Policies & Handbooks

Introduction

This policy sets out how the website available at www.culford.co.uk and www.culfordonline.co.uk  use cookies.

What is a cookie?

When we provide services we want to make them easy, useful and reliable. These services are delivered on the internet, which sometimes involves placing small amounts of information as files on your computer, mobile phone or other device. These small files are known as cookies. Certain cookies contain a limited amount of personal information. For example, if you click “remember me” when logging in, a cookie will store your username (which could be, for example, your email address). However, most cookies used on our Websites will not collect information that identifies you, and will instead collect more general information to help us analyse how well our Websites are performing so we can improve them:

• recognising that you may already have given a username and password so you don’t need to do it for every web page requested;
• measuring how many people are using services, so they can be made easier to use and there’s enough capacity to ensure that they are fast;
• analysing anonymised data to help us understand how people interact with our services so that we can make them better.

How to Manage Cookies

• You can manage these small files and learn more about them from the article Internet Browser cookies- what they are and how to manage them.
• Learn how to remove cookies set on your device

There are two types of cookie you may encounter when using our websites:

First party cookies: these are our own cookies, controlled by us and used to provide information about usage of our site.

Third party cookies: these are cookies found in other companies’ internet tools which we are using to enhance our site, for example Facebook or Twitter have their own cookies, which are controlled by them.

First party cookies

The Culford School website uses cookies in several places – we’ve listed each of them below with more details about why we use them and how long they will last.

NAME	PURPOSE	TYPICAL CONTENT	EXPIRES
ASP.NET_SessionId	Enables the server to recognise the user in their current browsing session.	Used to temporarily store non-sensitive data.	When the browsing session ends.
style	Used to remember the user's style preference.	Standard View, Print View, High Visibility	24 Hours

 

Third party cookies

We use suppliers who may also set cookies on their websites’ on its behalf. The Culford School website does not control the dissemination of these cookies. The Schools website uses Google Analytics and full information about their cookies can be found here. You should check the third party websites for more information about their cookies.

PROVIDER	NAME	PURPOSE	MORE INFO
AddThis	__atuvc	Enables the share count to update when a page is shared.	AddThis Privacy and Data Practices

 

We will not use cookies to collect personally identifiable information about you.

How to control and delete cookies

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of our Websites.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including what cookies have been set and how to manage and delete them, visit www.aboutcookies.org  or www.allaboutcookies.org .

To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.

External Privacy Notice

Site Terms and Conditions of Use

Access and use of this website www.culford.co.uk  is provided on the following terms. By using the site you are agreeing to comply with and be bound by the following terms and conditions of use:

1. The content of this website is for general information and is subject to change without notice.
2. We do not provide any warranty or guarantee as to the accuracy, timeliness, completeness or suitability of the information and materials it contains for any particular purpose. For the avoidance of doubt, this includes materials accessed by links to websites operated by others. You should not, therefore, rely on any such information contained on either this site or others accessed from it.
3. You agree to use the Culford School website for lawful purposes only and in a way that does not infringe the rights of, restrict or inhibit anyone else’s use and enjoyment of it.
4. Access to the Culford website is on a temporary basis and we reserve the right to withdraw or amend the information it contains without notice. Culford School will not be liable if the website is not available for any reason.
5. Addresses of or links to other websites may appear on the site for your convenience to provide further information but we do not accept any responsibility or liability for the content of other websites. Any link should not be construed as an endorsement of any kind by Culford School. It is your responsibility to check the terms and conditions and privacy policy on any other website that you visit.
6. You may link to the Culford School website provided that it is done in a way that is fair and legal and that it does not damage Culford School’s reputation or any of its associated businesses’ reputations in any way. You must not establish a link in such a way to suggest that there is any approval or endorsement by Culford School where none exists.
7. This website and its content is copyright of Culford School © Culford School 2016. All rights reserved. Users do not have permission to capture and reproduce content or images without first seeking express written consent from Culford School.
8. Use of this website and any dispute arising out of such use is subject to the laws of England and Wales.
9. Please report any errors or inaccuracies to: communications@culford.co.uk
10. If you do not agree to these terms and conditions of use, please refrain from using the website.

