Privacy Policy

Privacy Policy

In the course of the services that The Banda School provides, we will process personal data relating to you and your children. With regard to such processing, The Banda School will qualify as data controller.

In this capacity, The Banda School strives to comply with applicable data protection regulations on the protection of privacy in relation to the processing of personal data, as may be amended from time to time. The Banda School Privacy Notice (hereafter ‘Notice’) explains how we collect and use personal data, who we share it with and the ways in which we protect your privacy whilst doing so. This Notice applies to all personal data collected for and on behalf of The Banda School. This pertains to both information collected in analogue form (forms, documents, in writing) and through technological means, such as information systems and email.

From time to time, we may make you aware when we require additional personal data for processing activities through a separate specific privacy notice.

The Banda School reserves the right to make changes to this Notice from time to time, but will always inform you of such changes in advance. In any event, it is recommended that you consult this Notice regularly.

1. Collection of Personal Data

We may collect your personal data in a variety of ways:

• Personal data relating to you or your children can be obtained directly from you or your children through, but not limited to, completing the Admissions Form; Health or Consent forms; via information provided on the Parent Portal; and via meetings with teaching staff.
• Personal data relating to you or your children can also be obtained via other information channels, such as previous schools, health professionals and social media channels.
• Personal data relating to you or your children may also be obtained by actions of The Banda School itself or its data processors; for example, through evaluations and camera surveillance.

2. Use of Personal Data

The Banda School collects personal data, including special categories of personal data of pupils and parents, to provide a safe and caring environment for teaching, learning and general educational purposes.

More specifically, we process your or your children’s personal data for the following (but not limited to, purposes) and other purposes that are compatible with the purposes described below:

• to undertake and manage school admissions and enrolment;
• to provide a safe and secure learning environment;
• to comply with child protection requirements;
• to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of progress;
• to provide educational services;
• to provide support and care for emotional and psychological wellbeing (pastoral and counselling);
• to protect the health of the pupils and staff we serve;
• to provide a tailored learning environment and make evidence based educational decisions for the children we serve;
• to enable the children we serve to continue or progress their education at other educational organisations;
• to support and develop our employees in the performance of their duties;
• to assist future financial planning and for resource investment purposes;
• to meet our statutory reporting requirements to various authorities, educational and otherwise;
• to help investigate any concerns or complaints you may have affecting the school in general;
• to build and maintain the The Banda School community, including the PTA;
• to make you aware and inform you about services, news, events and activities that are undertaken at or in association with The Banda School;
• to communicate with you within the framework of your relationship with The Banda School;
• to ensure the safety and security of pupils and staff, including camera surveillance;
• to forecast and plan for education service provision;
• to respond to requests from our staff and (former) pupils regarding historic information pertaining to their time at The Banda School;
• for marketing purposes; for example, including photos of pupils in our brochures and on social media (a separate parental consent will be requested once a pupil has enrolled at the school).

3. Basis for processing Personal Data

The collection and use of personal data is done to carry out the education services prescribed above. We do so under the lawful basis that the processing is necessary for the performance of a contract in which you are entering or have entered into. In some circumstances, we may have to process data for other purposes that are not necessary for the performance of the contract. In such cases, the processing may be based upon:

• our legitimate interests, such as providing a safe learning environment;
• the protection of you or your children’s vital interests;
• compliance with our legal obligations;
• the consent you or your children may have provided to us.

4. Categories of Personal Data

The categories of Personal Data that The Banda School collects and processes include:

• personal information (such as name, unique number and address);
• special categories of data (such as health information and ethnicity);
• educational and evaluation data (such as assessments, relevant medical information, special educational needs information, behavioural information and psychological reports and assessments);
• attendance information (such as sessions attended, number of absences and absence reasons);
• logging and audit in the use of IT systems and education technology apps, applications and cloud based systems;
• communication and correspondence data (such as emails, letters and other types of correspondence);
• photographs and videos (see also section 9 and 10 of this Notice).

Special Categories of Data

The education services we provide require us to collect and process special categories of data, such as health information, for the purposes of safeguarding the protection of your children and the wellbeing of those within our care. We do not disclose or share special categories of data without explicit and unambiguous consent, unless we have to do so where we are required to by law, where we have good reason in protecting the vital interests of an individual or where not doing so would place someone else at risk.

5. Storing Personal Data

We keep personal data for as long as necessary with regard to the purposes described in Section 2 of this Notice or for any other purposes that may be communicated to you.

In general, your personal data is stored on our own servers and on the secure servers of our data service providers, such as Engage. The School does not guarantee the availability of the servers to third parties.

6. Sharing and Transfer of Personal Data

Your personal data will be shared internally within The Banda School for the purposes of delivering the services required.

