Data Protection Policy
Nacel English School London is committed to protecting your personal information.
This Data Protection Policy outlines how we use and protect your information andexplains the principles behind our commitment to safeguarding that information.

•Our principles- To comply with our obligations under the Data Protection Act 1998 and any otherrelevant legislation.
- To keep your personal information and the business you do with us in strict confidence.

•- To obtain your personal information lawfully and fairly.

•- To maintain appropriate procedures to ensure that personal information in ourpossession is accurate and, where necessary, kept up-to-date.

•- Where we choose to have certain services, such as data processing, provided by thirdparties we do so in accordance with applicable law and take all reasonable precautions
regarding the practices employed by the service provider to protect personal information.

•- To maintain appropriate technical and organisational safeguards to protect personal
information against loss, theft, unauthorised access, disclosure, copying, use ormodification.

•- Not to sell your personal information.

••

Use of your information
Any information collected about you will be treated as confidential and will only be used
as follows:- For considering any applications you make to us and for the administration of yourcourse.

•- For statistical analysis.

•- For our own internal marketing purposes, except where you instruct us not to.

••General information and your rights
You have the right to:- Receive a copy of information we hold about you if you apply for this in writing. A fee will
be payable for providing this information.
- Have rectified any information that is inaccurate.
-Please be aware that Internet communications are not secure unless the data being
sent is encrypted. Therefore Nacel English School London cannot accept responsibility
for the unauthorised access by a third party and/or the corruption of data being sent tous.
Marketing information
We may inform you of other products or services provided by us which may be ofinterest to you.

A) INTRODUCTION

We may have to collect and use information about you in order to fulfil our obligations to you. This personal
information must be handled and dealt with properly, however it is collected, recorded and used, andwhether it be on paper, in computer records or recorded by any other means.
We regard the lawful and correct treatment of personal information as very important to our successful
operation and to maintaining confidence between us and those with whom we carry out business. We will
ensure that we treat personal information lawfully and correctly.
To this end we fully endorse and adhere to the principles of the General Data Protection Regulation(GDPR).
This policy applies to the processing of personal data in manual and electronic records kept by us inconnection with our human resources function as described below.
This policy applies to the personal data help by the company including students, existing and former, groupleaders, guardians and parents. These are referred to in this policy as relevant individuals.
B) DEFINITIONS“Personal data” is information that relates to an identifiable person who can be directly or indirectly
identified from that information, for example, a person’s name, identification number, location, online
identifier. It can also include pseudonymised data.
“Special categories of personal data” is data which relates to an individual’s health, sex life, sexual
orientation, race, ethnic origin, political opinion, religion. It also includes genetic and biometric data (whereused for ID purposes).
“Criminal offence data” is data which relates to an individual’s criminal convictions and offences.
“Data processing” is any operation or set of operations which is performed on personal data or on sets ofpersonal data, whether or not by automated means, such as collection, recording, organisation, structuring,storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination orotherwise making available, alignment or combination, restriction, erasure or destruction.
C) DATA PROTECTION PRINCIPLES

Under GDPR, all personal data obtained and held by us must be processed according to a set of core
principles. In accordance with these principles, we will ensure that:a) processing will be fair, lawful and transparentb) data be collected for specific, explicit, and legitimate purposesc) data collected will be adequate, relevant and limited to what is necessary for the purposes ofprocessingd) data will be kept accurate and up to date. Data which is found to be inaccurate will be rectified orerased without delaye) data is not kept for longer than is necessary for its given purposef) data will be processed in a manner that ensures appropriate security of personal data including
protection against unauthorised or unlawful processing, accidental loss, destruction or damage byusing appropriate technical or organisation measures

D) TYPES OF DATA HELD

We keep several categories of personal data in order to carry out effective and efficient processes. We keep
this data in a personnel file relating to each student and we also hold the data within our computer systems.
Specifically, we hold the following types of data:a) personal details such as name, address, phone numbersb) copy of passport, id, visac) medical or health informationd) information relating to your course with use) educationf) next of kin details
All of the above information is required for our processing activities. More information on those processing
activities are available from reception.
E) YOUR RIGHTS

