Privacy Policy
Policy Owner: Head of IT
Date Approved: August 2026
Date of Next Review: August 2027
Your privacy is important to us. This Privacy Policy is where we explain to you what personal
information is collected when you visit our site, how it is collected, how we may use that
information, where we store it, how long we store it for, and how we protect it. We will also
explain your rights in relation to your personal information.
Please read the following carefully to understand our views and practices regarding your personal
information and how we may collect it and treat it.
For convenience, we have divided our data protection policies into three separate pages:
- Our Privacy Policy
This policy explains generally how we collect, use, store, and protect your personal information
when you visit our site.
- Our Cookie Policy
Our Cookie Policy is available here and explains more about how we may collect personal
information about you via cookies (it also explains what cookies are).
- Our Retention Policy
You can find out how long we may hold onto your personal information here.
If you have any questions please do not hesitate to contact us at contact@stleonards-fife.org or, if
you prefer to call or write to us, then you can find our contact details at the bottom of this page.
WHO WE ARE
We are St Leonards School. The School is a private company limited by guarantee and is
registered in Scotland with registration number SC016693. The company’s registered office
address is St Leonards School, St Andrews, Fife, KY16 9QJ. The School is also registered as a
charity with OSCR. The charity registration number is SC010904.
For the purposes of this Privacy Policy, it is easier if we refer to ourselves as ‘we’.
WHAT THIS PRIVACY POLICY GOVERNS
This Privacy Policy applies to our site, (www.stleonards-fife.org) and any other services that we
may provide to you through our site (we’ll just call these ‘our services’ for short).
In the context of this Privacy Policy ‘personal information’ means information which, on its own or
in combination with other information, can be used to identify you, in particular by reference to an
identifier such as your name, your address, or location data.
Because we are a school established in the United Kingdom, the personal information that you
give us or that we collect from you is held under UK data protection law, principally the UK
General Data Protection Regulation (UK GDPR) as amended by the Data (Use and Access) Act
2025, and the Data Protection Act 2018 (we will refer to this as ‘the legislation’). This law applies
across the whole of the UK, including Scotland. The legislation requires that we tell you that we
are a data controller for your personal information or, in other words, we determine the purposes
for which and the manner in which any of your personal information are, or are to be, processed
by us.
HOW YOU CONSENT TO US COLLECTING YOUR PERSONAL INFORMATION
When you visit our site you should see a pop-up at the bottom of your screen directing you to this
Privacy Policy and our Cookies Policy.
By clicking or selecting the ‘Learn More’ button that appears in the pop-up then you will be taken
to our policies, where you will have the right to disable cookies for our website if you so wish.
If you do not see a pop-up at the bottom of your screen then you may have already accepted our
Privacy Policy and our Cookie Policy. You may also be using a pop-up blocker or similar tools
that may prevent this policy from being brought to your attention. Please ensure that any pop-up
blockers are disabled when you use our site. We cannot be held liable to you if you use pop-up
blocks or similar tools that prevent us from complying with our obligations under the legislation.
Caveat: There is still some information that we may automatically collect about you – this
normally isn’t personal information but rather technical information sent by your device and used
to connect your computer, tablet, or mobile device to the Internet, including your browser type
and version, the time when you visit our site, your time zone setting, certain browser plug-in types
and versions, operating system and platform. This type of information is sent by you to our site
automatically and it isn’t something that we can prevent. We only use this information to
administer our site including troubleshooting, load testing, traffic throughout, data analysis,
performance testing, and for anonymised research and statistics purposes that we only use
internally.
We will only hold your personal information as detailed in our Retention Policy.
INFORMATION WE MAY COLLECT
You may give us personal information about you by filling in forms on our site or by corresponding
with us by phone, email or otherwise. This includes information you may provide to us when you
register to use our site, subscribe to our services, search our site, participate in any discussion
boards or other social media functions on our site, enter a competition, promotion or survey, and
when you report a problem with our site.
