Data Protection & Privacy Policy

1. Introduction

BSA Group Services Limited (BSAG) is a company registered in England and Wales (registered number: 4676107).

BSAG comprises BAISIS (British Association of Independent Schools with International Students), BSA (Boarding Schools’ Association), HIEDA (Health in Education Association), IELA (Inclusion & Equity Leadership Association), SACPA (Safeguarding and Child Protection Association) and TIOB (The Institute of Boarding). Also found within the group are SBF (State Boarding Forum) and BSA Legal Services Ltd, a subsidiary of BSA Group Services Ltd.

BSA Legal is a trading name of BSA Group Legal Services Ltd, a company registered in England and Wales (registered number: 13634894). BSA Group Legal Services Ltd is authorised and regulated by the Solicitors Regulation Authority (SRA Number: 8003074).

BSA Legal operates as a separate data controller in respect of the personal data it processes in connection with immigration support and other legal services. A dedicated Privacy Notice for BSA Legal’s immigration support services is available at: https://www.boarding.org.uk/immigration-support-for-schools. If you are receiving legal or immigration services from BSA Legal, please refer to that notice for full details of how your personal data is processed in that context.

BSAG’s mission is to support excellence in boarding, safeguarding, inclusion and health education. BSAG delivers services for 4,500 organisations and individuals in more than 50 countries worldwide.

BSAG acts as a data controller in respect of the personal data it processes. We take our responsibilities as a data controller seriously and are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), as amended by the Data (Use and Access) Act 2025 (DUAA).

This privacy notice provides detailed information about how we process personal data. Please read it carefully. If you have questions regarding your personal data or its use, please contact us at: info@bsagroup.org.uk.

 

2. Types of Personal Data We Process

We process personal data about current and past: employees, contractors, board and executive committee members, member and non-member organisations, schools, school staff, BSAG staff, training providers/contractors, students (where information is provided to us by a school) and other individuals connected to a member organisation or school.

The personal data we process may take different forms – it may be factual information, expressions of opinion, images or other recorded information which identifies or relates to a living individual. Examples include:

• Names, addresses, telephone numbers, email addresses and other contact details
• Images, audio and video recordings
• Financial information (bank details)
• Courses, meetings or events attended
• Usage data and technical data collected via our website (including IP addresses, browser type and cookies – see our separate Cookie Policy)

As an employer, we are required to process criminal records information about certain individuals (particularly staff and contractors). We do so in accordance with applicable law (including safeguarding and employment legislation) or with the explicit consent of the individual concerned.

 

3. Lawful Basis for Processing

UK GDPR requires that we identify a lawful basis before processing personal data. Depending on the purpose, we rely on one or more of the following lawful bases:

• Contract: processing is necessary for the performance of a contract with the individual, or to take steps at their request before entering into a contract.
• Legal obligation: processing is necessary to comply with a legal obligation (e.g. employment law, safeguarding duties, tax obligations).
• Legitimate interests: processing is necessary for our legitimate interests or those of a third party, except where these are overridden by the interests or rights of the individual. We carry out a legitimate interests assessment where we rely on this basis.
• Consent: the individual has given clear consent for us to process their personal data for a specific purpose. Where we rely on consent, individuals may withdraw it at any time.
• Vital interests: in limited circumstances, to protect someone’s life.

Where we process special category data (such as criminal records information), we additionally rely on an appropriate condition under Schedule 1 of the DPA 2018, most commonly the employment, safeguarding or substantial public interest conditions.

 

4. Collecting, Handling and Sharing Personal Data

We collect most of the personal data we process directly from members, staff or other individuals. We also collect data from third parties (such as working references, professional bodies or authorities) or from publicly available sources.

Personal data held by us is processed only by appropriate members of staff for the purposes for which the data was provided. We take appropriate technical and organisational measures to ensure the security of personal data, including secure use of technology and devices and controlled access to our online systems.

Some of our systems are provided by third-party suppliers, such as the Microsoft Office suite and cloud storage, BSAG’s websites, newsletters and independent cloud storage providers. All third-party processors are subject to contractual assurances that personal data will be kept securely and processed only in accordance with our specific instructions.

We do not sell personal data to any third party. We may share personal data with third parties where:

• We are required to do so by law or by a regulatory authority;
• It is necessary to fulfil a contract or provide a service;
• We have a legitimate interest in doing so, having carried out the appropriate assessment; or
• The individual has given their consent.