Disclaimer

The information on this website is for general information purposes and is subject to change. While we aim to ensure that the information is up to date and correct, we make no representations or warranties of any kind about its completeness, accuracy and reliability or about the suitability or availability of any of the products, services or events which it describes.

We will not be liable for any loss or damage including without limitation arising from the use of this website or from any reliance on the material contained within it.

Viruses, Hacking and Computer Security

You must not misuse our site by deliberately introducing viruses, trojans, worms, malware or other material which is malicious or technically harmful. You must not attempt to gain unauthorised access to our site, the server on which our website is stored or any server, computer or database connected to our site.

We will report any such breach to the relevant law enforcement authorities. In the event of such a breach, your right to use our site ceases immediately.

We will not be liable for any loss or damage caused by any virus or other technologically harmful event that may adversely affect or infect your computer equipment, computer programmes, data or other proprietary material due to your use of our site or due to you downloading any material posted on it, or any website linked to it.

Internal Privacy Notice

Culford School Foundation’s Privacy Notice

Alumni, Friends and Supporters

This privacy notice is intended to provide information about how the School will use (or "process") Personal Data about individuals including alumni, friends and supporters for the purposes of maintaining a lasting, life-long relationship with the School.

We are committed to protecting your personal information, using it in accordance with data protection laws and not doing anything with your information that you would not reasonably expect.

What does the Culford Foundation do and why do we hold your data?

The Culford Foundation interacts worldwide with its community which includes: current and former students, also referred to as alumni, Old Culfordians or Old East Anglians; current and former parents; current and former staff, Governors and Trustees; and other friends of the School such as event sponsors, event attendees, charitable trusts or other relatives of former pupils and staff.

Culford School is a registered charity, administered by the Methodist Independent Schools Trust. Our aim is to build and maintain good relations across the Culford community, fostering support for a range of activities such as: university and careers networking, advice and support; connecting old friends and colleagues; organising reunions, social and sporting events; and fundraising, including for capital projects and for the Culford Bursary Fund.  The funds which the Foundation raises enables the School to develop and maintain its facilities as well as to offer financial support to those who could not otherwise afford to attend the School.

To help us do this, the Culford School Foundation currently uses and maintains a relationship management database called the Raiser’s Edge NXT to enable us to communicate with all our stakeholders.

We also use Culford Online (Netcommunity) which is the online directory for alumni of Culford School and the East Anglian Schools to support friendraising and fundraising by the Foundation. It allows individuals to engage with the Foundation by providing a platform to create a personal profile that can be shared with other alumni, where the individual allows. Bookings and payments for events and merchandise can be made in addition to donations through Culford Online. The facility to add obituaries to the site is also available to users. Communication options to receive information from Culford Foundation can be managed by the profile holder.

How we collect personal information

• Data on current pupils is transferred from the Pupil database to the Foundation database in the term after a pupil leaves.
• When you give information to us directly; whether in writing, face to face or over the telephone. For example when you sign up for an event, request a copy of the alumni magazine, make a donation, complete a leavers’ or other contact form or tell us your news, which could be for inclusion in our alumni communications and publications.
• When we conduct surveys, including research on when and whether particular donations or funding appeals may be of interest.
• When you register with Culford Online and input your own contact details which you can update at any time. Culford Online is password protected. Culford Online collects personal information when you create a personal profile.  Culford Online does not collect any personal information about you unless you choose to give it to us by completing a form, sending us an email or updating your personal profile through your self-registered account.
• When you book an event through Culford Online.
• We may supplement information that you give us with publicly available data from elsewhere, such as from LinkedIn or other online media, news articles, magazines, books, directories or other published sources.

We do this so that we can (i) potentially connect current students and recent leavers with others in their field (ii) invite you to appropriate friendraising events; and (iii) ensure that any fundraising approach we may make is appropriate, tailored to your interests where possible and, we hope, will not cause offence.