The information you give us may include:
- Your name and that of your child/children
- Child/children date of birth and current school
- Address
- Contact information (including email, telephone etc)
- IP Address
- Financial and credit card information
- Personal description
- Photographs and/or videos
Information we collect about you:
When you visit our site we may collect information about you, including which pages you have
visited (including date and time) which services and pages you viewed or searched for, page
response time, download errors, files downloaded, length of visits to certain pages, page
interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse
away from a page and any phone number used to call our contact number.
The purpose of this information is to allow us to administer our site and for internal operations,
including troubleshooting, data analysis, testing, research, improving our site to ensure that
content is presented in the most effective manner for you and for your computer, and as part of
our efforts to keep our site safe and secure.
Information we receive from other sources:
Data collected from any of the other sites we operate may be shared internally and combined with
data collected on this site. We are also working with third parties (including, for example, sub-
contractors in technical, payment and delivery services, analytical providers and credit reference
agencies) and may receive information about you from them.
We share personal data about our Alumni with the Alumni Relations and Development Team.
We do not sell personal data to other organisations for their own purposes.
Information you may pass to third-parties outside our control:
On many of the pages on our site you will see ‘social buttons’. These enable you to share or
bookmark pages on our site. These may include buttons forFacebook, LinkedIn, Instagram or
other social features.
In order for us to implement these buttons on our site and connect to the relevant social networks
and external sites, there are scripts that are executed from domains owned by third-parties and
outside of our control.
You should be aware that these sites are likely to be collecting information about what you are
doing all around the internet, including on our site. So if you click on any of these buttons, these
sites will be registering that action and may use that information. In some cases these sites will
be registering the fact that you are visiting our site, and the specific pages you are on, even if you
don’t click on the button but are already or automatically logged into their services, like Google
and Facebook.
We recommend that you check the respective policies of each of these sites to see how exactly
they use your personal information and to find out how to opt out, or delete, such personal
information.
If you are a parent of a pupil who attends our school, an alumni, a member of staff, or a pupil who
is 12 years or older and attending our school then this Privacy Policy will apply alongside our
additional privacy policies. These other policies would have been brought to your attention
separately, however, if you are unsure then please do not hesitate to get in touch with us.
HOW WE MAY USE YOUR PERSONAL INFORMATION
When you give us your personal information then we may use it to:
- Carry out our obligations from any contracts entered into between you and us and to
provide you with information that you request from us. - Provide you with information about our school.
- Ensure that content from our site is presented in the most effective manner for you and for
your computer.
If you provide us with your email, telephone or mobile number then we may contact you by these
electronic means (email or SMS). However, we will not use your personal information for
marketing purposes without your consent.
If you do not wish to receive any information by electronic means then please get in touch with
us.
Marketing
If you opt-in to receive information about us then, depending on what personal information we
hold about you, we may decide to contact you via email/post/telephone/SMS.
You may opt-in to receive general school information or we may ask you to opt-in on a case by
case basis.
We will do our best to let you know what method or methods of communication we will use. Don’t
forget, you can always opt-out from receiving communications from us after you have opted-in or
you can tell us that you only want to receive communications in a particular manner, or about a
particular element of the school. Depending on the type of campaign we might give you the ability
to select how you would like to be contacted but this might not always be possible due to
technical issues.
If you opt-in to receive communications then we may need to pass your personal information to
select third parties who are responsible for facilitating communication with you on our behalf. For
example, we may need to pass some of your personal details if you wish to be contacted via SMS
because we need to partner with a third party business to provide us with this ability. We may use
some organisations on a one-off basis, in which case we will let you know.
The purpose of opting into receiving communications from us is to help us better understand you,
engage with you, share details about the school, and to assist us in providing the types of
communications that you wish to receive from us. We will not knowingly sell your personal
information for marketing purposes or pass your information to third parties.
If you are receiving communications from us in error or you have opted-out then please get in
touch with us and we apologise for any inconvenience caused.
DISCLOSURE OF YOUR INFORMATION
We may share your personal information with any member of our group, which means our
subsidiaries, our ultimate holding company and its subsidiaries. The reason for this is that
different parts of the school are responsible for different functions within the school and we need
to be able to freely pass your personal information within these various units for operational
efficiency.
