure that we confirm your identity before we can release any personal information.
If you send us a request to provide you with a copy of your personal information then we may ask you to provide some identification. We may ask you to provide a copy of your current and valid passport and/or driving license plus a utility bill (that is no more than 3 months old and has your current address). We may also ask you to visit one of our offices or obtain a solicitors or notary publics’ confirmation of your identification.
All of this might sound very onerous but please understand that we have an obligation to protect your personal information and we need to be certain that it is being released to the right person.
Requests for Pupil Information
The rights under Data Protection legislation belong to the individual to whom the data relates. However, we will often rely on parental consent to process personal data relating to pupils (if consent is required) unless, given the nature of the processing in question, and the pupil's age and understanding, it is more appropriate to rely on the pupil's consent.
Parents should be aware that in such situations they may not be consulted, depending on the interests of the child, the parents’ rights at law or under their contract, and all the circumstances.
In general, we will assume that the pupils’ consent is not required for ordinary disclosure of their personal data to their parents, e.g. for the purposes of keeping parents informed about the pupil's activities, progress and behaviour, and in the interests of the pupil's welfare, unless, in the school's opinion, there is a good reason to do otherwise.
However, where a pupil is over the age of 12 and seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, we may be under an obligation to maintain confidentiality unless, in our opinion, there is a good reason to do otherwise; for example where the school believes disclosure will be in the best interests of the pupil or other pupils, or is required by law.
Pupils over the age of 12 can make subject access requests for their own personal data, provided that they have sufficient maturity to understand the request they are making. Our Senior School pupils are generally assumed to have this level of maturity. The information relating to the child in question is always considered to be the child’s at law. For this reason, any subject access relating to a child over the age of 12 should be made by the child themselves, or with the child’s permission, by a parent or other representative acting on the child’s behalf, although in this circumstance evidence as to the child’s consent must be provided.
Data Accuracy and Security
An individual has the right to request that any out-of-date, irrelevant or inaccurate information about them is erased or corrected (subject to certain exemptions and limitations under Data Protection Law).
Hamilton College will endeavour to ensure that all personal data held in relation to an individual is as up-to-date and accurate as possible. This is why all parents/pupils are sent an annual update form. Individuals must notify the school of any significant changes to important information, such as contact details, held about them. Please let us know of any changes to your details as soon as possible using the provided links on the School Portal or by contacting us directly on:
Or you can let us know by telephoning 01698 282700. You can do this at any time.
Hamilton College will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including implementing policies around the use of technology and devices, and access to school systems. All staff and governors will be made aware of these policies and their duties under Data Protection Law and will receive relevant training.
If you opt-in to receive information about us, then depending on what personal information we hold about you, we may decide to contact you via e-mail, SMS, telephone or post.
Depending on the nature of the communications, you may opt-in to receive general school information or we may ask you to opt-in on a case-by-case basis. We will do our best to let you know what method or methods of communication we will use. Depending on the nature of the communication we will try to give you the ability to select how you would like to be contacted but this might not always be possible due to technical issues. Don’t forget, you can always opt-out from receiving communications from us.
If you opt-in to receive communication then we may need to pass your personal information to select third parties who are responsible for facilitating communication with you on our behalf. For example, we may need to pass some of your personal details if you wish to be contacted via SMS because we need to partner with a third party in order to provide you with this service. Don’t worry though, if we do this we only pass on data that is necessary for us to use these services effectively, which is limited to:
- Names, email addresses and pupil year groups for direct email communications
- Names and addresses for direct mailings by post
- Names, mobile phone numbers and pupil year groups for SMS messaging
The purpose of opting-in to receiving communications from us is to help us better understand you, engage with you, share details about the school, and to assist us in providing the types of communications that you wish to receive from us. We will not knowingly sell your personal information for marketing purposes or pass your personal information to third parties.
If you are receiving communications from us in error or you have opted-out then please get in touch with us and we apologise for any inconvenience caused.
This Privacy Notice has been prepared with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of our collection and use of your personal information. However, we are happy to provide additional information or explanation if needed.
If you have any questions, comments or requests regarding our Privacy Notice or any aspect of data protection then please do not hesitate to get in touch with us. To make things easier for both of us we would appreciate it if your queries were addressed:
or by writing to:
Hamilton College, Bothwell Road, Hamilton, ML3 0AY, United Kingdom
If you are not satisfied with the way that we have handled any of your requests or queries relating to our use of your personal data then you can contact the Information Commissioner’s Office at https://ico.org.uk/ The Information Commissioner’s Office is the statutory body responsible for overseeing data protection legislation and law in the United Kingdom.