Privacy Policy

 

DATA CONTROLLER:

BROOKHOUSE SCHOOLS KENYA

Brookhouse School, Karen
Magadi Rd
Nairobi, Kenya

Brookhouse School, Runda
Off Kiambu Road
Nairobi, Kenya

Brookhouse Schools (also referred as “the School”) are part of Inspired Education Holdings Limited,  which is a company registered in England with number 09268120 and registered address in Sixth Floor, 3 Burlington Gardens, London, W1S 3EP, United Kingdom. Inspired operates numerous affiliated schools globally via its regional offices in Europe, Africa, Middle East, Asia-Pacific and Latin America.


1. INTRODUCTION

This policy is drafted according to the Data Protection Act, 2019 (the “Act”) came into force on 25th November, 2019 and it is created with the aim to provide information to the data subjects about how the School processes the personal data.


2. TYPES OF PERSONAL DATA WE PROCESS

We process personal data from our current and former students and their families and / or legal representatives and also from our employees, candidates, suppliers, contractors, prospective customers and third parties interested in finding out more about our School within the systems controlled by the School as Data Controller. 

The personal data processed is mainly the following:

  • Names, addresses, telephone numbers, e-mail addresses and other contact details;
  • Family details;
  • Safeguarding information (such as court orders and professional involvement)
  • Education and employment data;
  • Images, audio and video recordings, including CCTV footage (video images);
  • Financial information;
  • Educational centres previously attended.

Other types of data we may collect and process, according to the school purposes, are related to health condition, criminal records and other sensitive information related to an individual, such as:

  • Information about health status or provision of health care linked to a specific individual;
  • Behavioural information; 
  • Special educational needs
  • Criminal records linked to a specific individual;
  • Biometric information;
  • Ethnicity;
  • Religion;
  • Nationality and location.


3. HOW WE COLLECT AND PROCESS PERSONAL DATA

The School collects information in several ways, including:

  • Personally and over the phone;
  • Through our website;  
  • From email and hand delivery paper documentation: including job applications, emails, invoices, letters, consent forms;
  • Through online tools: such as apps, educational platforms and other software used by our staff;
  • Through any CCTV cameras located at our premises or sites;
  • Through third parties, such as referees, professionals or authorities acting on behalf of the data subjects;

 

4. PURPOSES FOR WHICH WE PROCESS PERSONAL DATA 

The School processes personal data to lawfully and legitimately carry out the school’s educational activity. The school collects and keeps students and parents’ information when necessary:

  • To ensure that the student meets the school’s admission criteria;
  • To provide educational services including the support of pupil learning, monitor and report on pupil progress;
  • To provide to the students welfare and pastoral care services; 
  • To provide to the students medical and nurse attention, catering service and school transportation, among other necessary services; 
  • To meet the educational, social, physical and emotional requirements of the student;
  • To comply with the law regarding data sharing;
  • To comply with legislative or administrative requirements;
  • To administer the school’s governing body;
  • To enable parents/guardians to be contacted in the case of emergency or in the case of school closure, or to inform parents of their child’s educational progress or about school events, etc.
  • With the aim to celebrate school’s achievements and to keep a record of the history of the school, BSB may take photographs and recorded images of students to be shared in, e.g. yearbooks, school website, etc, always based on informed consent from parents or students of legal age;
  • To send commercial communications if previously authorised by the data subject. You will be able to unsubscribe from the receipt of commercial communications by clicking in the “unsubscribe” section found in all these kind of e-mails sent by the School.

The personal data object of processing may only be communicated to other Schools within the Inspired group with the prior written consent of the data subject or when necessary and the personal data will be processed with the same legitimate purposes mentioned herein.


5. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

As a School, we may be lawfully required to share personal information with relevant authorities or third parties as permitted on statutory grounds, to comply with legal obligations or on the basis of a specific consent given by the individual concerned. 
We will ensure that, where relevant, contractual safeguards are implemented to ensure the protection of your personal data when disclosing your personal data to a third party.

Your data will not be transferred outside of Republic of Kenya. In case such transfer is needed, we will implement appropriate measures to ensure adequate protection of your personal data in accordance with applicable data protection legislation. 
Your personal data shall be neither rented nor sold to third parties.


6. CONSERVATION OF DATA

Personal information will only be retained for the period of time required to fulfil the purpose for which it was collected unless for a longer time for public interest archiving, scientific or historical research, or statistical purposes. Once the personal information is no longer required or permitted to be retained for legal or business purposes, it will be destroyed or made anonymous.


7. YOUR RIGHTS

You can exercise your rights regarding the processing of your personal data. These rights are, however, subject to certain legal exemptions and limitations.

You have the right to:

  • Be informed, at the time when personal data is collected, about the data processing. 
  • Access the information we process and how we process it as well as to obtain a copy of the personal data considering the legal limitations and exceptions;
  • Ask for the erasure of the personal data we hold about you without undue delay considering the legal limitations and exceptions; 
  • Obtain the rectification of your personal data providing a supplementary statement;
  • Obtain restriction of processing of your personal data when it is inaccurate, illegal, unnecessary or not verified, considering the legal  limitations and exceptions;
  • Obtain data portability of your personal information in a structured, commonly used and machine-readable format. This allows the right to transmit that data to another controller without hindrance from the controller to which the personal data has been provided; 
  • Object to processing for direct marketing purposes;
  • Withdraw consent at any time and freely to the processing of your personal data. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. 
  • Right to not to have your personal information processed for purposes of direct marketing by means of unsolicited electronic communications, 
  • Right to not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of your personal information.

We will not process data from minors without parents or legal guardians’ consent.

According to this, we have processes in place to ensure that we respond to a request without undue delay from the date of the request although we can extend the time limit to respond to it if necessary. We are aware of the information we must provide in response to a request and the need to provide it in clear and plain language.

You can exercise your rights by sending a written request together with your ID card to our Data Protection Officer at: dpo@brookhouse.ac.ke. 


8. CONSENT

You will have the right to withdraw your consent for any specific purpose granted at any given time without prejudice of the legality of processing according to the consent given before withdrawal.


9. STORING AND SECURING INFORMATION

The School applies the appropriate technical and organisational measures to ensure the security, confidentiality, integrity and privacy of your personal data, preventing from unauthorised access or unlawful processing as well as accidental loss, destruction or damage of the data.


10. COMPLAINTS

If you are not satisfied with our response to your request, you would like to discuss anything regarding this privacy notice, or you believe we are processing your personal data disregarding the data protection regulations in force, please contact our Data Protection Officer at: dpo@brookhouse.ac.ke or you can address your complaint to the Office of the Data Protection Commissioner (DPC) at: https://www.odpc.go.ke/file-a-complaint/ although the Authority recommends that previous steps must be taken to resolve the matter with our School before involving DPC.


11. PRIVACY NOTICE UPDATES

The School may need to update this privacy notice periodically so we recommend that you review this information from time to time.  

This version was last updated on March 2022