Attention: You are using an outdated browser, device or you do not have the latest version of JavaScript downloaded and so this website may not work as expected. Please download the latest software or switch device to avoid further issues.
This Policy was last updated in January 2025. Currently under review.
1. WHO WE ARE
1.1 St Paul’s Girls’ School (the school) is a company limited by guarantee (company number 6142007, registered charity 1119613). We take our responsibilities as a data controller seriously, and we are committed to processing your personal data in accordance with the law.
The school Privacy Notice is available on our website www.spgs.org/privacy-notices and applies to staff, parents, students (including former students) and any other person whose personal data we may process. It should be read in conjunction with this Notice, the purpose of which is to explain in more detail how the Development Office stores, manages and protects your personal information. The Development Office is part of the school, which means that the school is ultimately responsible for how the Development Office uses your information.
1.2 If you have any questions about this Privacy Notice or on how we use your personal data, please contact the Bursar at the School (see section 8 ‘Contacts’).
2. WHO THIS PRIVACY NOTICE APPLIES TO
2.1 This notice applies to current students, students who have left the school and become an alumna (some may have registered on our alumnae database), parents (both current and former) and all supporters of the school.
3. WHY WE PROCESS PERSONAL DATA ABOUT YOU
3.1 In order to carry out its day-to-day operations and duties, the school processes a wide range of personal data. The legal basis for this is outlined in the School Privacy Notice. This section explains why the Development Office processes personal data.
3.2 The Development Office supports the school through the creation of meaningful relationships with alumnae, students, parents (both current and former) and supporters of the school. We do this by offering a range of educational, social and networking events, producing publications, and through the alumnae network providing careers advice for current and former students. We also fundraise to support the school’s bursary fund, capital projects and other initiatives in accordance with the Fundraising Promise1 and the Fundraising Code of Practice2. We use your personal information to ensure we contact you in the most appropriate way, to improve our offering and to ensure we work efficiently and effectively.
3.3 In many cases, we are processing your personal information because you have asked us to keep you in touch about our activities. Sometimes we also ask you for specific consent, for example to check that you want to receive information from us by email.
3.4 We also expect that use of your personal data is in accordance with the school’s legitimate interests. For example, we expect the following to fall within our legitimate interests:
4. TYPES OF PERSONAL DATA WE PROCESS AND HOW IT IS OBTAINED
4.1 In addition to other school databases, the Development Office has a separate database from the other departments at the school. This database contains personal information collected by the school during the course of our relationship with students, alumnae, parents, supporters and friends. Please refer to paragraph 5.1 for other school departments that have access to this database.
4.2 Information we hold includes; personal contact details, date of birth, details of when you attended the School, information about your occupation and professional interests and where you went to University, your relationship with other members of the alumnae community, records of donations, bank details for the purpose of processing donations, records of your engagement with the school community and events, photographs from events and relevant information about your time at the school and subsequent education.
4.3 Most of the information we hold is obtained directly from you, for example information that you provide on entry to the school. When students leave, they can provide additional contact details (such as their home email address) and can register on our alumnae database. We also collect personal data from you when you participate in events and activities or donate to the school. When students are in the Senior school and before they leave, they will be given more information about how we use and manage their personal data after they have left. We also obtain personal data about you from third party payment processing organisations, such as Paypal and CAF, when you make donations to the school through them.
4.4 We do not use third-party companies to research or profile, but we may analyse publicly available information about potential donors to contact you about initiatives and events that may interest you, or to make appropriate requests. This includes information on professional social media networks such as LinkedIn.
4.5 As a charity, we may have to carry out due diligence regarding any generous donations which you make to the school. This may involve obtaining and recording your personal information from sources such as 192.com, LinkedIn, the Charity Commission, Business Week and related media articles.
5. ACCESS TO PERSONAL DATA AND WHO WE SHARE IT WITH
5.1 For the most part personal data collected by us will remain within the school and will be shared with other departments in the school for specific purposes (e.g., to organise a careers networking event, to ask a former student if they wish to speak at a school event, or for financial reporting).