 What do we do with your data?

The personal data which the Culford School Foundation holds about you will only be used for friendraising and fundraising purposes.

We will use the contact details of the constituents on our database to send you information about the activities, events, future plans and fundraising appeals for the School, together with news from alumni and other appropriate stakeholders. This includes sending updates and newsletters both by email and by post.

Most records contain education, contact details, and career information. Some may contain photographs of you while at School or attending an event for example. Photographs and stories may be published through social media

Contact with the School and donations are recorded along with any sibling or other family links if known.

We do not communicate directly with alumni under the age of 18 i.e. pupils who left Culford prior to completing Sixth Form. Pupils who leave at a younger age may keep in touch, on request, via their parents or guardians, until they reach 18 years of age.

If you have registered with Culford Online, the Foundation uses your Culford Online personal information to communicate with you using your chosen methods about events, fundraising, current and former pupils and staff; and Culford School news. This may be via electronic communication or hard copy publications such as Hartley News and FOCuS.

In addition to disclosure as permitted or required by law, data may be disclosed on a considered and confidential basis to officers, governors, employees and/or staff of Culford School, MIST (Methodist Independent Schools Trust) and auditors e.g. The Charity Commission.

We may pass data to other organisations, known as Data Processors, who provide specific services such as printing, mailing houses, wealth screening services and fundraising consultants to the Culford School Foundation. We may also carry out due diligence research on donors in line with the charity gift policy and meet money laundering regulations. There are contractual agreements in place that require them to process your data compliantly with data protection laws.  They are required to delete or destroy all such information once they have completed the agreed activities carried out on our behalf.

The School does not retain any bank card information. Third party payment processor Global Payments is used for payments processed over the telephone or in person. Any payments details provided by you through Culford Online are securely processed directly by a third party provider Blackbaud Merchant Services.

We do not sell, share or swap information with any third parties for their own use and will not provide your contact information to other alumni or others without your consent.

Protecting Your Data & Security

Culford Foundation’s relationship management database, the Raiser’s Edge NXT and Netcommunity (Culford Online) is owned and hosted by Blackbaud.  Blackbaud offers Standard Contractual Clauses (“SCCs”) or Model Clauses as a mechanism to provide appropriate safeguards for the protection of personal data for EU, UK, and Swiss data protection purposes.

Blackbaud, its subsidiaries, and its affiliates are certified under the EU-U.S. Privacy Shield Framework; regarding the collection, storage, transfer, use and other processing of Personal Data transferred from the European Union and Switzerland, respectively, to the United States.

All information is held and transmitted securely on our database.

Culford School and their third party suppliers are compliant with the PCI DSS Safer Payments programme when completing payment transactions.  For further information on PCI DSS SaferPayments Programme please visit https://www.pcisecuritystandards.org/pci_security/

Our Responsibilities

The school has appointed the Compliance Officer as the Data Protection Lead who will endeavour to ensure that all personal data is processed in compliance with this policy and Data Protection Law.

 Basis for Processing

The law requires us to tell you the legal basis on which we process your data:

• Consent

In specific situations, we can collect and process your data with your consent for example, when you tick a box to receive email newsletters;

• Contractual obligations

In certain circumstances, we need your personal data to fulfil our contractual obligations to you for example, if you make payment through Culford Online to book an event or make a donation;

• Legal compliance

If the law requires us to, we may need to collect and process your data, for example; if you gift aid a donation, we are required to tell HMRC the name and postcode of the donor and the date and amount of the donation;

• Legitimate interest

In all other cases we are processing your data based on your pre-existing relationship with Culford or the East Anglian Schools which establishes a legitimate interest in our sharing with you news of developments at Culford, our fundraising programme generally, and the social and networking opportunities that we offer our community. It is on this basis that we hold and process the information that you or others have supplied to us, and use it in the manner set out in this Privacy Notice.

