Home » Data Protection and Privacy

fingers walking up books

Introduction

Bursary Administration Limited (BAL) has been registered with the Information Commissioner’s Office (ICO) since 13th February 2009 and is currently registered as a Data Controller under the reference Z1647679 and acts both as a Data Controller and Processor on behalf of client schools as required. BAL will make every endeavour to abide by the principles and terms of the Data Protection Act 2018. BAL undertakes to take all possible care to protect Bursary applicants’ (ie the families’) and client schools’ sensitive data.

The purpose of this policy is to outline how BAL practices with respect to data collected from families who use BAL’s website and provide personal (including sensitive) and financial data with regard to their applications to BAL’s client schools for Bursarial support.

Grounds for data collection

BAL collects data in order to be able to contact applicants and then process the data, which is provided to us as part of a Bursary application, in such a way as to provide a report to BAL’s client, the school to which the application is being made, in order to help the Governors of that school make a decision regarding the Bursary application.

Using BAL’s website

The only way BAL’s website will collect data on a contact is if the contact chooses to send BAL a message through the ‘Contact Us’ page, which requests name and email address details. The WordPress database, which the website uses, stores first and last name, the email address, and the message sent to BAL. The website also stores details of the web browser used, the pages which the sender viewed, and the IP address from which the message was sent. The website does not run cookies for any user who is not able to sign-in to the website, which is no-one outside of BAL staff. The website will pass on the first and last name of the sender, the sender’s email address and message onto BAL’s email system, Office 365. When a contact uses BAL’s website, he or she consents to this collection, storage, and transmission of data. The website and BAL’s email system, Office 365, is stored securely on servers which are situated within the United Kingdom.

User Rights with regard to the website

You may request to:

  1. receive confirmation as to whether or not personal data concerning
    you is being processed
  2. receive a copy of personal data you directly volunteer to BAL in a structured, commonly-used and machine-readable format
  3. request rectification of your personal data that is in BAL’s control
  4. request erasure of your personal data
  5. object to the processing of personal data by BAL
  6. request to restrict processing of your personal data by BAL
  7. lodge a complaint with the ICO

However, please note that these rights are not absolute, and may be subject to BAL’s legitimate interests and regulatory requirements.

If you wish to exercise any of the above rights please contact Liz Moseley on liz@schoolbursaryguide.com

Retention

BAL will retain data collected from the website for as long as necessary to provide BAL’s services, and as necessary to comply with BAL’s legal obligations, resolve disputes, and enforce BAL’s policies. Retention periods will be determined taking into account the type of data that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused data at the earliest reasonable time.

Making an application

When you make an application BAL will collect personal (including sensitive) and financial data:

  • Name and date of birth of child(ren) of the application, and home address
  • Full contact data of parents/carers making the application
  • Employment details of parents/carers making the application
  • Names and dates of birth of other dependent children, and schools attended for all children of the family, including Bursarial/grant/other fee support and/or scholarship details as appropriate
  • Names of other dependents, for example grandparents
  • Financial data for the parents/carers making the application, whether that be separately or jointly (separate parents/carers usually use different application forms). This will include data regarding income and expenditure, assets and liabilities.
  • Contact and financial data for adults who hold or are considered by the client school concerned to hold a financial interest in the application, for example a second partner, or a grandparent who will support fees. It may be that full financial data for that person(s) will not be deemed necessary.
  • Sensitive data, for example medical, social service involvement, but only as necessary to support an application. It is important to note that this may, out of necessity, be data regarding a third party as that situation may have a bearing upon the application.

Please note that BAL may use any publicly-available information (data) in order to provide as full a report to the client school as possible, but will not make a credit check upon any adult mentioned in the application, nor undertake any searches which would affect any adult’s credit status.

How BAL receives this data

An Application Form will be completed and sent either to the client school or directly to BAL as detailed at the bottom of the form. Supporting paperwork as required must be included.

If the Application Form and the supporting paperwork has been sent to the client school this will be scanned and forwarded to BAL using Microsoft SharePoint so that BAL may commence its work.

If you have sent the Application Form and supporting documents straight to BAL by post any original documents will be scanned and returned to you by ‘Signed-for’ post. Please ensure that you arrange to collect the envelope if a card is left in your letter-box. If any envelopes are returned to BAL as ‘uncalled-for’ these will be held securely until the papers’ whereabouts are queried. BAL will receive applications by email, including scanned supporting documents.

Assessing your application
BAL will contact you to make arrangements for a home visit if this has been required by the client school, or to make enquiries which will ensure that any paper financial review is as correct as it can possibly be. As there are time constraints for assessing applications BAL will offer two appointments before referring the application back to the client school for further directions.

BAL will send its report on your application to the client school through SharePoint and will then withdraw from the process unless the client school has any further enquiries it wishes BAL to make.

Data retention and security

All paper documents which BAL uses for the purpose of making its report to its client schools are stored in plastic wallets under lock and key. BAL undergoes the process of removing all papers held from storage once each year: these papers, which will include home visitors’/assessors’ handwritten notes, are scanned and then shredded securely using an authorised service.

Scans are stored securely on memory drives which are not linked to the internet in any way, and are themselves stored securely under lock and key.

Any electronic data, whether it be held on BAL’s SharePoint system, a BAL computer (necessary whilst a report is in process), or a memory drive, is stored within the United Kingdom. Electronic data will be deleted after the expiration of four years, unless its retention is necessary to comply with BAL’s legal obligations, resolve disputes, or enforce BAL’s policies.

It will be appreciated that BAL home visitors/assessors will need to transport papers/their laptop computers as they go about their daily work. These papers/computers are left out of sight in locked facilities if not in use, and the computers are passworded and encrypted. BAL uses multi-factor authentication to protect its computers (this means that if any person other than the recorded user of a BAL laptop tries to access it the recorded user will be contacted by electronic means, an app, and will be able to deny access to the laptop).

Applicant Rights

You may request to:

  1. receive confirmation as to whether or not personal data concerning
    you is being processed
  2. receive a copy of personal data you directly volunteer to BAL in a structured, commonly-used and machine-readable format
  3. request rectification of your personal data that is in BAL’s control
  4. request erasure of your personal data
  5. object to the processing of personal data by BAL
  6. request to restrict processing of your personal data by BAL
  7. lodge a complaint with the ICO

However, please note that these rights are not absolute, and may be subject to BAL’s legitimate interests and regulatory requirements.

If you wish to exercise any of the above right please contact Liz Moseley on liz@schoolbursaryguide.com

Important points to note

  • BAL will only use applicants’ data of any type for the purpose of assessing the application and making a report to the client school
  • BAL will never release applicants’ data, of any kind, to any person or body outside of the client school to which the applicant is applying. There is one exception to this, if the applicant has applied to more than one of BAL’s client schools, in which case the report will be shared, but only with all parties’ approval.
  • If assessing separated parents/carers, BAL staff will never reveal any type of data of one parent/carer to the other
  • BAL will never market its services to any applicant
  • BAL will not knowingly collect data of any type from a minor without the prior and express consent of a parent or carer
  • All BAL staff are required to sign confidentiality clauses when they commence working for the company, and are trained in matters of Data Protection and Security
  • Any data breach of any type will be reported to the client school immediately, and contact made with the applicants as agreed with the school concerned. The breach will then be reported to the ICO in accordance with regulations.
  • It should be noted that the report produced by BAL is the property of the client school and the ICO regards your report as confidential and exempt from the provision of Subject Access Requests.

This Policy will be review annually and amended as necessary.

The Data Protection Officer is Liz Moseley, who can be contacted on liz@schoolbursaryguide.com