ACG Website Privacy Policy 2022

Schools Policies & Procedures

Policy/Procedure Number: 606 Privacy Policy/Notice Policy Category: General Schools Policies and Procedures Last Updated: May 2022

AGENCY ACG SCHOOLS Support Office 117, 23 Edwin Street Mount Eden Auckland 1024 New Zealand ACG SCHOOLS are part of INSPIRED EDUCATION HOLDINGS LIMITED (“Inspired Group”), which is a company registered in England with Number 09268120 and registered address in Sixth floor, 3 Burlington Gardens, London, W1S 3ep, United Kingdom. INSPIRED operates numerous affiliated schools globally via its regional offices in United Kingdom, Europe, Africa, Middle East, Asia-Pacific and Latin America.

1. INTRODUCTION This policy is created according to the Privacy Act 2020 (Act) and the Information Privacy Principles (IPPs) and it aims to give you information on how we, ACG Education (also referred in this Policy as “our schools”), collect and process your personal data.

Personal data is referred to any information that relates to an identified or identifiable living individual and when collected together can lead to the identification of a particular person.

Our Privacy Officer can be contacted by email at the address privacy@acgedu.com if you have any queries regarding the processing of your personal data.

2. TYPES OF PERSONAL DATA WE PROCESS We process personal information from our students and their families or their legal representatives and also from our employees, candidates, suppliers, contractors, prospective customers and third parties that are legally authorised to act on their behalf.

The personal information processed are mainly the following: • • • • • • • •

Names, addresses, telephone numbers, e-mail addresses and other emergency and medical contact details; Nationality and location; Family details; Safeguarding information (such as court orders and professional involvement); Education and employment data; Schools previously attended, qualifications, recommendations and references; Images, audio and video recordings, including CCTV footage (video images); Financial information and educational centres previously attended.

Page 1 of 7 Privacy Policy/Notice Policy 606

Other types of data we may collect and process, according to our schools purposes and your consent, are related to health condition, criminal records and other sensitive information related to an individual, such as: • • • • • • • •

Medical history; Behavioural information; Special educational needs; Food intolerances or allergies; Criminal records linked to a specific individual; Biometric information; Ethnicity; and Religion or ideology.

3. HOW WE COLLECT AND PROCESS PERSONAL DATA ACG Education collects information directly from the individuals or legal authorised parties acting on their behalf in several ways, including: • • • • • •

Over the phone; Through our website; Through cookies used on our website we can collect login data, browsing behaviour, settings and actions in web applications ; From email and hand delivery paper documentation, including job applications, emails, invoices, letters, consent forms; Through online tools: such as apps, educational platforms and other software used by our schools; Through any CCTV cameras located at our premises or sites;

4. LAWFUL BASIS FOR PROCESSING YOUR DATA We process your data on the basis of the consent provided by you, as well as for the performance of a contract and to comply with the legal obligations that may derive from it. We may also process your data on the basis of a legitimate interest of ACG Schools when sending commercial communications about our activities.

5. PURPOSES FOR WHICH WE PROCESS PERSONAL DATA We have set out below, in tabular form, the ways in which we may use your personal data, and which of the legal bases we rely on to do so. Where appropriate, we have also identified our legitimate interests. Please note that we may process your data for more than one lawful purpose, depending on the circumstances and the specific purpose. Please contact us if you would like more detail about the specific legal ground which we are relying on to process your personal data, where more than one ground has been identified below.

Purpose/Activity

Type of data

To register you as a new customer

(a) Identity (b) Contact (c) Profile (d) Financial information

Page 2 of 7 Privacy Policy/Notice Policy 606

Lawful basis for processing including basis of legitimate interest Performance of a contract with you.

To provide educational services

To process and fulfil your contract, including: • managing payments, fees and charges; and • managing your queries – this may include recording calls or communications with our teams.

To collect and recover money owed to us in respect of your contract.

To carry out fraud assessments

Page 3 of 7 Privacy Policy/Notice Policy 606

(a) Identity To ensure that the student meets the (b) Contact school’s admission criteria; To provide (c) Profile educational services including the (d) Educational support of pupil learning, monitor and records report on pupil progress; To provide to (e) Health records the students welfare and pastoral care (f) Safeguarding services; To have a Student health information profile and to provide to the students (g) Family details medical and nurse attention accordingly; (h) Images, audio and To provide adequate catering service video recordings, and school transportation, among other including CCTV necessary services; To meet the footage (video educational, social, physical and images); emotional requirements of the student; To comply with the law regarding data sharing; To comply with legislative or administrative requirements; To provide School’s Summer Camp, Swimming activities, Trips or other extracurricular activities; To enable parents/guardians to be contacted in the case of emergency or in the case of school closure, or to inform parents of their child’s educational progress or about school events, etc.; To celebrate school’s achievements and to keep a record of the history of the school, the School may take photographs and recorded images of students to be shared in, e.g. yearbooks, school website, etc, always based on informed consent from parents or students of legal age; To send consented commercial communications. (a) Identity Performance of a contract with you. (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications (a) Identity (b) Contact (c) Financial (d) Transaction (a) Identity (b) Contact (c) Financial (d) Transaction (e) Technical

Performance of a contract with you.

Performance of a contract with you.

To notify you in relation to our legal obligations and documents, including changes to our terms or Privacy Policy To help us improve our offering to our customers, including asking you to leave a review or take a survey, or provide customer insights To enable you to partake in one of our awards or a competition

To administer and protect our business and websites (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) To deliver relevant website content, advertisements and other marketing material to you and measure or understand the effectiveness of the advertising we serve to you

(a) Identity (b) Contact (c) Profile

Performance of a contract with you.