We will also use your address details to send you direct marketing information by post, telling you about friendraising and fundraising opportunities that we think may interest you.

How long do we keep your data for?

We pride ourselves on offering a lifelong relationship with our alumni and former staff; many individuals remain in contact with us until they die. As relationships between constituents and Culford School are often long term ones, we expect to maintain and update your data for as long as that relationship exists. You may ask us to cease contact at any time by contacting: foundation@culford.co.uk or telephone 01284 385310 or updating your personal profile using Culford Online.

Data Control: Your Rights

You will receive our general news and information as described above, including about our events and our development and fundraising programmes, unless you ask us not to.

We will communicate with you based on your personal preferences chosen at registration. Culford Online allows you to update your personal information and communication preferences at any time.

You have the right to receive copies of the information we hold on you and, in some cases, to object to how we process it. If we do hold information about you, you can ask to correct any mistakes.

If you wish to make a Subject Access Request to find out if we hold any personal information, please contact the Compliance Officer at the address detailed below or email: compliance@culford.co.uk

If you have any queries, wish to restrict data processing or sharing, including use for fundraising or marketing of events or do not want to be contacted at all, please inform us:

Culford School Foundation, Culford School, Bury St Edmunds, Suffolk IP28 6TX

Tel: +44 (0)1284 385310                            Email: foundation@culford.co.uk

Please note, minimal information is always retained to make sure we do not contact you inadvertently. Our privacy notice and data protection policy are under constant review and any changes will be published on our website, via our email links and can be provided in hardcopy on request.

Compliance

If you believe we have not complied with this Privacy Notice or have acted otherwise than in accordance with current Data Protection Law, please direct your concerns or complaint to:

The Compliance Officer Tel: +44 (0)1284 728615             

Email: compliance@culford.co.uk

You may also refer the matter to the Information Commissioner’s Office (ICO) at https://ico.org.uk/ although the ICO recommends that steps are taken to resolve it directly with us, before involving them.

Updates & Changes to our Privacy Notice

This privacy notice and Culford Foundation’s policies are subject to regular review.

Last updated December 2022

Employment applications, current and previous employees

Any information provided by you during the recruitment process will be used for the express purpose of processing your employment application, or to fulfil legal or regulatory requirements for recruitment and essential to assessing your suitability for employment within the School. We do not collect any information in excess of what is required and we do not retain it for longer than is necessary.  

You are not required to provide us with the information we ask for but it may influence your application if we do not have the information we require for a successful application to work in a School.

If you apply using our online application form you will be required to use our website. This information will be passed to the recruitment team who will shortlist applications for interview.

We may use the following recruitment agencies Pure, Compass Point, Reedand Hays. They collect information on our behalf which will be used to assess your suitability for the role. We post job vacancies using indeed and our school website. 

Any data generated from the interview process will be stored as part of your application process and will be retained for 3 months, but no longer than a year if unsuccessful or the duration of employment plus a minimum of 7 years.

An offer of employment will be conditional and we will ask you for information in order to carry out pre-employment checks. We are required to confirm your identity, your right to work in the United Kingdom, required safeguarding checks for working in education, your fitness to work via a health questionnaire and to seek assurances to your professional conduct, trustworthiness and reliability.

The School uses a third party service provider Atlantic Data Ltd. to carry out Disclosure and Barring Services Checks (DBS). This is only carried out with your express permission. It is a condition of employment that all employees have a successful DBS check.

All archived employment records are stored on a dedicated server in the UK. All current employment records are held in electronic and paper filing systems.

Please read our Internal Privacy Notice

 on how we collect and process your personal data during and after employment at the school.

Visitors to our website

The Culford website is hosted by Finalsite UK. When you visit www.culford.co.uk we use a third party service via Finalsite UK, Google Analytics to collect internet log information and details of visitors’ behaviours whilst using the website. Our marketing department use this information to understand the number of visitors to the website and which parts of the website attract the most use. If we wish to collect personally identifiable data through the website, we will make it clear this is what we are doing and we will explain what we intend to do with it.