Although we may share your personal information within members of our group, this does not
mean that we will use it for advertising or marketing purposes. Unless you opt-in to receive
marketing communications, we will not contact you unless it is necessary for us to get in touch
with you. For example, we may need to get in touch with you if you asked us to provide you with
further information about your potential attendance at our school.
Please remember that our Cookies Policy covers matters such as using your personal information
for analytics purposes.
In some cases we may disclose information about you with select third-parties:
- We may anonymise and aggregate your information with other users (for example, we
may track that 500 men aged under 20 have clicked on a specific page on our site on any
given day). - We may use such aggregate and anonymised information to help reach a
particular target audience or understand who uses our site. - Credit reference agencies for the purpose of assessing your credit score where this is a
condition of us entering into a contract with you or providing you with services. - Debt collection agencies where you have breached a condition of any contract entered
between us and you. - If we or substantially all of our assets are acquired by a third party, in which case personal
information held about you may be one of the transferred assets. - If we are under a duty to disclose or share your personal information in order to comply
with any legal obligation, or in order to enforce any agreements with you, or to protect our
rights, property, or safety of our pupils, our employees, or others.
WHERE WE STORE YOUR PERSONAL INFORMATION
The personal information that we collect from you will be stored with the United Kingdom and the
European Economic Area. We will not knowingly transfer your personal information outside of the
European Economic Area. Where it may be necessary for us to transfer your personal information
outside of the European Economic Area we will get in touch with you and seek your consent.
All personal information you provide to us is stored on our secure servers. Where we have given
you (or where you have chosen) a password which enables you to access certain parts of our
site, you are responsible for keeping this password confidential. We ask you not to share a
password with anyone.
Unfortunately the transmission of information via the internet is not completely secure. Although
we will do our best to protect your personal information, we cannot guarantee the security of our data transmitted from our site and any transmission is at your own risk. Once we have received
your personal information, we will use strict procedures and security features to try to prevent
unauthorised access. We apply a ‘Privacy by Design’ approach to protecting your personal
information in order to promote privacy and data protection compliance from the start.
YOUR RIGHTS
You have the right to ask us not to process your personal information or to restrict the purposes
for which we may process your personal information. However, if you have an account with us on
our site and you withdraw your consent then we reserve the right to suspend or terminate your
access to certain parts of our site.
You can exercise your right to prevent processing of your personal information by not selecting or
clicking on the ‘I Agree’ button when you visit our site or when you login or create an account on
our site.
You can also exercise your right at any time by contacting us. If you consented to us collecting
and/or processing your personal information but you change your mind then you can get in touch
with us about erasing the personal information we hold about you.
Please be aware that, even if we receive a request from you to delete your personal information,
it may be that we cannot entirely remove all of your personal information. This is usually because
we have a legitimate interest to hold onto some of that personal information, for example, if you
have an ongoing contract with us, there are outstanding payments due to you by us, the personal
information relates to a third-party such as a pupil who attends our school, or we have a legal
obligation to retain some or all of your personal information – but we’ll let you know.
ACCESS TO INFORMATION
The legislation gives you the right to access a copy of the personal information that we hold about
you.
In order to request a copy you need to submit a request – details on how to get in touch can be
found at the bottom of this page. However, please remember that certain types of data cannot be
disclosed to you as part of your request. For example, we cannot disclose information to you
which identifies another individual or information that may be subject to legal professional
privilege. In many cases, we may be required to redact some of the documentation that you
receive in order to comply with the legislation.
Additionally, we cannot just release your personal information to anyone. We can only release
your personal information to you or an authorised third party who can demonstrate that you
consented to have your personal information release – this is a legal requirement. Therefore, it is
important for us to ensure that we confirm your identity before we can release any personal
information.
If you send us a request to provide you with a copy of your personal information then we may ask
you to provide some identification. We may ask you to provide a copy of your current and valid
passport and/or driving licence plus a utility bill (that is no more than three months old) and has
your current address. We may also ask you to visit one of our offices or obtain a solicitors or
notary publics’ confirmation of your identification.
