We collect most of the personal data we process directly from the individual concerned (or in the case of pupils, from their parents). In some cases, we collect data from third parties (for example, the Disclosure and Barring Service, or professionals working with the individual) or from publicly available resources. Personal information about Children and Parents / Guardian as well as Emergency contact details are collected through the enrolment process using a secure registration form. Complementary information may also be shared by emails.

We will only use Your personal information when the law allows us to. Most commonly, we will use Your personal information in the following circumstances:

(1)    Where we need to perform the contract we have entered into with You.

(2)    Where we need to comply with a legal obligation

Though it is likely to be rare, we may also collect and process personal information on the grounds of legitimate interest or personal information for which an explicit consent is required.

Whilst the majority of the personal data you provide to the school is mandatory, some is provided on a voluntary basis. When collecting data, the school will inform you whether you are required to provide this data or if your consent is needed. Where consent is required, the school will provide you with specific and explicit information with regards to the reasons the data is being collected and how the data will be used.

a.      Independent contractors & members

All information described in section 4.a of this document are collected to allow us to perform our contracts with independent contractors and members and to enable us to comply with legal obligations (Safeguarding policy). We process the data for the following purposes:

• To appoint independent contractors and new board and active members;
• To pay invoices;
• To administer the contract we have entered into with the independent contractor;
• To conduct reviews and appraisals of performance;
• To assess qualifications, training and development requirements;
• To conduct of any grievance, capability or disciplinary procedures;
• To maintain appropriate human resources records for current and former staff;
• To provide references;
• To administer and implement rules and policies for independent contractors & members;
• To comply with health and safety obligations;
• To monitor the use of IT systems to ensure compliance to policies;
• To monitor Equal opportunities

b.      Children

All information described in section 4.b of this document are collected to allow us to perform our contracts with children and to enable us to comply with legal obligations (Safeguarding policy). We process the data for the following purposes:

• To manage school admissions;
• To administer school curriculum and timetable;
• To support pupil teaching and learning;
• To monitor and report on pupil progress;
• To provide library services;
• To provide appropriate pastoral care;
• To assess the quality of our services;
• To administer and implement rules and policies for pupils;
• To assess the performances of the school;
• To carry out fundraising;
• To comply with the law regarding Safeguarding

c.      Parents / Guardian / Emergency contacts

All information described in section 4.c of this document are collected to allow us to perform our contracts with parents / guardian in relation to child enrolment and to enable us to comply with legal obligations (Safeguarding policy). We process the data for the following purposes:

• To administer and implement rules and policies for parents / guardian;
• To report on a Child’s attendance and progress;
• To contact a Parent or a Child’s emergency contact about their Child;
• To administer invoices and collect fees;
• To improve communication towards parents / guardian;
• To fulfil our charitable mission: to advance the education for the public benefit

If Independent contractors and Parents fail to provide personal information

If independent contractors and Parents fail to provide certain information when requested, we may not be able to perform the respective contracts we have entered into with Independent Contractors and Parents, or we may be prevented from complying with our respective legal obligations to independent contractors, Children and Parents.

”Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data. We may process special categories of personal information in the following circumstances:

1. In limited circumstances, with Independent Contractors or Parent explicit written consent.

2. Where we need to carry out our legal obligations or exercise rights in connection with Independent Contract.

3. Where it is needed in the public interest, such as for equal opportunities monitoring. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect an Independent Contractors, a Child or a Parents’ interests (or someone else’s interests) and the Independent Contractors, Child or Parent as is appropriate is not capable of giving consent, or where the Independent Contractors or Parent has already made the information public.

We envisage that we will hold information about criminal convictions. We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so, which includes but is not limited to Disclosure and Barring Service (“DBS”) checks. Where appropriate, we will collect information about criminal convictions as part of the appointment process or we may be notified of such information directly by you in the course of you working for us. We will use information about criminal convictions and offences in the following ways:

• To conduct a DBS check on each Independent Contractor as well as any individual in regular contact with children as per Safeguarding policy, to record the date of the DBS check, the number of the DBS check and the name of the body conducting the DBS check. We are allowed to use your personal information in this way to carry out our obligations. We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. Les Crocodiles does not make any decision on that basis.

We may have to share Independent contractors, charity members, Child or Parent data with third parties, including third-party service providers.

We will share Your personal information with third parties where required by law, where it is necessary to administer the working relationship with You or where we have another legitimate interest in doing so.

Most of our systems are administered by third parties and cloud storage providers, eg hosted databases, school website, school posts and messages and school emails. This is always subject to contractual assurances that personal data will be kept securely. We do not allow our third-party service providers to use Your personal data for their own purposes. We only permit them to process Your personal data for specified purposes and in accordance with our instructions.

We may share personal data with French and Francophone public institutions and public bodies for fundraising purposes, including the AEFE (l’Agence pour l’enseignement du Français à L’Etranger) and the Parapluie FLAM (Français Langue Maternelle).

We may also need to share Your personal information with a regulator or to otherwise comply with the law. For example, as a Charity Incorporated Organisation, Les Crocodiles is required to have its accounts independently examined.

We do not otherwise share or sell personal data to other organisations for their own purposes.

Les Crocodiles uses various cloud-based services and cloud storage for the processing of Your Personal data. These companies are “data Processors” under GDPR.

