1. INTRODUCTION
The Privacy Policy explains how we obtain, use and disclose your personal information (PI), in accordance with the requirements of the Protection of Personal Information Act No. 4, 2013 (POPIA). Cowan House Preparatory School (The School) takes data protection seriously and we are committed to protecting your privacy and to ensure that your PI is collected and used properly, lawfully and transparently.

2. PURPOSE
This document is the undertaking of the School to conform to the POPI Act. It provides detailed information about how we treat information that you provide to us. This policy guides the way in which all employees of the School are required to use, disclose and destroy PI appropriately, transparently, securely and in accordance with applicable laws. It also stipulates for what purpose this information will be used.

3. SCOPE
This policy and procedure applies to all employees, parents, pupils and service providers of the School.

4. PRINCIPLES OF COLLECTION
1. PI will only be obtained for lawful purposes;
2. PI will be processed in a reasonable manner that does not impinge on the privacy of the individual or organisation;
3. PI will only be collected as necessary for the School to conduct its business. The principle of minimality of collection will be applied;
4. The School undertakes to obtain written consent (email acceptable), wherever possible for the collection and processing of PI; however, there are instances where such consent may be tacit or verbal, and consent under these conditions should be recorded in writing at the time by the person collecting the PI;
5. PI will generally be collected directly from the data subject.

5. TYPES OF PERSONAL DATA WE COLLECT AND PROCESS
We collect and process PI about prospective, current and past members of the School community: pupils and their parents; staff, suppliers and contractors; friends and supporters; board members, donors and benefactors and other individuals connected to or visiting the School. The PI processed includes recorded information that is true and correct, and/or video and photographic images about an individual.

6. PURPOSE FOR WHICH WE PROCESS PERSONAL INFORMATION
The School processes PI to lawfully and legitimately support the school’s operation as an independent school. Our school collects PI about pupils and their families when necessary to:
– assess, select and admit pupils;
– educate pupils and support pupils’ learning process;
– administer pupils’ entries to the IEB and other third party assessments;
– monitor and report on pupil progress, including providing academic reporting on each pupil and publishing of results;
– provide references for current and past pupils;
– provide appropriate pastoral care, support pupils’ social and emotional wellbeing, and health;
– support operational management of the school including administration of pupil records; the administration of invoices, fees and accounts; the management of the school’s property; the management of security and safety arrangements (including the use of CCTV); management planning and forecasting; research and statistical analysis; the administration and implementation of the school’s rules and policies for pupils and staff; the maintenance of historic archives and other operational purposes;
– fulfil legal requirements;
– take reasonable steps to reduce the risk of foreseeable harm to pupils, staff and visitors (duty of care);
– make reasonable adjustments and support for pupils with special needs;
– provide a safe and secure working and school environment;
– communicate with parents about pupils’ schooling matters and celebrate the efforts and achievements of pupils;
– maintain the good order and management of the school;
– promote the school on our school’s website or school-controlled social media, the school prospectus, the newsletter, the annual School magazine, the Alumni newsletter on an ad hoc basis, and other publications and communications conducted by the school; and
– promote the school in local newspapers to celebrate the efforts and achievements of pupils.

Our school collects PI about staff, prospective staff and contractors when necessary for:
– the administration of staff records;
– the recruitment of staff;
– the engagement of contractors;
– administration of payroll, pensions and sick leave;
– staff appraisals;
– disciplinary procedures;
– administration of human resources records; and
– provide references.

7. PROCESSING/DISCLOSURE AND COMMUNICATION
Processing of PI will be conducted only where the purpose is consistent/compatible with the School’s activities and objectives inclusive of alumni relationship management. Your PI may be disclosed under the following circumstances:
– To our service providers who are involved in the delivery of products or services to you. They are required to comply with the provisions of the Act;
– Where we have a duty or a right to disclose in terms of law or industry codes;
– With respect to alumni, for institutional history and heritage purposes and to alumni colleagues for social purposes and retention of contact with their peers, as consistent with the objects of the CHAPPS constitution;
– Where such disclosure matches the legitimate purposes associated with each of the persons and organisations described above;
– Further processing, if lawfully warranted, will only be carried out where it is compatible with the purpose of collection.

In the context of providing education, information relating thereto, and alumni related activities, the School needs to employ the techniques afforded by modern electronic communication such as, but not limited to, specialist database platforms, bulk e-mails as well as other similar e-notification methodologies, and social media.

8. INFORMATION SECURITY
We are legally obliged to provide adequate protection for the PI we hold and to stop unauthorised access and use of PI. We regard all PI as confidential in nature and take all reasonable steps to prevent inappropriate disclosure whether accidentally or via unauthorised access. We have policies around the use of technology and devices, and access to school systems, for both our pupils and staff. We will, on an ongoing basis, continue to review our security control and related processes to ensure that your PI remains secure. In general terms, the School’s obligations will include:
– Minimising the number of electronic databases where PI is stored;
– Limiting and consolidating, where practical, the number of hard-copy records;
– Restricting access to hard-copy records;
– Instituting and maintaining a variety of electronic safeguards which include:
o Firewalls
o Secured “V-lans”
o Password protection
o Data encryption where appropriate and practical
o Securely shredding hard-copy data
o Destroying, de-identifying and deleting permanent electronic records
o Employing physical barriers such as locks, access control mechanisms and security cameras

9. YOUR RIGHTS
You have the right to:
– access and understand the PI we hold about you;
– access and understand the PI data we hold about your child/children;
– ask for the PI we hold about you and/or your child/children to be erased or amended (this is with limitations and exceptions as we may have lawful reason to hold such PI);
– withdraw consent to process your PI or your child/children’s PI (this is with limitations and exceptions as we may have lawful reason to process such PI regardless of consent)
For data access, please contact us in writing, or via electronic media, specifying what information you require. Please note that any such access request may be subject to a payment of a legally allowable fee. We also draw your attention to the procedure set out in our Promotion to Access of Information manual which is accessible on the School’s website.
We request that you regularly update us, in writing, of any changes to your PI so we may amend our records accordingly.

10. INFORMATION BREACHES
Where a reasonable breach of security has occurred, the School will be guided by S22 of the Act in notifying all specified persons and/or organisations. By handling such incidents efficiently and correctly, the impact on the reputation of the School, and other damage to the School can be managed. Implementing the necessary control measures in the case of an information or data breach is critical. The School’s Data Breach Policy gives further guidelines.

11. TRANS-BORDER INFORMATION FLOWS
The following types of activity give rise to trans-border PI flows in accordance with the specified purpose of the School. These include, but are not limited to:
– Pupils who are enrolled but who are normally resident outside South Africa. Alumni who are normally resident outside South Africa;
– The intention of pupils to enrol at educational institutions outside South Africa and where the provision of PI is necessary to facilitate enrolment.

12. COOKIES POLICY
The School (www.cowanhouse.co.za) uses cookies to enhance functionality and improve the user experience. The school website does not use cookies that give us access to any PI about the user. Third-party cookies are ones that are not set directly by the School, but they may be dropped onto your computer by a third party when you use one of our websites.