In this document
Introduction
Arbor Education Partners Limited (“Arbor”, “we”, “us” and “our”) operates arbor-education.com and Arbor’s Management Information System (“MIS”). We are committed to protecting your personal data. This Privacy Notice sets out how we handle personal data that is provided to us or collected by us in relation to our website, MIS, general enquiries, and other contact with us.
If you have any questions about this Privacy Notice or how we handle personal data, contact dataprotection@arbor-education.com.
If you are an applicant, please see our Recruitment Privacy Notice which will be provided to you separately for more information.
We may need to update this Privacy Notice from time to time so please check it regularly.
Who we are and how to contact us
Arbor is a company registered in England with company number 07790198 and registered address HYLO 103-105 Bunhill Row, London, EC1V 8LZ. Arbor is part of The Key Group and together we serve the education sector.
Arbor’s MIS gives schools the tools they need to work better today and be ready for tomorrow, free staff from busywork, work more collaboratively, and stay connected on the cloud. We are part of the same group of companies as: ScholarPack and Integris, both of which offer management information systems to schools; GovernorHub (which offers online resources to school governors); and The Key (which provides up-to-the-minute sector intelligence and resources that empower education leaders with the knowledge to act).
How we process personal data and why
We collect and use personal data in order to provide information and services to you.
We collect personal data:
- directly from you when you submit an enquiry, register for a free trial, adjust your user account profile and preferences, submit data to our MIS and our website; and otherwise interact with us (including for recruitment purposes; entering our competitions and surveys; submitting ideas to us; booking event tickets; as well as by communicating with us in person or via other means such as email, livechat, and phone);
- automatically from our website and our MIS using automated means such as cookies. We receive data about how you use our website and our MIS, including IP address, browser type, length of stay, location and traffic data, and the site that referred you to our website;
- from trusted partners we work with where such sharing is permitted under data protection laws, including our group companies, subcontractors acting on our behalf who provide us with services such as payment processing (we do not view or store your card details), third parties that have notified you that they may share your data with us, and other subscribers to our services (e.g. teachers or administrators at the schools we work with); and
- that is publicly available, such as information published by social media platforms, Get Information About Schools (Edubase), local authorities and government departments.
The table below sets out how we use personal data in more detail. Please note that the lawful bases we rely on to process your data may differ depending on what type of users you are. For example, if you are an administrator or staff of the school with whom we are contracted to provide the MIS Service, the lawful basis that we may rely on to process your data will be to perform our contractual obligations. However, for a user of our website, the lawful basis will be different and may be based on consent or legitimate interests.
We may also process your personal data in order to comply with a legal obligation, or in order to protect our rights and interests and those of individuals and third parties.
| Personal Data | Reason | Lawful Basis (User dependent) |
| Website Operation and Management | ||
|
Website usage data (location and traffic data, length of visit, IP address etc.) |
To operate, maintain and secure our website, including managing user traffic, displaying content from external platforms, and hosting and backend infrastructure. To analyse and improve the use and performance of our website (e.g. the number of users). To detect malicious or fraudulent activity. To target advertising effectively. |
Our legitimate interest in operating, securing and improving our website. User consent (where information is collected by non-essential cookies). |
| Communication, Marketing and Sales | ||
| Personal Data | Reason | Lawful Basis |
|
Name Address Email address Phone number Role and organisation Publicly-available social media activity and profile contents Website and MIS usage data (location and traffic data, length of visit, IP address etc.) |
To provide messages (e.g. to verify user credentials, confirm instructions, send invoices, provide technical support, send renewal information). To process and respond to communications regarding our products and services. To analyse and understand which products or services may be of interest to you. To monitor communications for quality assurance, training and fraud prevention. To invite you to participate in opportunities such as market research, free trials or demos, and competitions and promotions. To inform you of products and services you may be interested in. To operate our “Invite a Colleague” or “Ask for Work Experience” functions. |
To comply with our contractual obligations to the user by providing you with information that you have asked for, administering payments made to us, and record-keeping. Our legitimate interest in communicating with you about our services, in maintaining and developing our business and offerings. Our legitimate interest in fraud prevention and User consent where relevant. |
| Provision of our MIS | ||
| Personal Data | Reason | Lawful Basis |
|
Name School / academy / trust at which you are registered Communication preferences Academic record, including behaviour, attainment and attendance Medical needs and dietary requirements Special education needs Training records Career experience Other user-generated content Relationship to other individuals (e.g. parent/guardian) Other information received from the school or academy MIS usage data (location and traffic data, length of visit, IP address etc.) |
To provide you with access to our MIS. To provide third party service providers and schools with access to our MIS via an API. To ensure the technical security and business continuity of our systems. To manage and run integral product and technical support tools. To better understand your experience of, and to improve, our offerings. |
To comply with our contractual obligations to provide and improve our MIS service. |
| Payments | ||
| Personal Data | Reason | Lawful Basis |
|
Name and email address Personal data relating to payments made to us |
To administer payments made to us through payment processor services. |
To comply with our contractual obligations to you. Our legitimate interest in administering payments made to us, including record-keeping. |
We do not carry out automated decision-making (that is, decisions made solely by automated means without any human involvement), such as profiling, in order to make decisions that have a legal or significant effect on you.