Data Processors include

• Salesforce: for the management of contacts, registration process, management of classes.
• Microsoft Office 365: emails, cloud storage, collaboration, production de documents
• Quickfile: accounts & finances, invoices
• ClassDojo: attendance & evaluation, communication with parents
• Mailchimp: general communication

We also use Paypal and GoCardless services to process payments of tuition fees. They are also a data controller of Your personal data.

We also use Google Analytics – a data processor, to understand how les-crocodiles.org is used and to make improvements to the website. You can choose not to be tracked by Google Analytics using Google Analytics Opt-out Browser Add-on. This add-on can be found here: https://tools.google.com/dlpage/gaoptout/

As a consequence, Your personal data may be transferred to countries or territories around the world.

We will only retain Your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our Retention policy. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of Your personal data, the purposes for which we process Your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise Your personal information so that it can no longer be associated with You, in which case we may use such information without further notice to You. Once you are no longer an Independent contractor, a charity member, or a Child benefiting from the school services or a Parent, as is appropriate, we will retain and securely destroy your personal information in accordance with our data retention policy OR applicable laws and regulations.

Your duty to inform us of changes

It is important that the personal information we hold about You is accurate and current. Please keep us informed if Your personal information changes during your contractual relationship with us.

Your rights in connection with personal information

Under data protection legislation, You have the right to request access to information that we hold.

Under certain circumstances, by law You have the right to:

•       Request access to Your personal information (commonly known as a “data subject access request”). This enables You to receive a copy of the personal information we hold about You and to check that we are lawfully processing it.

•       Request correction of the personal information that we hold about You. This enables You to have any incomplete or inaccurate information we hold about You corrected.

•       Request erasure of your personal information. This enables Employees or Parents to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove Your personal information where You have exercised Your right to object to processing (see below).

•       Object to processing of Your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about Your particular situation which makes You want to object to processing on this ground. You also have the right to object where we are processing Your personal information for direct marketing purposes.

•       Request the restriction of processing of Your personal information. This enables Independent contractors, charity members or Parents, as is appropriate, to ask us to suspend the processing of personal information about You, for example if You want us to establish its accuracy or the reason for processing it.

•       Request the transfer of Your personal information to another party.

If You want to review, verify, correct or request erasure of Your personal information, object to the processing of Your personal data, or request that we transfer a copy of Your personal information to another party, please contact the manager in writing. No fee shall be required to access Your personal information or to exercise any of the above rights.

We will respond to any such written requests as soon as is reasonably practicable and in any event within statutory time-limits, which is one month in the case of requests for access to information. We will be better able to respond quickly to smaller, targeted requests for information. If the request is manifestly excessive or similar to previous requests, we may ask you to reconsider your request.

We may need to request specific information from You to help us confirm your identity and ensure Your right to access the information (or to exercise any of Your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

In the limited circumstances where You may have provided Your consent to the collection, processing and transfer of Your personal information for a specific purpose, You have the right to withdraw Your consent for that specific processing at any time. To withdraw Your consent, please contact privacy@les-crocodiles.org . Once we have received notification that You have withdrawn Your consent, we will no longer process Your information for the purpose or purposes You originally agreed to, unless we have another legitimate basis for doing so in law.

In the UK, only children aged 13 or over are able to provide their own consent. Children have the same rights as adults over their personal data. These include the right to access their personal data, request rectification, object to process and have their personal data erased.

The rights under Data Protection legislation belong to the individual to whom the data relates. However, we will often rely on parental consent to process personal data relating to pupils (if consent is required) unless, given the nature of the processing in question, and the pupil's age and understanding, it is more appropriate to rely on the pupil's consent. 

Parents should be aware that in such situations they may not be consulted, depending on the interests of the child, the parents’ rights at law or under their contract, and all the circumstances.

In general, we will assume that pupils’ consent is not required for ordinary disclosure of their personal data to their parents, e.g. for the purposes of keeping parents informed about the pupil's activities, progress and behaviour, and in the interests of the pupil's welfare, unless, in the school's opinion, there is a good reason to do otherwise.

However, where a pupil seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, we may be under an obligation to maintain confidentiality unless, in our opinion, there is a good reason to do otherwise; for example, where the school believes disclosure will be in the best interests of the pupil or other pupils, or is required by law.

Pupils can make subject access requests for their own personal data, provided that they have sufficient maturity to understand the request they are making. A person with parental responsibility will generally be entitled to make a subject access request on behalf of pupils, but the information in question is always considered to be the child’s at law. A pupil of any age may ask a parent or other representative to make a subject access request on their behalf. Moreover (if of sufficient maturity) their consent or authority may need to be sought by the parent making such a request.  

We reserve the right to update this privacy notice at any time, and we will provide You with a new privacy notice when we make any substantial updates. We may also notify You in other ways from time to time about the processing of your personal information.

Our privacy notice should be read in conjunction with our other policies and Terms and Conditions which make reference to personal data, including our Safeguarding Policy and our Code of Conduct.

If you believe that we have not complied with this policy or have acted otherwise than in accordance with Data Protection Law, you should notify the Data Protection Officer: dpo@les-crocodiles.org

You can also complain to the Information Commissioner’s Office in one of the following ways:

• Report a concern online at https://ico.org.uk/concerns/  
• Call 0303 123 1113
• Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF