DATE February 2025
REVIEW DATE February 2026
Owner Data Protection Officer
Version Number: Ver 01
Working Date:
Legal Sign-off by: N/A
Type of Policy: Exec
Authorised by Exec: 27/02/2025
Authorised by Board: N/A
Effective date of Policy: February 2025
Circulation: Internal, External
INTRODUCTION
1.1 At Jumeirah English Speaking School (‘JESS’) we value the rights and freedoms of all people. This includes respecting your privacy and protecting your personal data. This Privacy Notice describes how we collect and use (or "process") your information. It also tells you how to contact us as well as outlining what rights you have regarding your personal data.
WHO ARE WE?
2.1 JESS is a not-for-profit school located in Dubai, United Arab Emirates. JESS provides education to children between the ages of 3 – 18 years old and regulated by the Dubai Knowledge and Human Development Authority.
WHAT IS THE PURPOSE OF THIS PRIVACY NOTICE?
3.1 The purpose of this Privacy Notice is to provide detailed information about how we process personal data from visitors to the JESS website.
3.2 This Privacy Notice should be read in conjunction with other JESS policies and terms and conditions which refer to personal data, including the Data Protection Policy and CCTV Policy.
3.3 Please read this notice carefully and if you have questions regarding your personal data or its use, or if you consider your personal data is not being used appropriately in accordance with this policy, please contact the Data Protection Officer.
3.4 JESS will update this Privacy Notice from time to time. Any substantial changes that affect how we process your personal data will be notified on the website and to you directly, as far as practicable.
WHAT IS PERSONAL DATA?
4.1 The term ‘personal data’ refers to any information which identifies you or can be used to identify a data subject when used in conjunction with other information.
4.2 The term ‘data subject’ describes the person about whom the personal data is about.
WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU?
5.1 JESS processes personal data about visitors to the website; prospective, current and past: students and their parents; staff and contractors; supporters and other individuals connected with or visiting the school.
5.2 The personal data we process takes different forms, for example:
5.2.1 IP addresses, location data, and website statistics and analytics;
5.2.2 website cookies;
5.2.3 if enrolling or registering your child in JESS the following information may be collected from you:
(a) you and your child’s personal information such as names, addresses, telephone numbers, e-mail addresses, employment data, emergency contact information date of birth, nationality, gender, religion, photo, passport, government issued ID, your child’s health and family health information;
(b) academic, disciplinary and other education related records, references, examination scripts and marks;
5.2.4 if employed or seeking employment with JESS, or an organisation with whom the School has a business relationship, the following information may be collected from you:
(a) personal information such as names, addresses, telephone numbers, email addresses, employee data including recruitment, training, performance management, payroll, and other HR information.
5.3 As a school, from time to time we also need to process personal data which is designated as “sensitive” or “special category personal data” to facilitate the school operations and activities. Such data includes personal data regarding a data subject concerning:
5.3.1 Health;
5.3.2 Special education needs;
5.3.3 Information relating to safeguarding and child protection/welfare;
5.3.4 Race ethnicity; or
5.3.5 Religion.
HOW DO WE OBTAIN YOUR INFORMATION?
6.1 JESS collects most of the personal data it processes directly from the data subject concerned (or parents in the case of students). In some cases, JESS collects data from third parties (e.g. referees/references and previous schools) or from publicly available resources.
6.2 We also collect data about you when:
6.2.1 You have expressed an interest in having a student attend our school;
6.2.2 You have registered to attend (or have attended) one of our events;
6.2.3 You visit our website;
6.2.4 You sign up to receive emails, our newsletters and/or prospectus;
6.2.5 You have expressed an interest in working for, or with JESS; or
6.2.6 You are employed by us or an organisation with whom we have a business relationship.
HOW DO WE USE YOUR PERSONAL DATA?
7.1 Whenever JESS use (or “process”) any personal data (sensitive/special category or otherwise), it does so in accordance with applicable laws and regulations (including with respect to safeguarding or employment). Personal data held by JESS is processed by appropriate members of staff for the purposes for which the data was provided.
7.2 JESS takes appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to school systems.
7.3 JESS will provide information to each student/parent (which can include relevant personal data of the respective child) as necessary to facilitate school operations.
7.4 In the course of school business, JESS shares personal data (including special category personal data where appropriate) with third parties such as examination boards, government and regulatory authorities and accrediting boards. JESS may also be required to share your personal data with other organisations for legal or statutory purposes, or where we have your consent to do so.
7.5 Some school systems are managed or operated by third parties (e.g. hosted databases, school website, school calendar, student information system or cloud storage providers). Third parties must adhere to equivalent data protection principles and contractual assurances are in place to ensure that personal data will be kept securely and only in accordance with the school’s specific directions. We do not transfer personal data you have provided unless we are satisfied that the personal data will be afforded an equivalent level of protection.
7.6 JESS may transfer data to other countries but in doing so will rely either on the existence of adequacy agreements or upon standard contractual clauses as part of agreements with data processors. For more information on how we transfer data to other countries is available upon request by contacting the Data Protection Officer.
PURPOSES FOR WHICH WE PROCESS PERSONAL DATA
8.1 JESS processes personal data to support the operation as an independent school, and uses the data for:
8.1.1 the selection and admission of students.
8.1.2 the provision of education and enrichment to students, including the administration of school curriculum; monitoring student academic progress and educational needs; reporting internally and to parents; administration of students’ entries to public examinations, and providing references for students (including after a student has left).
8.1.3 the provision of educational support and related services to students.
8.1.4 the safeguarding of students’ welfare and provision of pastoral care, welfare, health care services and support.
8.1.5 the provision of a safe and secure environment for students, staff, and visitors.
8.1.6 compliance with legal and regulatory requirements.