Where our website links to third-party websites, please review their respective privacy policies for information on how personal data is handled by those third parties.
Our role as controller and processor
We handle personal data as a data controller when we determine how and why to process the personal data. This includes, for example, when we use personal data to register you for our services, for marketing and invoicing purposes, to produce benchmarks and analytics of aggregated customer data, and to provide customer support.
We handle personal data as a data processor when we process the personal data on behalf of a school, academy or trust that is registered with us for the provision of our MIS and in respect of information uploaded by you. In these circumstances, the relevant school, academy or trust is the data controller. Please check the privacy policy of the relevant school, academy or trust in relation to how we process personal data in those circumstances.
Whom we share personal data with
We share certain personal data:
- within our company group where it is required for the purposes of our internal shared support services;
- with our service providers, such as for email deployment, cloud storage, technical data analysis, sales fulfilment, customer support, accounts and billing, survey and messaging service provision, business intelligence analytics and other purposes;
- in aggregated or anonymised form using anonymisation and pseudonymisation techniques, with our company group and partners for marketing and strategic development purposes;
- where we have consent to do so;
- where we are required to or permitted to in order to comply with our legal, regulatory, financial and professional obligations, in order to enforce or apply our User Terms, in order to protect our rights, property and safety and those of others, and where else necessary; and
- if we or substantially all our assets are merged or acquired by a third party and personal data forms part of the transferred or merged assets.
Certain personal data of our MIS users will also be accessible to authorised individuals on behalf of their school, academy or trust. The relevant access permissions can be viewed on your account profile on our MIS. Administrators at each school, academy or trust using our MIS can also view certain information relating to their organisation, including a list of permitted MIS users at their organisation and their roles. We may also share with an administrator or organisation that an individual has registered with us in order to ensure that those who register are eligible to use our MIS. You can also set preferences for certain products to enable the sharing of their references, training records or testimonials with third parties.
How we store and transfer personal data
We only retain personal data for as long as we need it, subject to legal and regulatory requirements (including those related to the procurement of public contracts), or longer if we have consent. Where you use our MIS, we will retain your personal data for as long as the subscription term lasts, and for a limited period afterwards in line with our data retention policy.
Some of our group companies and service providers run their operations outside of the UK and EEA, including in countries with different data protection laws to the UK. In these circumstances, there are safeguards in place to ensure that personal data is adequately protected in accordance with UK data protection law. Please contact us if you would like more information about these safeguards.
Cookies
We use cookies and similar technologies to operate our website, to help us understand how it is being used, and to help us target advertising effectively. Some of these cookies are essential for our website to work properly. We use non-essential cookies from Google Analytics in order to understand how people navigate to and use our website. You can disable and delete cookies through your web browser settings and/or on the website, although this may impact website functionality.
Rights and complaints
You have various rights in relation to their personal data. These include the right to:
- request copies of the personal data we hold on you;
- request rectification of inaccuracies or omissions in the personal data we hold on you;
- request to restrict or object to the processing of the personal data we hold on you; and
- request we delete or otherwise remove the personal data we hold on you.
Additionally, where personal data is processed based on consent, you have the right to withdraw this consent at any time.
To make a request or complaint, or to opt out of marketing emails, contact us at dataprotection@arbor-education.com. We hope to be able to address any of your concerns. You can also make a complaint to the Information Commissioner’s Office.
Last updated: June 2024