Privacy Notice

This Privacy Notice explains how St George’s College and Hartmann House Preparatory School (“we,” “us,” or “our”) collects, uses, shares, and protects the personal information of our learners, parents/guardians, staff, and website visitors. We are committed to protecting your privacy and handling your personal information in compliance with the Cyber and Data Protection Act [Chapter 12:07] (the “Act”) and its associated regulations.

This notice applies to personal information collected by us directly from you or from other sources.

1. Who We Are and Our Legal Status

St George’s College and Hartmann House Preparatory School is a data controller as defined by the Act, meaning we determine the purposes and means of processing personal information. We are regulated by the Data Protection Authority (Postal and Telecommunications Regulatory Authority of Zimbabwe – POTRAZ) and hold a valid data controller licence.

2. What Personal Information We Collect

We may collect and process the following categories of personal information as defined in Section 3 of the Act:

– Personal Identifiers: Name, address, date of birth, contact details (telephone number, email address), national identification number, and student number.

– Educational Information: Academic records, class schedules, attendance records, disciplinary records, and progress reports.

– Health Information: Medical history, allergy information, special educational needs, and information about physical or mental health.

– Demographic Information: Gender, race, or ethnic origin.

– Family Information: Details of parents, guardians, and emergency contacts.

– Correspondence: Any communications with the school, including emails and letters, which relate to home and family life.

– Technical Information (from website visitors): IP address, browser type, and device information.

– video images and audio (if applicable) through campus CCTV.

3. How We Collect Your Information

  We collect personal information in several ways:

– Directly from you (or your parent/guardian if you are a child): When you enrol at the school, fill out forms, attend meetings, or communicate with us.

– Indirectly: From other sources, such as previous schools, healthcare providers, or when information is provided for historical, archival, or educational purposes as permitted by the Act.

– Automatically: Through our website using cookies (where permitted) and Google Analytics.

– Campus wide CCTV

4. Why We Collect and Process Your Information (Lawful Basis)

Under the Act, we must have a legal justification for processing your personal information. The purposes for which we use your data include:

– To provide and manage educational services: This includes maintaining academic records, managing school operations, and communicating with parents and students. This is often for the performance of a contract or legitimate interests.

– To ensure safety and well-being: This includes managing health and safety protocols, providing pastoral care, and ensuring a secure environment for learners. This is often necessary to protect the vital interests of the data subject.

– To comply with legal obligations: This includes reporting data to government authorities (e.g., for education statistics or public health) as required by law.

Special Note on Processing Children’s Data:

Under the Act, a “child” is any person under the age of 18. A parent or legal guardian may exercise the child’s data protection rights on their behalf.

5. Sharing Your Information

We may share your personal information with data processors (see Appendices for a list of our data processors) for the purposes described above:

– Service Providers: Third parties who provide services on our behalf, such as payment processors, IT support, or cloud storage providers.

– Health Professionals: For the provision of care or medical treatment in the best interest of the data subject, under the supervision of a health professional.

– Legal and Regulatory Authorities: Where required by law, for the prevention of crime, or to comply with a legal obligation.

– Other Educational Institutions: For the transfer of records (e.g., when a student transfers to a new school or for sporting and cultural Activities, see Appendix B for a list of other educational institutions we share personal information with).

We do not sell your personal information to third parties.

6. Transborder Data Flows

We may transfer personal information to third parties in countries outside Zimbabwe (e.g., for data backup or using cloud-based services). We will only make such transfers if an adequate level of protection is ensured for the data in the recipient country or international organisation, or if one of the specific exceptions under Section 29 of the Act.

See Appendix A for Cloud Service Providers we share personal information with.

7. Data Security and Breach Notification

We have implemented appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, or destruction, as required by Section 18 of the Act and Regulation 16 of S.I. 155 of 2024.

We are required by law to notify the Data Protection Authority (POTRAZ) of any security breach within 24 hours of becoming aware of it. If the breach poses a high risk to your rights and freedoms, we will also notify you as soon as possible and within 72 hours.

8. Your Data Subject Rights

Under the Act, you or your parent/guardian (if you are a child) have the following rights regarding your personal information:

– Right to be Informed: You have the right to know how your data is being used (as outlined in this notice).

– Right of Access: You have the right to request access to the personal information we hold about you.

– Right to Object: You have the right to object to the processing of all or part of your personal information.

– Right to Rectification: You have the right to request the correction of false or misleading personal information.

– Right to Deletion: You have the right to request the deletion of false or misleading data about you.

To exercise any of these rights, please contact our Data Protection Officer (DPO) using the details provided in Section 11.

9. Data Retention

We will retain your personal information only for as long as necessary to fulfil the purposes it was collected for, including for legal, accounting, or reporting requirements. Our retention periods are in line with the principles of the Act which require that data is kept in a form which permits identification of data subjects for no longer than is necessary.

10. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or legal obligations. We will notify you of any significant changes by posting a notice on our website.

11. Contact Us and Complaints

If you have any questions about this Privacy Notice or our data protection practices, please contact our Data Protection Officers.

– Names: Chauya Isaac, Muhuru Loveson, Ziyageba Collen

– Email: compliance@stgeorges.co.zw

– Address: 3 Borrowdale Road, Harare, Zimbabwe