(a) Identity (b) Contact (c) Profile (d) Marketing and Communications (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (a) Identity (b) Contact (c) Profile (d) Technical

Necessary for our legitimate interests (to study how customers use our products/services, to improve our offering to our customers, to develop them and grow our business).

Performance of a contract with you to fulfil the promotion and run the awards/competition. We may also subsequently use your entries for the legitimate interests of understanding our customer base more effectively.

Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise).

Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business to inform our marketing strategy and to improve our offering to you).

(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical To use data analytics to improve our (a) Technical website, products/services, (b) Usage marketing, customer relationships and experiences To make suggestions and recommendations to you about products or services that may be of interest to you

(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile CV received through our website, in (a) Identity the section “Career Opportunities” or (b) Contact by other means. It is also referred to (c) Professional employees backgrounds (d) References

Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy).

Necessary for our legitimate interests (to develop our products/services and grow our business, and to improve our offering to you).

Conducting the selection process, recruitment of staff, position assessment, management of human resources records, administration of payroll, pensions and sick leave, disciplinary actions, staff appraisals.

6. WITH WHOM DO WE SHARE YOUR PERSONAL DATA We do not share your personal information with others unless it is necessary for the purpose for which it is provided or is required by law.

Page 4 of 7 Privacy Policy/Notice Policy 606

7. CONSERVATION OF DATA Personal information will only be retained for the period of time required to fulfil the legal or business purposes for which it was collected. Once the period has expired, the information will be destroyed or made anonymous.

8. YOUR RIGHTS Under the, Privacy Act 2020 you have the right to access and correct your information by sending a written specific request, along with a copy of your ID card or equivalent, to the Privacy Officer’s email address privacy@acgedu.com.

ACG Schools will attend your request not later than 10 working days after the day on which the request is received.

9. MARKETING With your consent, your personal data will be used for direct marketing purposes. We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

-

Promotional Offers From Us

We may use your identity, contact, technical, usage and profile data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this “Marketing”).

You will receive marketing communications from us if you have requested information from us or purchased products (including publications) or services from us or if you provided us with your details when you entered a competition or registered for a promotion and, in each case, you have not opted out of receiving that marketing.

-

Opting Out

You can ask us to stop sending you marketing messages at any time by following the optout/unsubscribe links on any marketing message sent to you or by contacting us at any time at emarketing@acgedu.com.

Where you opt out of receiving these marketing messages, we will stop sending you marketing messages, but we will continue to process your personal data if there are legitimate grounds for further processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

10. USE OF PHOTOGRAPHS AND / OUR AUDIOVISUAL RECORDINGS Images are created for the purpose of sharing student achievements, skills, talents, celebrating pupil success and as a beautiful memory of each student’s time at our ACG Schools, as well as the day-today life of the school and the entire ACG Schools community. Photographs and video images may be used for internal and external purposes including external marketing.

Page 5 of 7 Privacy Policy/Notice Policy 606

Therefore, images may be used for internal magazines, publications and displays, they may be hosted on the ACG Schools and Inspired Education Group Websites and Social Media Channels, submitted to communications, publications and commercial actions through printed and online media outlets, used in ACG Schools’ publications and external marketing assets. Photography and videography of particular events and programs within ACG Schools are submitted to media and news outlets that occasionally cover special events within our Schools. Consent to use such images will be required through our Audiovisual Consent Form. You can withdraw your consent at any time and freely by submitting a written request to our Privacy Officer at: privacy@acgedu.com or at: emarketing@acgedu.com.

11. STORING AND SECURING INFORMATION ACG Schools shall use the appropriate technical and organisational measures to ensure the security, confidentiality, integrity and privacy of the personal data; preventing unauthorised access or unlawful processing, as well as accidental loss, destruction or damage of the files.

12. COOKIES USED IN OUR WEBSITE We use cookies to provide you with a better experience in the use of our website, as well as to store information about our visitors. This information is related to your session ID and are a way of monitoring single user access.

The Web server is allowed to remember some data concerning the user, such as his preferences for visiting the pages of this server, name and password, products that are more interesting, etc.

The Cookies that we use in our website and that require informed consent by the user are the functional cookies and the targeting cookies. Consent is not required for required cookies, which are those of a technical nature necessary for the operation of the website or the provision of services expressly requested by the user.

You can find more information https://www.acgedu.com/legal#cookiespolicy.

about

our

Cookies

policy

at:

13. COMMON USE WITH SOCIAL NETWORKS This site contains links to other websites such as platforms or social networks. ACG Schools are not responsible for the privacy practices or the content of such sites. You should be aware that the processing of your personal information is carried out by those sites and governed by their respective privacy policies.

If you do not want these sites to collect and process your information, please review their corresponding privacy policies and / or disconnect from it before using our Services.

14. MINORS ACG Schools will not collect and / or process information from individuals under legal age. Consent from parents or legal representatives will be always required.

Page 6 of 7 Privacy Policy/Notice Policy 606

15. COMPLAINTS If you consider we didn’t attend your requests or you believe we are processing your personal data disregarding the data protection regulations in force, please contact our Privacy Officer at: privacy@acgedu.com or you can address your complaint to the Privacy Commissioner at https://www.privacy.org.nz/your-rights/making-a-complaint/.

16.

PRIVACY NOTICE UPDATES:

ACG Education may update this privacy notice periodically so we recommend that you review this information from time to time.

Last Version May 2022

Page 7 of 7 Privacy Policy/Notice Policy 606