8.1.7 operational management including the compilation of student records; the administration of invoices, fees and accounts; the management of school property; the management of security and safety arrangements (including the use of CCTV in accordance with our CCTV Policy and monitoring of the school’s IT and communications systems in accordance with the Acceptable Use Policy; the administration and implementation of the school’s rules and policies for students and staff; and the maintenance of historic archives.
8.1.8 staff administration including the recruitment of staff/engagement of contractors; administration of payroll, pensions and sick leave; review and appraisal of staff performance; conduct of any grievance, capability or disciplinary procedures; and the maintenance of appropriate human resources records for current and former staff; and providing references.
8.1.9 analysing website traffic, demographics and behaviour through the use of analytical tools and cookies.
8.1.10 the promotion of JESS through the website and other publications and communications (including through JESS social media accounts).
8.1.11 maintaining relationships with JESS alumni and former employees.
8.1.12 for keeping a record of historical and memorable events relevant to the maintenance of a historical record.
WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA?
9.1 JESS may process your personal data for the above purposes based one or more of the following legal basis:
9.1.1 Consent: if we have an individual’s consent to do so (or their parent’s, if appropriate).
9.1.2 Contractual: for the performance of a contract e.g. employment contract.
9.1.3 Legal obligation: to comply with legal obligations e.g. to fulfil safeguarding duties to students and staff.
9.1.4 Vital interest: e.g. to prevent serious harm to someone
9.1.5 It is necessary for the establishment, exercise or defence of legal claims
9.1.6 It is necessary for medical purposes, including medical diagnosis and the provision of health care or treatment for students, managing related health care systems, and/or for assessing the working capacity of employees.
9.1.7 It is necessary for archiving, research or statistical purposes.
CONSENT
10.1 Under data protection laws, the rights belong to the individual to whom the data relates (i.e. the data subject). However, where consent is required as the lawful bases for processing personal data relating to students we will rely on parental consent.
10.2 In general, JESS will assume that students’ consent is not required (and that other lawful bases are more appropriate, as described above) for ordinary disclosure of their personal data to their parents, e.g. for the purposes of keeping parents informed about the student’s activities, progress and behaviour, and in the interests of the student’s welfare, unless, in the school’s opinion, there is a good reason to do otherwise
10.3 However, where a student seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, we may be under an obligation to maintain confidentiality unless, in our opinion, there is a good reason to do otherwise; for example where the school believes disclosure will be in the best interests of the student or other students, or is required by law.
WHAT ARE OUR RESPONSIBILITIES FOR LOOKING AFTER YOUR PERSONAL DATA?
11.1 In every case, when we are collecting or using personal data we will comply with the requirements of UAE Data Protection Laws
WHAT RIGHTS DO YOU HAVE OVER YOUR PERSONAL DATA?
12.1 Under data protection laws, you have the right to:
12.1.1 obtain access to, and copies of, the personal data held about you (subject to legal exceptions).
12.1.2 correct the personal data held about you if it is incorrect.
12.1.3 require JESS to erase your personal data in certain circumstances.
12.1.4 require JESS to restrict its data processing activities in certain circumstances.
12.1.5 receive from JESS the personal data held about you which you have provided, in a reasonable format specified by you, including for the purpose of your transmitting that personal data to another data controller.
12.1.6 object, on grounds relating to your particular situation, to any particular processing activity where you feel this has a disproportionate impact on your rights (including a right to object to receiving communications, and to object to profiling you for the purposes of keeping in touch).
12.1.7 where the processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of the processing based on consent before its withdrawal
12.2 If you would like to exercise any of your rights, please contact the Data Protection Officer. Please note that these rights are not absolute, and JESS may be entitled or required to refuse requests where exceptions or exemptions apply. JESS will respond to any such written requests as soon as is reasonably practicable and in any event within statutory time limits
HOW DO WE RETAIN AND STORE YOUR PERSONAL DATA?
13.1 All personal data is securely stored in accordance with UAE Data Protection Laws JESS retains personal data only for legitimate purposes, relying on one or more of the lawful bases as set out above, and only for so long as necessary for those purposes, or as required by law.
COOKIES
14.1 Cookies are small files of information that a web server generates and sends to a web browser to overall enhance your internet experience:
14.1.1 Identification: When you visit a website, the server creates a unique identifier (an “ID”) for your computer. This ID is stored in a cookie.
14.1.2 Personalisation: Cookies allow websites to remember you. They help personalize your interactions by remembering your logins and preferences.
14.1.3 Session Tracking: Cookies track your session, enabling seamless navigation across different pages on the website
14.2 JESS uses cookies solely to enhance your browsing experience and provide essential functionality. Here’s how we use them:
14.2.1 Authentication: Cookies help us recognize you when you log in, ensuring a smooth user experience.
14.2.2 Analytics: We use cookies to collect anonymous data about website traffic and user behaviour. This information helps us improve our content and services.
14.2.3 Session Management: Cookies allow us to maintain your session while you navigate our site.
14.3 Privacy and Security
14.3.1 No Third-Party Sharing: JESS does not sell or transfer any cookie data to third parties. Your privacy is our priority
14.3.2 Consent: By using the JESS website, you consent to the use of cookies as described in this policy. You can manage your cookie preferences through your browser settings, however note that disabling cookies may impact full functionality on the website
CONTACT US
15.1 If you would like to exercise any of your rights under data protection law for which we are the data controller, or if you have questions, requests or issues, please let us know how we can help by contacting our Data Protection Officer at dataprotection@jess.sch.ae.
15.2 We try to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Please notify dataprotection@jess.sch.ae of any significant changes to important information, such as contact details, held about you.
15.3 Controller details:
JESS Dubai PO Box 24942 Dubai, UAE