Header Background Image

GDPR Policy

Learning & Discipline  »  GDPR Policy

At Hubert Ogunde Memorial School, we are committed to fostering a global educational environment and engaging in international partnerships that enrich our students’ learning experience.

As part of this vision, we ensure that our data protection practices not only comply with legal standards but are also forward-thinking and robust, keeping pace with the evolving global digital landscape.

With the implementation of this General Data Protection Regulation (GDPR) policy, we are taking proactive steps to safeguard personal data.

This policy ensures that we maintain the trust of our stakeholders and meet the expectations of both local and international collaborators.

By future-proofing our approach to data privacy, we aim to set a standard for excellence and compliance in education.

Policy Scope

This policy applies to:

  1. All staff, volunteers, students, parents, and third-party contractors associated with the school.
  2. Any personal data processed by the school, whether stored electronically, on paper, or through other means.

Key Principles

Hubert Ogunde Memorial School adheres to the following GDPR principles:

  1. Lawfulness, Fairness, and Transparency: Personal data is processed lawfully, fairly, and transparently.
  2. Purpose Limitation: Data is collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes.
  3. Data Minimisation: Only the data necessary for the intended purpose is collected.
  4. Accuracy: Data is kept accurate and up to date.
  5. Storage Limitation: Data is stored only as long as necessary.
  6. Integrity and Confidentiality: Data is processed securely to protect against unauthorised access, loss, or damage.

Data Collected

We collect the following types of data (read our photo policy also):

  • Student Data: Name, date of birth, academic records, medical information, and emergency contact details.
  • Parent/Guardian Data: Name, contact information, and financial details for fee processing.
  • Staff Data: Employment records, qualifications, and performance reviews.
  • Third-Party Data: Information required to fulfil contractual obligations.

Legal Basis for Data Processing

The school processes personal data under the following lawful bases:

  • Consent: When explicit consent is given (e.g., marketing materials).
  • Contractual Obligations: To fulfil contractual agreements with staff, parents, and partners.
  • Legal Obligations: Compliance with educational and child protection laws.
  • Legitimate Interests: To deliver education effectively and ensure operational efficiency.

Data Subject Rights

Under GDPR, all individuals have the following rights:

  1. The Right to Be Informed: Clear details about how personal data is used.
  2. The Right of Access: Access to the data the school holds about them.
  3. The Right to Rectification: Correct inaccuracies in their data.
  4. The Right to Erasure: Request the deletion of their data where applicable.
  5. The Right to Restrict Processing: Limit the way data is processed in specific situations.
  6. The Right to Data Portability: Transfer their data to another organisation upon request.
  7. The Right to Object: Oppose the processing of their data.
  8. Rights Related to Automated Decision-Making and Profiling: Safeguards against decisions made solely through automated processes.

Data Security

Hubert Ogunde Memorial School employs strict measures to protect data, including:

  • Encrypted electronic data storage systems.
  • Restricted access to sensitive information.
  • Regular staff training on data protection.
  • Immediate reporting and resolution of any data breaches.

Third-Party Sharing

We only share data with trusted third-party organisations when necessary, such as:

  • Government authorities (for compliance purposes).
  • Technology providers (for online learning platforms).
  • International partners (for exchange programmes, with explicit consent).

We ensure all third parties comply with GDPR standards through binding agreements.

Data Retention Policy

Data is retained only as long as required for its intended purpose. Specific retention periods include:

  • Academic records: Retained for 10 years.
  • Employment records: Retained for [6 months after employment ends].
  • Financial records: Retained for [10 years] per regulatory requirements.

Policy Updates and Contact Information

This policy is reviewed annually to ensure it reflects current laws and best practices. For questions or to exercise data rights, please contact our Data Protection Officer (DPO) at:

Email: admin@ogundememorialschool.com