Data Privacy Policy

1. Scope

This policy applies to personal data collected through our website, online application forms, sponsor, student and staff portals, school management system, admissions, academics, attendance, welfare, finance, transport, library, communications, and related school administration.

We act as a data controller when we decide why and how personal data is processed. Where approved suppliers process personal data for us, they act as data processors and must handle the data only under our instructions and applicable law.

2. Personal Data We Collect

• Student and applicant details, including name, date of birth, gender, nationality, ID or passport number, grade, term, application status, and uploaded identification documents.
• Parent, sponsor, guardian, and emergency contact details, including names, relationship, contact details, ID or passport details, employer, profession, and billing responsibility information.
• Academic and school records, including classes, subjects, assessments, report cards, attendance, behaviour, learning support, activities, and portal activity.
• Health and welfare information, including allergies, medical conditions, disabilities, immunisation records, safeguarding records, and other information needed to protect a student.
• Financial and administrative data, including invoices, receipts, payment history, refunds, discounts, subscriptions, transport records, and account communications.
• Technical and security data, including login records, IP address, device or browser information, audit logs, uploaded files, and system usage records.

3. Why We Process Personal Data

We process personal data only where there is a lawful reason and a clear school purpose. These purposes include:

• receiving, assessing, and managing admissions and enrolment applications;
• providing education, pastoral care, assessment, reporting, learning platforms, school activities, transport, and administrative services;
• communicating with students, parents, sponsors, guardians, staff, suppliers, and regulators;
• managing fees, payments, refunds, accounting, procurement, and school records;
• protecting student safety, health, welfare, safeguarding, security, and emergency response;
• meeting legal, regulatory, audit, education, tax, employment, and record keeping obligations; and
• maintaining secure systems, preventing misuse, investigating incidents, and improving school services.

Depending on the context, our lawful bases may include consent, steps needed before entering into an enrolment or service relationship, performance of school obligations, compliance with law, protection of vital interests, public interest obligations, and legitimate school interests that do not override the rights and freedoms of the person whose data is processed.

4. Children and Sensitive Personal Data

Many records we hold relate to children. We handle student data with heightened care and restrict access to authorised staff, parents, sponsors, guardians, service providers, or authorities who have a legitimate need to access it.

Sensitive personal data, including health, welfare, biometric, disciplinary, criminal allegation, disability, and child-related records, is processed only where necessary, supported by consent or another lawful basis, and protected with stronger access controls and confidentiality measures.

5. Sharing Personal Data

We do not sell personal data. We may share personal data where necessary with:

• authorised school staff, management, teachers, administrators, and support teams;
• parents, sponsors, guardians, or emergency contacts with a legitimate relationship to the student;
• education bodies, examination bodies, government departments, regulators, law enforcement, courts, or public authorities where required or permitted by law;
• service providers supporting school operations, including school management software, hosting, email, SMS, payment, accounting, transport, document storage, and IT support providers;
• banks, auditors, insurers, professional advisers, and debt recovery or legal representatives where necessary; and
• medical, welfare, safeguarding, or emergency services where needed to protect a person.

6. International Transfers

Some technology or support providers may process or store data outside Botswana. Where this happens, we will take steps required by the Data Protection Act, 2024, such as using approved destinations, appropriate contractual safeguards, consent where required, or another lawful transfer mechanism.

7. Retention

We keep personal data only for as long as needed for the purpose collected, school administration, legal compliance, audit, dispute resolution, safeguarding, archiving, or legitimate educational records. When records are no longer required, we securely delete, anonymise, or archive them in line with school retention procedures and applicable law.

8. Security and Breach Response

We use appropriate technical and organisational safeguards to protect personal data from unauthorised access, accidental loss, alteration, disclosure, or destruction. These safeguards include role-based access, authentication, audit logs, secure file handling, backups, staff confidentiality expectations, and supplier controls.

If a personal data breach is likely to create risk for affected people, we will assess it promptly and notify the Information and Data Protection Commission without undue delay and, where feasible, within 72 hours after becoming aware of it. We will also communicate with affected individuals where required by law.

9. Your Rights

Subject to lawful limits, you may have the right to:

• be informed about how your personal data is processed;
• request access to personal data we hold about you or your child;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data where there is no lawful reason for us to keep it;
• request restriction of processing in appropriate circumstances;
• object to processing, including direct marketing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the Information and Data Protection Commission.

10. Contact Us

To ask a privacy question, exercise a data protection right, update your records, or raise a concern, contact the school administration using the details below.

11. Updates to This Policy

We may update this policy to reflect changes in our systems, school operations, or applicable law. The latest version will be published on this page.