Cookies Policy

COOKIES POLICY COOKIES POLICY Introduction This Cookies Policy explains how and why we use cookies and similar tracking technologies on our website. It is designed to be transparent and to provide you with clear information about your choices, in compliance with the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe. This policy should be read in conjunction with our main Privacy Policy, which provides further details on how we handle your personal information. What are Cookies? Cookies are small text files placed on your device to collect standard internet log and visitor behaviour information. They are used to make websites work more efficiently and to provide reporting information to the school. Why We Use Cookies (Purpose of Processing) Under Section 13 of the Act, data must be collected for explicit, specified, and legitimate purposes. We use cookies to: Ensure the website functions correctly (Essential Cookies). Analyse website traffic and usage patterns to improve our digital services (Analytics Cookies). Remember your preferences, such as language settings (Functional Cookies). Lawful Basis for Processing Consent: For non-essential cookies (analytics and functional), we rely on your affirmative consent. Legitimate Interest: For essential cookies necessary for the operation of the website, processing is based on the school’s legitimate interest in providing a functional digital platform. Categories of Data Collected Through cookies, we may process the following Personal Information: Online identifiers (e.g., IP addresses). Device type and browser information. Browsing history and interactions with our website. Your Choices: Managing Consent Upon your first visit to our website, you will be presented with a clear cookie banner. You will be asked to give your consent for the use of non-essential cookies. You are free to accept or decline these cookies. In accordance with the Right to Consent Guidelines, we ensure that: Active Opt-In: You must actively “opt-in” to non-essential cookies. We do not use pre-ticked boxes. Unbundled Consent: Your agreement to cookies is separate from other school terms and conditions. Right to Withdraw: You have the absolute right to withdraw your consent at any time through our cookie settings banner or browser settings. Withdrawal is free of charge and as easy as giving consent. Data Retention and Recipients Retention: Cookie data is kept in an identifiable form for no longer than necessary to fulfil the purposes outlined above. Third-Party Recipients: We share anonymized analytics data with Google Analytics. We have a Data Processing Addendum in place to ensure they maintain strict security measures. Data Subject Rights As a website user, you have the right to: Be informed of how your data is used. Access the information we hold about you. Object to processing for marketing purposes. Rectify or delete inaccurate data. Updates to This Policy We may update this Cookies Policy from time to time to reflect changes in technology, legislation, or our data processing practices. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Contact Details If you have questions about this policy, our use of your personal data or wish to exercise your rights, please contact our Data Protection Officers (DPOs): – School Name: St George’s College and Hartmann House Preparatory School – DPOs: Chauya Isaac, Muhuru Loveson, Ziyageba Collen – Email: compliance@stgeorges.co.zw – Phone: +2638677020314 / 9 – Address: 3 Borrowdale Road, Harare, Zimbabwe

Privacy Notice

PRIVACY NOTICE Privacy Notice This Privacy Notice explains how St George’s College and Hartmann House Preparatory School (“we,” “us,” or “our”) collects, uses, shares, and protects the personal information of our learners, parents/guardians, staff, and website visitors. We are committed to protecting your privacy and handling your personal information in compliance with the Cyber and Data Protection Act [Chapter 12:07] (the “Act”) and its associated regulations. This notice applies to personal information collected by us directly from you or from other sources. Who We Are and Our Legal Status St George’s College and Hartmann House Preparatory School is a data controller as defined by the Act, meaning we determine the purposes and means of processing personal information. We are regulated by the Data Protection Authority (Postal and Telecommunications Regulatory Authority of Zimbabwe – POTRAZ) and hold a valid data controller licence. What Personal Information We Collect We may collect and process the following categories of personal information as defined in Section 3 of the Act: – Personal Identifiers: Name, address, date of birth, contact details (telephone number, email address), national identification number, and student number. – Educational Information: Academic records, class schedules, attendance records, disciplinary records, and progress reports. – Health Information: Medical history, allergy information, special educational needs, and information about physical or mental health. – Demographic Information: Gender, race, or ethnic origin. – Family Information: Details of parents, guardians, and emergency contacts. – Correspondence: Any communications with the school, including emails and letters, which relate to home and family life. – Technical Information (from website visitors): IP address, browser type, and device information. – video images and audio (if applicable) through campus CCTV.   How We Collect Your Information   We collect personal information in several ways: – Directly from you (or your parent/guardian if you are a child): When you enrol at the school, fill out forms, attend meetings, or communicate with us. – Indirectly: From other sources, such as previous schools, healthcare providers, or when information is provided for historical, archival, or educational purposes as permitted by the Act. – Automatically: Through our website using cookies (where permitted) and Google Analytics. – Campus wide CCTV Why We Collect and Process Your Information (Lawful Basis) Under the Act, we must have a legal justification for processing your personal information. The purposes for which we use your data include: – To provide and manage educational services: This includes maintaining academic records, managing school operations, and communicating with parents and students. This is often for the performance of a contract or legitimate interests. – To ensure safety and well-being: This includes managing health and safety protocols, providing pastoral care, and ensuring a secure environment for learners. This is often necessary to protect the vital interests of the data subject. – To comply with legal obligations: This includes reporting data to government authorities (e.g., for education statistics or public health) as required by law. Special Note on Processing Children’s Data: Under the Act, a “child” is any person under the age of 18. A parent or legal guardian may exercise the child’s data protection rights on their behalf. Sharing Your Information We may share your personal information with data processors (see Appendices for a list of our data processors) for the purposes described above: – Service Providers: Third parties who provide services on our behalf, such as payment processors, IT support, or cloud storage providers. – Health Professionals: For the provision of care or medical treatment in the best interest of the data subject, under the supervision of a health professional. – Legal and Regulatory Authorities: Where required by law, for the prevention of crime, or to comply with a legal obligation. – Other Educational Institutions: For the transfer of records (e.g., when a student transfers to a new school or for sporting and cultural Activities, see Appendix B for a list of other educational institutions we share personal information with). We do not sell your personal information to third parties. Transborder Data Flows We may transfer personal information to third parties in countries outside Zimbabwe (e.g., for data backup or using cloud-based services). We will only make such transfers if an adequate level of protection is ensured for the data in the recipient country or international organisation, or if one of the specific exceptions under Section 29 of the Act. See Appendix A for Cloud Service Providers we share personal information with. Data Security and Breach Notification We have implemented appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, or destruction, as required by Section 18 of the Act and Regulation 16 of S.I. 155 of 2024. We are required by law to notify the Data Protection Authority (POTRAZ) of any security breach within 24 hours of becoming aware of it. If the breach poses a high risk to your rights and freedoms, we will also notify you as soon as possible and within 72 hours. Your Data Subject Rights Under the Act, you or your parent/guardian (if you are a child) have the following rights regarding your personal information: – Right to be Informed: You have the right to know how your data is being used (as outlined in this notice). – Right of Access: You have the right to request access to the personal information we hold about you. – Right to Object: You have the right to object to the processing of all or part of your personal information. – Right to Rectification: You have the right to request the correction of false or misleading personal information. – Right to Deletion: You have the right to request the deletion of false or misleading data about you. To exercise any of these rights, please contact our Data Protection Officer (DPO) using the details provided in Section 11. Data Retention We will retain your personal information only for as long as necessary to fulfil the purposes it was collected for, including for legal, accounting, or reporting requirements. Our retention periods are in