Ellingham C of E Aided Primary School - EIA Addendum to Risk Assessment

1. Introduction

1.1. We are committed to safeguarding the privacy of the users of our services. Our services include and will hereby be referred to as 'Our Services' (our websites used to promote eSchools services and tutorial resources, specifically https://www.eschools.co.uk and https://academy.eschools.co.uk), 'School Websites' ( designed by eSchools and populated by individual schools themselves) and 'Platforms' (individual online services that provide teachers, learners, parents and governors with information, tools and resources) as well as our smartphone app. This policy sets out how we will treat your personal information across these services.

2. Collecting personal information on Our Services

2.1 We may process or temporarily store the following kinds of personal information:
- information about your computer and about your visits to and use of Our Services (including but not limited to, your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths)
- information contained in or relating to any communications that you send to us or send through our website (including, the communication content) via online forms
- any other personal information that you choose to send to us via online forms
- manually inputted details of users added to the platform
- details of users as integrated by our providers at Wonde via your MIS (if applicable to your package). For further information on integrated data please see our Data Sharing Agreement
2.2 Before you disclose to us the personal information of another person, you must obtain that person's consent to both the disclosure and the processing of that personal information in accordance with the terms of this policy.
2.3 eSchools websites may request cookies to be set on your device. We use cookies to let us know when you visit our websites, how you interact with us and to enrich your user experience. You can adapt your cookie preferences, although please note that blocking some types of cookies may impact your experience on our websites and the services we are able to offer. We will not, without your express consent, supply your personal information to any third party for the purpose of their or any other third party's direct marketing. For further information on how you can manage and set your cookie preferences, please see our Cookie Policy.
2.4 Information submitted through the online contact form on a school website is processed via eSchools, and passed directly to the school in question. This data is held by eSchools for 30 days (or in the case of failed messages, 90 days) before deletion. Once passed to the school this data is held by them and subject to that school’s privacy policy.
2.5 Schools are also able to add analytics tools and can therefore gather information on visits to and use of their website (including but not limited to, IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths). Individual visitors can manage their preferences through cookie preferences, as mentioned in 2.4.
2.6 Session IP addresses are retained to monitor and safeguard against improper usage of our services.
2.7 Content on the platform (added by staff, governors and students) and website content is added directly by School Users. This information is only used for to display on the platform in the way the user intends and is not used for any other purposes by eSchools. At a time when a school ceases to use our services the content is removed within a 14 day period as detailed in our agreement with the school.
2.8 Some of our services require the school to provide access to information they require for use with those services. For example a school using our communication tool, Letters Home, which enables schools to contact parents by email regarding important school information. In this situation a school will provide eSchools with access to the email address(es) they wish to send their communication to. Schools have granular access to ensure only the required data is shared and accessed by eSchools. The data is frequently updated to ensure that eSchools only retains up-to-date data.

3. Using your personal information

3.1. We may use your personal information to:
- administer our services
- enable your use of our services
- troubleshoot and problem solve
- send you email notifications that you have specifically requested. You can manage your preferences at anytime through your eSchools dashboard.
- keep our services secure, safeguard against improper use of our services and prevent fraud.
3.2. We will not, without your express consent, supply your personal information to any third party for the purpose of their or any other third party's direct marketing.
3.3. eSchools understands our obligation to be mindful about the data we process and only process data that is required to fulfil our obligations in providing our services; to a school who enters into an agreement to use our services and you, the user.
3.4. We will not pass your information to third parties; except for the purpose of fulfilling our services to a school who enters into an agreement to use our services and you, the user or where we are required to do so by law.

4. Disclosing personal information

4.1 We may disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors insofar as reasonably necessary for the purposes set out in this policy.
4.2 We may disclose your personal information:
- to the extent that we are required to do so by law;
- in connection with any ongoing or prospective legal proceedings;
- in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk);
- to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that personal information;
- to the school in the case of improper use on the platform by individuals
4.3 Except as provided in this policy, we will not provide your personal information to third parties.

5. International data transfers

5.1. Data directly collected by eSchools may be stored and processed in and transferred between any of the countries in which we operate in order to enable us to use the information in accordance with this policy. Any third party we use is within the EEA or they hold an existing EU SCC, as in line with requirements under the GDPR. No other third party are permitted to access the school’s data.
5.2. Personal information that an individual adds to our websites may be available, via the internet, around the world. We cannot prevent the use or misuse of such information by others.

6. Retaining personal information

6.1. This section sets out our data retention policies and procedures, which are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal information.
6.2. Personal information that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6.3. Data collected through analytic cookies will be retained for 26 months. Individual visitors can adapt the data collected through cookie preferences, as mentioned in 2.4.
6.4. Notwithstanding the other provisions of this Section 6, we will retain documents (including electronic documents) containing personal data:
- To the extent that we are required to do so by law;
- If we believe that the documents may be relevant to any ongoing or prospective legal proceedings; and
- In order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk). Data will no longer be kept after the termination of the contract with the school.

7. Security of your personal information

7.1. We will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.
7.2. We will store all the personal information you provide on our secure (password- and firewall-protected) servers. The web service we employ has a broad range of accreditations and certifications and the data centres used ensure the data stays within the EEA.
7.3. eSchools use a Secure Sockets Layer (SSL) which creates a secure connection and uses two keys to encrypt data in transit. Despite this, you acknowledge that the transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data.

8. Amendments

8.1. We may update this policy from time to time by publishing a new version on our website.
8.2. You should check this page regularly to ensure you are aware of any changes to this policy.

9. Your rights

9.1. You may instruct us to provide you with any personal information we hold about you.
9.2. We may withhold personal information that you request to the extent permitted by law.
9.3. You may change your cookie preferences at any time as referenced in 2.4.
9.4. School Staff/Governors who subscribe to our Newsletter may manage their preferences at any time through their eSchools dashboard.

10. Third party websites

10.1 Our websites may include hyperlinks to, and details of, third party websites. We have no control over, and are not responsible for, the privacy policies and practices of third parties.

11. Updating information

We will only provide communication about the eSchools platform to school staff/governors who can manage their preferences at any time through their eSchools dashboard.

Covid-19

EIA Addendum to Risk Assessment