You have the following rights in relation to the personal data we hold on you:a) the right to be informed about the data we hold on you and what we do with it;b) the right of access to the data we hold on you.
c) the right for any inaccuracies in the data we hold on you, however they come to light, to becorrected. This is also known as ‘rectification’;d) the right to have data deleted in certain circumstances. This is also known as ‘erasure’;e) the right to restrict the processing of the data;f) the right to transfer the data we hold on you to another party. This is also known as ‘portability’;g) the right to object to the inclusion of any information;h) the right to regulate any automated decision-making and profiling of personal data.
F) RESPONSIBILITIESIn order to protect the personal data of relevant individuals, those within our business who must processdata as part of their role have been made aware of our policies on data protection.
We have also appointed employees with responsibility for reviewing and auditing our data protection
systems.
G) LAWFUL BASES OF PROCESSING

We acknowledge that processing may be only be carried out where a lawful basis for that processing exists.
Where no other lawful basis applies, we may seek to rely on the students’ consent in order to process data.
However, we recognise the high standard attached to its use. We understand that consent must be freely
given, specific, informed and unambiguous. Where consent is to be sought, we will do so on a specific andindividual basis where appropriate. Students will be given clear instructions on the desired processing
activity, informed of the consequences of their consent and of their clear right to withdraw consent at anytime.

H) ACCESS TO DATA

As stated above, students have a right to access the personal data that we hold on them. To exercise thisright, you should make a Subject Access Request. We will comply with the request without delay, and within
one month unless, in accordance with legislation, we decide that an extension is required. Those who makea request will be kept fully informed of any decision to extend the time limit.
No charge will be made for complying with a request unless the request is manifestly unfounded, excessiveor repetitive, or unless a request is made for duplicate copies to be provided to parties other than the student
making the request. In these circumstances, a reasonable charge will be applied.
I)

DATA DISCLOSURESThe Company may be required to disclose certain data/information to any person. The circumstancesleading to such disclosures include:a) any students benefits operated by third parties;b) disabled individuals - whether any reasonable adjustments are required to assist them at the school;c) individuals’ health data - to comply with health and safety or occupational health obligations
towards the student;d) the smooth operation of coursese) to assist law enforcement or a relevant authority to prevent or detect crime or prosecute offenders
These kinds of disclosures will only be made when strictly necessary for the purpose.
J) DATA SECURITY

Employees are aware that hard copy personal information should be kept in a locked place accessible only
to authorised people.
Employees are aware of their roles and responsibilities when their role involves the processing of data. All
employees are instructed to store files or written information of a confidential nature in a secure mannerso that are only accessed by people who have a need and a right to access them and to ensure that screen
locks are implemented on all PCs, laptops etc when unattended. No files or written information of aconfidential nature are to be left where they can be read by unauthorised people.
Where data is computerised, it should be coded, encrypted or password protected both on a local hard
drive and on a network drive that is regularly backed up. If a copy is kept on removable storage media, thatmedia must itself be kept in a locked filing cabinet, drawer, or safe.
Employees must always use the passwords provided to access the computer system and not abuse them bypassing them on to people who should not have them.
Personal data should not be kept or transported on laptops, USB sticks, or similar devices, unless priorauthorisation has been received. Where personal data is recorded on any such device it should be protectedby:a) ensuring that data is recorded on such devices only where absolutely necessary.
b) using an encrypted system — a folder should be created to store the files that need extra protection
and all files created or moved to this folder should be automatically encrypted.
c) ensuring that laptops or USB drives are not left where they can be stolen.
Failure to follow the Company’s rules on data security may be dealt with via the Company’s disciplinary
procedure. Appropriate sanctions include dismissal with or without notice dependent on the severity of thefailure.

K) REQUIREMENT TO NOTIFY BREACHESAll data breaches will be recorded. Where legally required, we will report a breach to the Information
Commissioner within 72 hours of discovery. In addition, where legally required, we will inform theindividual whose data was subject to breach.
L) TRAINING

New employees must read and understand the policies on data protection as part of their induction.
Employees receive training covering basic information about confidentiality, data protection and the actions
to take upon identifying a potential data breach.
The nominated data controller/auditors/protection officers for the Company are trained appropriately intheir roles under the GDPR.
All employees who need to use the computer system are trained to protect individuals’ private data, toensure data security, and to understand the consequences to them as individuals and the Company of any
potential lapses and breaches of the Company’s policies and procedures.

M) RECORDS

The Company keeps records of its processing activities including the purpose for the processing andretention periods in its HR Data Record. These records will be kept up to date so that they reflect current
processing activities.