Privacy Notice & Cookie Statement

Arbor Education Partners Limited (“Arbor”, “we”, “us” and “our”) operates arbor-education.com and Arbor's Management Information System (“MIS”). We are committed to protecting your personal data. This Privacy Notice sets out how we handle personal data that is provided to us or collected by us in relation to our website, MIS, general enquiries, and other contact with us.

If you have any questions about this Privacy Notice or how we handle personal data, contact dataprotection@arbor-education.com.

If you are an applicant, please see our Recruitment Privacy Notice which will be provided to you separately for more information. We may need to update this Privacy Notice from time to time so please check it regularly.

Arbor is a company registered in England with company number 07790198 and registered address HYLO 103-105 Bunhill Row, London, EC1V 8LZ. Arbor is part of The Key Group and together we serve the education sector.

Arbor's MIS gives schools the tools they need to work better today and be ready for tomorrow, free staff from busywork, work more collaboratively, and stay connected on the cloud. We are part of the same group of companies as: ScholarPack and Integris, both of which offer management information systems to schools; GovernorHub (which offers online resources to school governors); and The Key (which provides up-to-the-minute sector intelligence and resources that empower education leaders with the knowledge to act).

We collect and use personal data in order to provide information and services to you. We collect personal data:

• directly from you when you submit an enquiry, register for a free trial, adjust your user account profile and preferences, submit data to our MIS and our website; and otherwise interact with us (including for recruitment purposes; entering our competitions and surveys; submitting ideas to us; booking event tickets; as well as by communicating with us in person or via other means such as email, livechat, and phone);
• automatically from our website and our MIS using automated means such as cookies. We receive data about how you use our website and our MIS, including IP address, browser type, length of stay, location and traffic data, and the site that referred you to our website;
• from trusted partners we work with where such sharing is permitted under data protection laws, including our group companies, subcontractors acting on our behalf who provide us with services such as payment processing (we do not view or store your card details), third parties that have notified you that they may share your data with us, and other subscribers to our services (e.g. teachers or administrators at the schools we work with); and
• that is publicly available, such as information published by social media platforms, Get Information About Schools (Edubase), local authorities and government departments.

The tables below set out how we use personal data in more detail. Please note that the lawful bases we rely on to process your data may differ depending on what type of user you are. For example, if you are an administrator or staff of the school with whom we are contracted to provide the MIS Service, the lawful basis that we may rely on to process your data will be to perform our contractual obligations. However, for a user of our website, the lawful basis will be different and may be based on consent or legitimate interests.

We do not carry out automated decision-making (that is, decisions made solely by automated means without any human involvement), such as profiling, in order to make decisions that have a legal or significant effect on you. Where our website links to third-party websites, please review their respective privacy policies for information on how personal data is handled by those third parties.

We handle personal data as a data controller when we determine how and why to process the personal data. This includes, for example, when we use personal data to register you for our services, for marketing and invoicing purposes, to produce benchmarks and analytics of aggregated customer data, and to provide customer support.

We handle personal data as a data processor when we process the personal data on behalf of a school, academy or trust that is registered with us for the provision of our MIS and in respect of information uploaded by you. In these circumstances, the relevant school, academy or trust is the data controller. Please check the privacy policy of the relevant school, academy or trust in relation to how we process personal data in those circumstances.

We share certain personal data:

• within our company group where it is required for the purposes of our internal shared support services;
• with our service providers, such as for email deployment, cloud storage, technical data analysis, sales fulfilment, customer support, accounts and billing, survey and messaging service provision, business intelligence analytics and other purposes;
• in aggregated or anonymised form using anonymisation and pseudonymisation techniques, with our company group and partners for marketing and strategic development purposes;
• where we have consent to do so;
• where we are required or permitted to in order to comply with our legal, regulatory, financial and professional obligations, to enforce or apply our User Terms, and to protect our rights, property and safety and those of others; and
• if we or substantially all our assets are merged or acquired by a third party and personal data forms part of the transferred or merged assets.

Certain personal data of our MIS users will also be accessible to authorised individuals on behalf of their school, academy or trust. The relevant access permissions can be viewed on your account profile on our MIS. Administrators at each school, academy or trust using our MIS can also view certain information relating to their organisation, including a list of permitted MIS users and their roles. You can also set preferences for certain products to enable the sharing of references, training records or testimonials with third parties.

We only retain personal data for as long as we need it, subject to legal and regulatory requirements (including those related to the procurement of public contracts), or longer if we have consent. Where you use our MIS, we will retain your personal data for as long as the subscription term lasts, and for a limited period afterwards in line with our data retention policy.

Some of our group companies and service providers run their operations outside of the UK and EEA, including in countries with different data protection laws to the UK. In these circumstances, there are safeguards in place to ensure that personal data is adequately protected in accordance with UK data protection law. Please contact us if you would like more information about these safeguards.

We use cookies and similar technologies to operate our website, to help us understand how it is being used, and to help us target advertising effectively. Some of these cookies are essential for our website to work properly. We use non-essential cookies from Google Analytics in order to understand how people navigate to and use our website. You can disable and delete cookies through your web browser settings and/or on the website, although this may impact website functionality.

You have various rights in relation to your personal data. These include the right to:

• request copies of the personal data we hold on you;
• request rectification of inaccuracies or omissions in the personal data we hold on you;
• request to restrict or object to the processing of the personal data we hold on you; and
• request we delete or otherwise remove the personal data we hold on you.

Additionally, where personal data is processed based on consent, you have the right to withdraw this consent at any time.

To make a request or complaint, or to opt out of marketing emails, contact us at dataprotection@arbor-education.com. We hope to be able to address any of your concerns. You can also make a complaint to the Information Commissioner's Office.