Under the Data (Use and Access) Act 2025, when responding to a request to access your
personal information we are only required to carry out searches that are reasonable and proportionate in the circumstances. This means we will take into account factors such as the
nature of the information sought, the context in which it is held, any difficulty involved in locating
it, and the potential benefit to you of receiving it.
We try to respond to all legitimate requests within one month. Where we have asked you for
identity verification or clarification, that response period is paused (‘stopped’) while we wait for the
information we have requested, in line with the Data (Use and Access) Act 2025. Occasionally it
may take us longer than one month if your request is particularly complex or you have made a
number of requests, in which case we may extend the response period by up to a further two
months and will notify you within one month, explaining why.
WHAT IF I DO NOT CONSENT OR WITHDRAW CONSENT?
If you do not consent to us collecting your personal information then we cannot guarantee the full
functionality of our site and cannot be held responsible or liable to you for any reduction or
restriction in access to our site or any of our other services.
Our site may, from time to time, contain links to and from the sites of our partners and affiliates. If
you follow a link to any of these sites, please note that these sites have their own privacy and
cookie policies and that we do not accept any responsibility or liability for these policies. Please
check these policies before you submit any personal information to these sites.
HOW LONG WILL YOU HOLD ONTO MY PERSONAL INFORMATION?
Depending on how you engage with us it may be necessary for us to store your personal
information for shorter or longer periods of time. Either way, we will only store your personal
information for a legitimate and lawful reason. Please remember that this Privacy Policy only
applies to how we may collect, store, use, and retain your personal information when you visit our
site. If you are a parent of a pupil or you are a pupil who is 12 years or older and attend our
school then you will be bound by the terms of additional policies that specifically relate to how we
may use your personal information.
You can find details on how long we may hold onto your personal information on our Retention
Policy which can be found here.
CHANGES TO OUR PRIVACY POLICY
We may need to change this Privacy Policy if it is necessary for legal reasons or to reflect
changes to our site and services. In any case, the provisions of this Privacy Policy may be
changed without prejudice to your rights. When we change our Privacy Policy we will make the
updated Privacy Policy available on our site and we will also update the ‘Last Updated’ date.
When we change our Privacy Policy, the updated version will apply from the date it is posted on
our site. Where a change materially affects your rights, it will take effect a reasonable period after
we post it, and during that period you are welcome to contact us with any questions about the
changes.
If you don’t agree with our changes to the Privacy Policy (regardless of whether you get in touch
with us) then unfortunately we may need to restrict or limit your use of the parts of our site that
require your personal information in order for us to deliver our services to you. We are sorry we
have to say that, but we hope you will appreciate that in order for certain parts of our site to work
properly and in order for us to identify you in connection with our services we need to have everyone using our sites and our services under the same rules instead of different people having
different rules – that is why we encourage you to get in touch with us if you have queries.
CONTACT US
This Privacy Policy was prepared with brevity and clarity in mind. It does not provide exhaustive
detail of all aspects of our collection and use of your personal information. However, we are
happy to provide additional information or explanation as needed.
If you have any questions, comments or requests regarding our Privacy Policy then please do not
hesitate to get in touch with us. To make things easier for both of us we would appreciate it if
your queries were addressed to:
PRIVACY TEAM
ST LEONARDS SCHOOL
ST ANDREWS
FIFE
KY16 9QJ
contact@stleonards-fife.org
+44 (0) 1334 472126
COMPLAINTS
If you have a complaint about how we handle your personal information, we ask that you contact
us first so that we can try to resolve it for you. You can submit a data protection complaint to us
by emailing us at contact@stleonards-fife.org.
We will acknowledge your complaint within 30 days of receiving it. We will investigate it without
undue delay, keep you informed of our progress, and communicate the outcome to you clearly,
with sufficient detail for you to understand how we reached our conclusion.
If you are not satisfied with the way that we have handled any of your requests or queries relating
to our use of your personal data then you can contact the Information Commissioner’s Office at
www.ico.org.uk. The Information Commissioner’s Office is the statutory body responsible for
overseeing data protection legislation and law in the United Kingdom.
