INTRODUCTION AND DEFINITIONS
Okeford Education Limited, trading as A-List Education UK (“we”, “our” and “us”) is committed to protecting and respecting your privacy.
Our site may, from time to time, contain links to and from partners’, advertisers’, affiliates’ and social network sites. If you follow a link to any of these websites, please note that these sites have their own privacy policies and that we do not accept any responsibility or liability for those policies. Please check their privacy policies before you submit any personal data to those websites as they may not be on the same terms as ours.
If you have questions about correcting or deleting your personal data please refer to sections 9 and 12 below.
References in this policy to “data protection law” mean (as applicable) the Data Protection Act 2018, the General Data Protection Regulation (Regulation (EU) 2016/679) and all related data protection legislation having effect in the United Kingdom from time to time.
References in this policy to “data or “information” include “sensitive personal data” and “special categories of data” (as defined under data protection law) where applicable.
1 OUR DETAILS
1.1 The data controller with control of your personal information is Okeford Education Limited, trading as A-List Education UK of 14 Waterloo Place, London SW1Y 4AR.
1.2 Our data protection officer is Edward Smallwood who is contactable at 14 Waterloo Place, London SW1Y 4AR.
2 HOW WE USE YOUR INFORMATION
2.1 The following sections explain what information we hold about you, why we are processing that information, the legal basis for the processing, the duration for which we keep your information and (if applicable) who your information will be shared with and where those recipients are based.
Which information do we process and for what purpose?
2.2 We process the following information from you:
2.2.1 Information you give us. This is information about you that you give us by completing application forms to use our services. The information you give us may include your name, address, email address, phone number, date of birth, gender, personal description and photograph. Information you give us might also include “special categories” of more sensitive personal information. This could include information about your health, if they are relevant to learning differences. In some cases it may include details of criminal record checks where requested by the educational institutions that you are applying to.
We may monitor, record, store and use any session with students, for quality and training purposes, for safeguarding purposes and so that students can re-watch sessions where appropriate.
2.2.2 We process information you give to us for the following purposes:
22.214.171.124 to help you (or your child if you apply on behalf of one of your children) to apply for and obtain places at educational institutions in the United States, and to provide any other services you have asked to provide;
126.96.36.199 to manage your account with us;
188.8.131.52 to send you emails about our services.
2.2.3 Information obtained from or provided by third parties. If you are a student and an application has been made to use our services on your behalf by your parent or guardian, we collect the same information about you from them as we would collect if you applied to us yourself – see section 2.2.1 above.
2.2.4 We process such information
184.108.40.206 to help you to apply for and obtain places at educational institutions in the United States and to provide any other services your parent or guardian has asked us to provide;
220.127.116.11 to manage their account with us; and
18.104.22.168 to send you emails about our services.
What are the grounds for processing your information?
2.3 We are processing your data on the following grounds:
2.3.1 you have consented to the processing (this applies to the use of any health related, criminal offence related or other sensitive data);
2.3.2 the processing is necessary for the performance of the contract between you and us;
2.3.3 the processing is necessary for achieving our legitimate interests, being the provision of our services to you and the operation of our business. In accordance with data protection law, we have carefully weighed your interests and fundamental rights and freedoms against our interest to process your information and are satisfied that we are justified in processing your information for this purpose.
3 DURATION AND FURTHER PROCESSING
3.1 We only keep your information for so long as it is reasonably necessary. When setting our data retention periods, we consider the amount, nature, and sensitivity of the information we hold, the potential risk of harm from unauthorised use or disclosure of the information and the purposes for which we process the information (including whether we can achieve those purposes by other means). We also take into account our other legal obligations to keep or securely dispose of personal information.
3.2 Generally speaking, we retain your information for up to ten years after the end of the completion of our services to you, save for criminal record related data, which we destroy as soon as we have passed details on to the educational institution that requested it. All recorded sessions will be retained for up to 18 months before being deleted.
4 WHO IS YOUR INFORMATION SHARED WITH?
4.1 Your personal information is shared with:
- the educational institutions in the United States that you wish to apply to study at. We transfer it to these institutions (outside the European Economic Area) on the ground that it is necessary to perform the services you have contracted us to perform, or which your parent or guardian has asked us to perform in your interests;
- A-List Services LLC, an international organisation based in the United States providing tutoring services. This is necessary for the performance of the contract between us; and
- the third-party software platforms you are required to use as part of the services we provide, namely Canvas, BibliU and LinkIt. This is necessary for the performance of the contract between us.
4.2 It is possible that in the future we may share your personal data with a potential purchaser of our business, subject to such a person entering into strict confidentiality obligations with us and only to the extent permissible under data protection law.
4.3 We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
5 INTERNATIONAL TRANSFERS
5.1 Many of our external third parties are based outside the EEA so their processing of your personal data will involve a transfer of data outside the EEA.
5.2 Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
- Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
5.3 Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.
6 AUTOMATED DECISION MAKING
6.1 We do not make automated decisions about you based on your information.
7 YOUR RIGHTS
7.1 Under data protection law you have the following rights:
7.1.1 if we are processing your data on the basis of your consent then you have the right to withdraw that consent at any time. Consent can be withdrawn by closing your account with us/other details of consent withdrawal process and notifying us using the details set out in section 12 below. The lawfulness of our historic processing based on your consent will not be retrospectively affected by your withdrawal of consent;
7.1.2 the right to access a copy of your information which we hold. This is called a ‘subject access request’. Additional details on how to exercise this right are set out in section 9, below;
7.1.3 the right to prevent us processing your information for direct marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by contacting us using the details set out in section 12, below;
7.1.4 the right to object to decisions being made about you by automated means. We will inform you if your information is subject to automated processing;
7.1.5 the right to object to us processing your personal information in certain other situations;
7.1.6 the right, in certain circumstances, to have your information rectified, blocked, erased or destroyed if it is inaccurate; and
7.1.7 the right, in certain circumstances, to claim compensation for damages caused by us breaching data protection law.
7.1.8 in certain circumstances, the right to request the information we hold on you in a machine readable format so that you can transfer it to other services. This right is called ‘data portability’. Additional details on how to exercise this right are set out in section 9, below.
7.2 You also have the general right to complain to us (in the first instance) and to the Information Commissioner’s Office (if you are not satisfied by our response) if you have any concerns about how we hold and process your information. Our contact details are set out in section 12, below. The Information Commissioner’s Office website is www.ico.org.uk.
7.3 For further information on your rights under data protection law and how to exercise them, you can contact Citizens Advice Bureau (www.citizensadvice.org.uk) or the Information Commissioner’s Office (www.ico.org.uk).
9 ACCESS TO INFORMATION
9.1 Under data protection law you can exercise your right of access by making a written request to receive copies of some of the information we hold on you. You must send us proof of your identity, or proof of authority if making the request on behalf of someone else, before we can supply the information to you. Requests should be sent to Edward Smallwood who is contactable at 14 Waterloo Place, London SW1Y 4AR.
9.2 If you are requesting copies of documents you already possess, we may charge our reasonable administrative costs. We will also be allowed to charge you for our reasonable administrative costs in collating and providing you with details of the requested information which we hold about you if your request is clearly unfounded or excessive. In very limited circumstances, we are also entitled to refuse to comply with your request if it is particularly onerous.
10 DATA SECURITY
We will always store your digital information on secure servers. Unfortunately, however, the transmission of information via the internet is not completely secure. Although we will do our best to protect your information, we cannot guarantee the security of your information transmitted to our site or otherwise to our servers (such as by email). Any such transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.