Recruitment Selection and Disclosures Policy and Procedure

E – Newsletters and Culford Post

The School communicates to Parents and Guardians via Culford Post which is hosted by Schoolpost. We use MailChimp and SurveyMonkey

We gather statistic about emails opened and number of clicks to help the school monitor and improve our communication platforms.

Individuals who contact us via social media

The school uses Instagram, Facebook, Twitter, LinkedIn and Google to build relationships with parents, pupils and friends of Culford School.

Please click on the links above for more information on their compliance to data protection laws.

Visitors to our website

The Culford website is hosted by Finalsite UK. When you visit www.culford.co.uk we use a third party service via Finalsite UK, Google Analytics to collect internet log information and details of visitors’ behaviours whilst using the website. Our marketing department use this information to understand the number of visitors to the website and which parts of the website attract the most use. If we wish to collect personally identifiable data through the website, we will make it clear this is what we are doing and we will explain what we intend to do with it.

Culford School CCTV Policy

The purpose of this policy is to regulate the management and operation of the Closed Circuit Television (CCTV) system for Culford School (the School). It also serves as a notice and a guide to data subjects (including pupils, parents, employees, volunteers, governors, visitors to the School and members of the public) regarding their rights in relation to personal data recorded via the CCTV system (the System).

The CCTC system is administered and managed by the School, who act as the Data Controller. This policy will be subject to review from time to time, and should be read with reference to the School's Data Protection Policy. For further guidance, please review the Information Commissioner's CCTV Code of Practice (accessible here link).

All fixed cameras are in plain sight on the School premises and the School does not routinely use CCTV for covert monitoring or monitoring of private property outside the School grounds. Every passenger vehicle operated by the School has an external facing Dashboard Camera.

The School's purposes of using the CCTV system are set out below and, having fully considered the privacy rights of individuals, the School believes these purposes are all in its legitimate interests. Data captured for the purposes below will not be used for any commercial purpose.

Objectives of the System

• To protect pupils, staff, volunteers, visitors and members of the public with regard to their personal safety.
• To support the management of safeguarding on school grounds.
• To protect the school buildings and equipment, and the personal property of pupils, staff, volunteers, contractors, commercial customers, visitors and members of the public.
• To support the police and community in preventing and detecting crime, and assist in the identification and apprehension of offenders or vehicles.
• To provide evidence of damage or loss to the School’s insurance company.
• To monitor the security and integrity of the School site and deliveries and arrivals.
• To monitor staff and contractors when carrying out work duties.

• To monitor passenger vehicles operated by the school.

• To monitor areas of the sports pitches during selected events or to determine weather impact on the safety of the pitches.

• To monitor and uphold discipline among pupils in line with the schools handbooks, which are available to parents and pupils on the School website or on request.

Positioning

• Locations have been selected, both inside and out, that the School reasonably believes require monitoring to address the stated objectives.
• Adequate signage has been placed in prominent positions to inform staff and pupils that they are entering a monitored area.
• No images will be captured from areas in which individuals would have a heightened expectation of privacy, including sleeping, changing and washroom facilities.
• No images of public spaces will be captured except to a limited extent at site entrances and exits, sports pitches, around boarding and teaching buildings.

Maintenance 

• The CCTV System will be operational 24 hours a day, every day of the year. 
• The Head of IT Services will check and confirm that the system is properly recording and that cameras are functioning correctly and on a regular basis.
• The system will be checked and (to the extent necessary) serviced regularly.

​Supervision of the System

• Employees authorised by the School to conduct routine supervision of the system may include Caretakers, IT technicians, supervisors at the sports centre and relevant staff on duty.
• Images will be viewed and/or monitored in a suitably secure and private area to minimise the likelihood of or opportunity for access to unauthorised persons.