5.2 An exception to this is the alumnae online platform – OP Connect, which is operated by Graduway, a business of Headhunter Systems Ltd. This is an online directory where users from within the OP community can view the profile entry for other OPs and make contact with one another. We will provide students with details as to how they can register on this platform when they enter the sixth form. Each user controls the amount of personal data included in their profile entry and can set their own privacy limits. Graduway is the data controller for any personal data processed on OP Connect. We share with Graduway our lower 6th names, school email addresses and year group for the purpose of enabling Graduway to verify an account when it is registered by a student.
5.3 We may have to share personal data with government authorities such as HMRC.
5.4 Some of our processing activity is carried out on our behalf by third parties such as database providers, online payment platform providers, web developers and event booking platforms. This is subject to contractual assurances that personal data will be kept securely
and only in accordance with the school’s agreement and/or specific direction. We would never sell your data to a third party. A third party may also pass on, or contract with, a sub-processor. This would only be with our prior authorisation and under a written contract that contained appropriate data protection safeguards
6. HOW LONG WE KEEP PERSONAL DATA
6.1 The School retains personal data in accordance with retention guidelines for the sector. Please see the School Privacy Notice (www.spgs.org/privacy-notices).
6.2 The Development Office will keep information about you as long as we have a legitimate or legal reason to do so. We have retention protocols so that we don’t keep information unnecessarily. We will take reasonable steps to ensure that the information we hold about you is up to date, reasonable and relevant.
6.3 We retain details of our former students indefinitely so that we can communicate with you as part of our alumnae community. You may change your contact preferences at any time (see Your Rights below). We may also need to keep a record if you tell us that you do not want to hear from us anymore, so that we do not inadvertently add you to our mailing list in future.
7. YOUR RIGHTS
7.1 Please also refer to the School Privacy Notice for more information on the individual’s rights under Data Protection Law (The UK General Data Protection Regulations and the Data Protection Act 2018 as amended on 01 January 2021).
7.2 You can tell us at any time that you do not wish to receive fundraising or other information promoting our activities and events. You can also change your communication preferences by contacting us or by following the online link in the communications we send to you.
7.3 Consent: you have the right to withdraw consent where given. You can do so by contacting the Development Office (contact details below). Please be aware that we may not be relying on consent to process your data but may have another lawful reason to process the personal data in question even without your consent.
7.4 Access: you have the right to access and understand personal data held about you, and in some cases ask for it to be erased or amended or have it transferred to others, or for the school to stop processing it – but subject to certain exemptions and limitations. If you wish to access or transfer data to another person or organisation, or you have another objection to how your personal data is used, please put your request in writing to the Bursar (see contact details below).
7.5 The School will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time-limits (which is usually one month in the case of requests for access to information).
7.6 The School will be better able to respond quickly to smaller, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, the school may ask you to reconsider, or require a proportionate fee (but only where Data Protection Law allows it).
7.7 Accuracy: we will take reasonable steps to keep information we hold about you up to date and as accurate as possible. You can ask us to erase or correct any out of date, irrelevant or inaccurate information we hold about you (subject to certain limitations and exemptions under Data Protection Law). Please contact the Development Office if you want to amend your personal information.
7.8 You may have heard of the "right to be forgotten". However, we will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing your personal data: for example, a legal requirement, or where it falls within a legitimate interest identified in this Privacy Notice. All such requests should be made to the Development Office (contact details below) and will be considered on their own merits.
8. THIS PRIVACY NOTICE
8.1 We will review and update this Privacy Notice from time to time. Any substantial changes that affect how we process your personal data will be provided to you directly as far as is reasonably practicable.
8.2 If you believe that the school has not complied with this Privacy Notice or acted otherwise than in accordance with data protection law, you should email bursar@spgs.org with details of your complaint. The school will acknowledge your complaint within 30 days of receipt and will investigate and inform you of the outcome of your complaint without undue delay (keeping you informed of progress as necessary).
8.3 You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with the organisation before involving the regulator.
9. CONTACTS
St Paul's Girls' School Brook Green London W6 7BS
Development office: development@spgs.org
Bursar: bursar@spgs.org
ICO: www.ico.org.uk Helpline: 0303 123 1113