For the purposes described in Section 2 of this Notice, The Banda School may need to share your personal data externally with certain recipients, as well as with third parties processing your data on behalf of The Banda School. This means that the personal data, including special categories of data, may be transferred outside of Kenya, including the UK and the EU (and, for example, any additional territories where a pupil’s transferring school is located).

Section 7 – Technical and Organisational Measures – provides further information as to what steps we take to ensure that your transferred data is properly secured.

More specifically, this includes the following categories of recipients:

• schools that the pupils attend after leaving The Banda School and other international schools (for example, for the purposes of trips, sports and activities);
• family nurses, doctors or social service organisations (where sharing is in the individual’s vital interests or where not sharing could have a negative impact on the individual);
• providers of information systems that are necessary for The Banda School to deliver the admissions, administration, teaching and learning, pastoral development, mental health and wellbeing assessments, and child protection services;
• providers of IT hosting and maintenance services;
• government organisations, the police and health and social care (where we are required to do so by law or where we have obtained your consent to do so).

Personal data may also be transferred to other data processors. For such transfers of personal data, The Banda School has implemented suitable safeguards.

7. Technical and Organisational Measures

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Where appropriate, such measures include access controls, strong passwords, pseudonymising, anonymising and encrypting personal data, and ensuring that our employees are well trained on how to handle personal data.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties on a need-to-know basis. They will only process your personal data on our instruction and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Cookies

When you view the school website, some information may be stored on your computer. This information will be in the form of a ‘cookie’ or similar file and will allow the website to tailor the experience to your interests and preferences. With most Internet browsers, cookies can be blocked or erased after visiting a website. Some aspects of the school website may not function properly if your browser is set to block cookies.

9. Camera Surveillance

We collect information in the form of camera footage via our CCTV systems to ensure the safety and security of pupils, staff and parents. We retain these CCTV images for twenty days, after which they are deleted, unless we need to retain the images for further investigation or law enforcement purposes.

10. Photographs and Videos

Photographs and videos of your children may be taken by staff and pupils throughout the school year to record and share everyday life at The Banda School. Your child may be identifiable in these photographs or videos. Identifiable photographs of your child may be used for:

• educational and informational purposes (such as keeping records of lessons, field trips, sports, events, staff training) as we have a legitimate interest to do so;
• the identification of your child for health related purposes, such as allergies, as it is in the vital interest of your child to do so; 
• marketing and publication purposes, if (and to the extent to which) we have obtained you and/or your child’s consent where required under applicable data protection legislation to do so.

If such photographs and videos reveal any sensitive personal data of you or your child, we will only process and use such photographs and videos if (and to the extent to which) we have obtained you and/or your child’s consent where required under applicable data protection legislation to do so.

The Banda School holds copyright to such photographs and videos, and infringement of the same may result in legal action being taken by The Banda School.

11. Your Rights

Parents and pupils may exercise a number of rights with regard to the processing of their personal data.

The first point of contact in connection with the processing of personal data and the exercise of the rights described below is The Banda School Privacy contact ([email protected]). The Banda School shall respond to such requests and may or may not act upon them, in principle within a period of one month, all in accordance with applicable data protection legislation.

The rights which you may have under applicable data protection legislation are:

• Right to object – on grounds relating to your particular situation to the processing of personal data based on the legitimate interests of The Banda School and the right to object to the processing for direct marketing purposes.
• Right to information and access – to request access to and a copy of the personal records The Banda School holds on you within our data management systems. This Notice serves to inform you thereon, but please email if you have any questions.
• Right to rectification – to correct inaccurate personal data or to complete incomplete personal data.
• Right to erasure – to request the deletion or removal of personal data in specific circumstances; for example if your personal data is no longer necessary for the purposes pursued by The Banda School or if there is no longer a legal ground for the data processing.
• Right to restriction of the processing – to limit the processing; for example, where you have told us the data is inaccurate and we are in the process of checking this (in such circumstances, we will continue to store your data but will not process it further until we have checked and confirmed whether the data is inaccurate).
• Right to data portability – to receive your personal data in a structured, commonly used format and to transmit it or have it transmitted to another international school.
• Right not to be subject to automated individual decision-making – the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Where the processing of your personal data is based upon consent, you and/or your child have the right to withdraw consent at any time. Such withdrawal of consent shall not affect the lawfulness of the processing based on consent before the withdrawal.

There may be instances where you may not want us to process or share your personal information. In these cases, we may not be able to fulfil the service you need or we may only be able to do so in a limited way, or be able to comply with a statutory obligation. In those instances, we will not be able to comply with your request and we will tell you if this is the case.

For any questions or concerns relating to this Notice or the processing of your personal data by or on behalf of The Banda School, as well as for the exercise of any of the rights described in this Notice, please contact The Banda School on privacy@ bandaschool.com.

Updated: January Term 2026