Storage of Data

• The day-to-day management of images will be the responsibility of the Head of IT Services, or such suitable person as the Head of IT Services shall appoint in their absence.
• Images will be stored for [e.g. 2-4 weeks], and automatically over-written unless the School considers it reasonably necessary for the pursuit of the objectives outlined above, or if lawfully required by an appropriate third party such as the police or local authority.
• Where such data is retained, it will be retained in accordance with the Data Protection Act 2018 and the School’s Data Protection Policy. Information including the date, time and length of the recording, as well as the locations covered and groups or individuals recorded will be retained;

Access to Images

• Access to stored CCTV images will only be given to authorised persons, under the supervision of the Head of IT Services, in pursuance of the above objectives (or if there is some other overriding and lawful reason to grant such access).  
• Individuals also have the right to access personal data the School holds on them (please see the Data Protection Policy), including information held on the CCTV system, if it has been retained. The School will require specific details including at least to time, date and camera location before it can properly respond to any such requests. This right is subject to certain exemptions from access, including in some circumstances where others are identifiable.
• The Head of IT Services must satisfy themselves of the identity of any person wishing to view stored images or access the system and the legitimacy of the request. The following are examples when the Head of IT  Services may authorise access to CCTV images:

- Where required to do so by the Headmaster, the Executive, their representative, the Police or some relevant statutory authority.

- To make a report regarding suspected criminal behaviour.

- To enable the Designated Safeguarding Lead or his/her appointed deputy to examine behaviour which may give rise to any reasonable safeguarding concern.

- To assist the School in establishing facts in cases of unacceptable pupil behaviour, in which case, the parents/guardian will be informed as part of the School’s management of a particular incident.

- To Data Subjects (or their legal representatives) pursuant to an access request under the Data Protection Act 2018.

- To the School's insurance company where required in order to pursue a claim for loss or damage to insured property; or

- In any other circumstances required under law or regulation.

- Where images are disclosed as detailed  above a record will be made in the system log book including the person viewing the images, the time of access, the reason for viewing the images, the details of images viewed and a crime incident number (if applicable).

- Where images are provided to third parties under the above rights, wherever practicable steps will be taken to obscure images of non-relevant individuals.

Other CCTV systems

• The School does not own or manage third party CCTV systems, but may be provided by third parties with images of incidents where this in line with the objectives of the School's own CCTV policy and/or its school rules.
• Many pupils travel on coaches provided by third party contractors and a number of these coaches are equipped with CCTV systems. The School may use these in establishing facts in cases of unacceptable pupil behaviour, in which case the parents/guardian will be informed as part of the School’s management of a particular incident.
• The Tennis Performance Centre and hockey pitches have cameras recording pupil and coach training sessions and selected matches. The lessons are broadcast live onto an online streaming service. This allows parents to view their child’s training session from anywhere in the world.  Access to this service is restricted and regular access updates will occur to support the continued restricted access to the service. The school will ask for consent for pupils and or parents using this facility and signage is in place to make individuals aware of the recording taking place within the premises.  These recording are retained for no longer the 5 hours.

Complaints and queries

If you have any further questions about the School's CCTV system, or its use of CCTV, or requests for copies, should be referred to The Compliance Officer. Compliance@culford.co.uk

CCTV FOOTAGE ACCESS REQUEST

The following information is required before the school can provide copies of or access to CCTV footage from which a person believes they may be identified.

Please note that CCTV footage may contain the information of others that needs to be protected, and that the school typically deletes CCTV recordings after a two week period.

Name and address: (proof of ID may be required)
Description of footage (including a description of yourself, clothing, activity etc.)
Location of camera
Date of footage sought
Approximate time (give a range if necessary)

 

Signature*……………………………………

 

Print Name…………………………………….                Date ………………..

* NB if requesting CCTV footage of a child under 13, a person with parental responsibility should sign this form. For children 13 or over, the child's authority or consent must be obtained except in circumstances where that would clearly be inappropriate and the lawful reasons to provide to the parent(s) outweigh the privacy considerations of the child.

Use of Images Policy

Health and Safety Policy

Modern Slavery Act Policy