International transfers: We do not routinely transfer personal data outside the UK. Where any transfer outside the UK is necessary, we ensure that an appropriate safeguard is in place (such as adequacy regulations, standard contractual clauses or binding corporate rules) in accordance with UK GDPR Chapter V.

 

5. Purposes for Which We Process Personal Data

We process personal data to support BSAG’s function of promoting and supporting key stakeholders. This includes:

• Names, emails and telephone numbers of key contacts for organisations and schools, for membership changes, updates and payments.
• Names, emails and telephone numbers of attendees of events and training (both current and previous), to provide information on similar training or events.
• School-supplied press releases containing names, for the purposes of promoting the school through BSAG online networks.
• Names and contact details of prospective members, for the purpose of promoting membership.
• Email addresses of key contacts of members for BSAG newsletters and mailings (an opt-out option is always available).
• Name, title and school address for the purpose of distributing the BSA Boarding School magazine and BSA promotional content.
• Staff, board and executive committee administration (including recruitment and contractors), covering payroll, pensions, sick leave, annual leave, performance reviews, grievance, conduct, capability and disciplinary procedures, and providing references.
• Images supplied by schools, for the promotion of BSAG on our websites, social media, print content and presentations.
• Contact details for associations working in conjunction with BSAG across all our sectors.
• Details of individuals who have booked on to BSAG training programmes, in order to confirm training arrangements, share resources and maintain attendance records.
• Details of individuals in the boarding sector who have applied for the Accredited Boarding Practitioner (ABP) scheme, to keep them updated with the boarding sector through ABP-specific mailings and promotions.
• Details of safeguarding professionals and advisors for the SACPA newsletter. Details are provided by individuals who request access to this service; they may opt out at any time by replying to the email or by emailing: info@bsagroup.org.uk.
• Sharing of social media posts from member schools through BSA social networks (retweeting, sharing)

The processing described above is carried out on the basis of our legitimate interests, compliance with legal obligations (including staff employment contracts), or consent where indicated.

 

6. Keeping in Touch

BSAG maintains contact with past school Heads and boarding school staff who have requested to remain on BSAG mailing lists and have provided their personal data for this purpose. This enables BSAG to continue to invite them to events, keep them updated with the boarding sector and provide useful and relevant information.

BSAG asks that individuals requesting continued contact provide their data preferences to ensure that all communications are relevant. Individuals may opt out of these mailings at any time by emailing info@bsagroup.org.uk or by clicking the ‘unsubscribe’ link at the bottom of any email communication.

 

7. How Long We Keep Personal Data

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required or permitted by law. Our key retention periods are as follows:

• Staff records: retained for seven years following the end of employment, for the purposes of providing references and meeting legal obligations.
• School staff contact details: updated annually. Details of staff who have left a school are removed from our contact lists unless they request to continue receiving BSAG communications.
• Press releases: retained on BSAG websites (News Archive) and social media pages for a period of ten years, to support schools in promoting their brand. Press releases may be removed at any time on request by emailing info@bsagroup.org.uk.
• Website usage data and cookies: retained in accordance with our Cookie Policy.

We maintain a Record of Processing Activities (ROPA) which documents retention periods for each category of personal data we process, in accordance with our accountability obligations under UK GDPR Article 30.

 

8. Your Rights

Under UK GDPR and the DPA 2018, individuals have the following rights in relation to their personal data, subject to certain exemptions and limitations:

• Right of access: to obtain a copy of the personal data we hold about you.
• Right to rectification: to have inaccurate or incomplete personal data corrected.
• Right to erasure (‘right to be forgotten’): to request deletion of your personal data in certain circumstances.
• Right to restriction of processing: to request that we limit how we use your personal data.
• Right to data portability: to receive your personal data in a structured, commonly used and machine-readable format, and to have it transferred to another controller where technically feasible.
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
• Rights in relation to automated decision-making and profiling: not to be subject to solely automated decisions that have a legal or similarly significant effect on you.
• Right to withdraw consent: where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.

Please be aware that BSAG may have another lawful basis on which to process your personal data even without your consent. This is most common in relation to staff records (e.g. time worked, HR matters and reference requests).

To exercise any of your rights, please make a written request to the CEO, DCEO/COO or Legal Director. We will respond within one month of receipt of your request (or within three months for complex or multiple requests, in which case we will notify you of the extension and reasons).

There is no charge for making a request, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request, in accordance with UK GDPR.

Certain data is exempt from the right of access. This includes information that would identify other individuals, or information subject to legal privilege. We are not required to disclose any confidential reference given by BSAG for the purposes of education, training or employment.

