GDPR Policy

At Hubert Ogunde Memorial School, we are committed to fostering a global educational environment and engaging in international partnerships that enrich our students’ learning experience. As part of this vision, we ensure that our data protection practices not only comply with legal standards but are also forward-thinking and robust, keeping pace with the evolving global digital landscape.

With the implementation of this General Data Protection Regulation (GDPR) policy, we are taking proactive steps to safeguard personal data. This policy ensures that we maintain the trust of our stakeholders and meet the expectations of both local and international collaborators. By future-proofing our approach to data privacy, we aim to set a standard for excellence and compliance in education.

Why this policy exists

This policy exists because Hubert Ogunde Memorial School receives pupils transferring from schools in the United Kingdom. GDPR governs how the personal data those pupils bring with them, academic and pastoral records from their previous UK school, is handled once it reaches us. Day-to-day data processing within Nigeria is also governed by the Nigeria Data Protection Act (NDPA) 2023, overseen by the Nigeria Data Protection Commission (NDPC), which sits alongside this GDPR policy rather than being replaced by it.

Policy Scope

This policy applies to:

All staff, volunteers, students, parents, and third-party contractors associated with the school.
Any personal data processed by the school, whether stored electronically, on paper, or through other means.

Key Principles

Lawfulness, Fairness & Transparency

Personal data is processed lawfully, fairly, and transparently.

Purpose Limitation

Data is collected for specified, legitimate purposes and not further processed incompatibly.

Data Minimisation

Only the data necessary for the intended purpose is collected.

Accuracy

Data is kept accurate and up to date.

Storage Limitation

Data is stored only as long as necessary.

Integrity & Confidentiality

Data is processed securely against unauthorised access, loss, or damage.

Data Collected

We collect the following types of data (see also our Photo Policy):

Student Data: Name, date of birth, academic records, medical information, and emergency contact details.
Parent/Guardian Data: Name, contact information, and financial details for fee processing.
Staff Data: Employment records, qualifications, and performance reviews.
Third-Party Data: Information required to fulfil contractual obligations.

Legal Basis for Data Processing

The school processes personal data under the following lawful bases:

Consent: When explicit consent is given (e.g., marketing materials).
Contractual Obligations: To fulfil contractual agreements with staff, parents, and partners.
Legal Obligations: Compliance with educational and child protection laws.
Legitimate Interests: To deliver education effectively and ensure operational efficiency.

Data Subject Rights

Under GDPR, all individuals have the following rights. Tap each one to read more.

The Right to Be Informed ▼

Clear details about how personal data is used.

The Right of Access ▼

Access to the data the school holds about them.

The Right to Rectification ▼

Correct inaccuracies in their data.

The Right to Erasure ▼

Request the deletion of their data where applicable.

The Right to Restrict Processing ▼

Limit the way data is processed in specific situations.

The Right to Data Portability ▼

Transfer their data to another organisation upon request.

The Right to Object ▼

Oppose the processing of their data.

Rights Related to Automated Decision-Making and Profiling ▼

Safeguards against decisions made solely through automated processes.

Data Security

Hubert Ogunde Memorial School employs strict measures to protect data, including:

Encrypted electronic data storage systems.
Restricted access to sensitive information.
Regular staff training on data protection.
Immediate reporting and resolution of any data breaches.

Third-Party Sharing

We only share data with trusted third-party organisations when necessary, such as:

Government authorities (for compliance purposes).
Technology providers (for online learning platforms).
International partners (for exchange programmes, with explicit consent).

We ensure all third parties comply with GDPR standards through binding agreements.

Data Retention Policy

Data is retained only as long as required for its intended purpose. Specific retention periods include:

Record type	Retention period
Academic records	10 years
Employment records	6 months after employment ends
Financial records	10 years per regulatory requirements

Questions or want to exercise a data right?

This policy is reviewed annually. Contact our Data Protection Officer (DPO) at admin@ogundememorialschool.com.