 

9. Data Protection Complaints Process

In accordance with requirements introduced by the Data (Use and Access) Act 2025, BSAG has a formal data protection complaints process. If you have a concern about how we have handled your personal data, please contact us in the first instance:

Email: info@bsagroup.org.uk

Post: CEO/Legal Director, BSA Group Services Limited, 167–169 Great Portland Street, 5th Floor, London W1W 5PF

We will acknowledge your complaint promptly and aim to respond substantively within 20 working days. We will maintain a record of all data protection complaints and the actions taken in response.

If you remain dissatisfied following our response, or if you believe that we have acted otherwise than in accordance with Data Protection Law, you have the right to make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk | Helpline: 0303 123 1113

The ICO recommends that steps are taken to resolve the matter with the organisation before involving them.

 

10. Pupil Data

We only hold pupil data when it has been provided to BSAG specifically for the purposes of promoting a member school (through BSA and TIOB websites, social media pages and marketing content such as the Boarding School magazine). Such data is handled with particular care and is not used for any other purpose.

This section applies to BSAG’s promotional activities only. Where legal or immigration services are provided by BSA Legal (BSA Group Legal Services Ltd), additional categories of student personal data – including identity documents, immigration history and visa application materials – are processed by BSA Legal in its separate capacity as an independent data controller. BSA Legal’s collection and use of such data is governed entirely by the BSA Legal Privacy Notice for Immigration Support Services, which is available at:

https://www.boarding.org.uk/immigration-support-for-schools. That processing falls outside the scope of this policy.

 

11. Safeguarding Data

Any data relating to safeguarding matters is provided to us by our member organisations and schools. Data is provided with all identifying details of individuals already removed (even if those details may be available in the public domain).

If an organisation or school provides information that has not been fully anonymised, the CEO, DCEO/COO or Senior Director will remove all relevant identifying data upon receipt. All safeguarding information is stored securely within BSAG’s systems, with strictly limited access.

Safeguarding data will not be shared with any external agency, other than where required by a legal obligation and where there is a lawful basis for sharing.

 

12. Website Data and Cookies

Our website (https://boarding.org.uk) uses cookies and similar tracking technologies. When you visit our website, we may collect the following categories of data automatically:

• Usage data and device information (e.g. IP address, browser type, pages visited, session duration)
• Analytics data via Google Analytics 4
• Data processed by tag management services (Google Tag Manager)
• Data processed by security and bot-protection services (Cloudflare)
• Data associated with social media sharing tools (e.g. AddToAny, Facebook, X/Twitter)
• Data processed in connection with embedded content (e.g. Vimeo video, Issuu, Google Fonts)

Full details of the cookies we use, the purposes for which they are used and how you can manage your preferences are set out in our separate Cookie Policy, available on our website.

Where cookies require your consent, we will seek this via our cookie consent tool before placing non-essential cookies on your device. You may withdraw or update your consent at any time through the cookie settings on our website.

 

13. Change of Details

We take steps to ensure that all personal data we hold is kept as accurate and up to date as possible. Please notify us of any changes to your information (such as contact details) by emailing info@bsagroup.org.uk.

 

14. This Policy

This privacy notice should be read alongside our other policies and terms and conditions that refer to personal data, including our Commitment to Care Charter and Cookie Policy. Where services are provided by BSA Legal (BSA Group Legal Services Ltd), the BSA Legal Privacy Notice for Immigration Support Services applies and is available at: https://www.boarding.org.uk/immigration-support-for-schools.

Where BSAG staff or consultants visit a member school or carry out consultancy work on behalf of a school, a separate Confidentiality and Data Privacy Statement for Consultancy Services governs how information shared in that context will be handled. That statement sets out the specific confidentiality and data protection commitments that apply to information – including personal data – shared with BSAG in the course of a consultancy engagement. It is provided to schools prior to any consultancy visit or engagement and is available on request from info@bsagroup.org.uk.

We will review and update this Privacy Notice periodically and whenever required by changes in law or our processing activities. Any substantial changes affecting how we process your personal data will be notified on our website and, where practicable, communicated to you directly. The date of the most recent update is shown at the top of this document.

For any queries about this policy or our data protection practices, please contact us at: info@bsagroup.org.uk.

 

Last updated: March 2026

Next update: March 2027

 

Terms and Conditions

Please click on the links below to download our terms and conditions:

• Consultancy terms and conditions
• Event terms and conditions
• Membership terms and conditions
• Photography consent form
• Photography policy
• Speaker terms and conditions.