INTRODUCTION
This policy is intended to provide information about how AHA Courses Ltd will use (or “process”) personal data about: future, current and past students, their parents, carers or guardians and adult clients.
This Privacy Notice explains in detail the types of personal data we may collect about you when you interact with us and how we use it. It also explains how we’ll store, handle and use that data, and how you have access to that data.
This Privacy Notice will be updated occasionally. We will notify you of any significant changes, but this page will always show the current version of our Privacy Notice.
WHO WE ARE?
AHA Courses Ltd, also known as Art History Abroad, is an educational organisation based in the UK with courses around the world. AHA Courses Ltd is a data controller, meaning that it determines the processes to be used when using your personal data. Our contact details are as follows:
Postal Address: The Red House, 1 Lambseth Street, Eye. Suffolk IP23 7AG
Registered Office: Yew Tree House, Lewis Road, Forest Row, East Sussex RH18 5AA
Registered in London No. 2132281
In this privacy policy references to “we”, “us” and “our” are to AHA Courses Ltd T/A Art History Abroad
References to “our Website” or “the Website” are to arthistoryabroad.com
RESPONSIBILITY
AHA Courses Ltd has appointed the Managing Director as Data Controller, in order to ensure that all personal data is processed in compliance with this Privacy Notice and Data Protection law and he will oversee requests and enquiries concerning AHA Courses Ltd uses of personal data.
LAWFUL REASONS FOR PROCESSING
When we collect your personal data, we’ll always make clear to you which data is necessary in connection with a particular service.
Article 6 of the GDPR sets out a number of different reasons for which a company may collect and process your personal data, including:
Consent
We collect and process your data with your consent e.g. when you fill in a form at a lecture or a gap year fair asking for our course details or when you ask for our course details on our website or in the course of conversation at an AHA event.
If you have given us your address, email address and/or telephone number either when we have met you at a fair or trade show or through the enquiry on our web site, we may use your address details to send you direct marketing information by post, email or telephone telling you about products and services that we think might interest you.
Contract
We may need your personal data collected through the application form and/or the registration form in order to comply with our contractual obligations. For example, if we are organising a course or tour or lecture on which you have registered.
Legal obligation
If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity to law enforcement. We may also pass on your details where your vital interests are concerned, for example should there be an accident where the emergency services are involved.
Legitimate interests
In specific situations, we may use your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.For example:
- For the purposes of student selection
- To provide education and guiding services
- Maintaining relationships with alumni and the AHA community, including direct marketing or fundraising activity
- To enable relevant authorities to monitor our performance and to intervene or assist with incidents as appropriate
- To enable students and clients to visit museums and hotels and institutions that require details of age and proof of nationality
- To safeguard students’welfare and provide appropriate pastoral care
- To make use of photographic images of students in AHA’s publications, on our Website and (where appropriate) on AHA’s social media channels in accordance with AHA’s policy on taking, storing and using images
- To carry out or cooperate with any AHA or external complaints, disciplinary or investigation process
- Where otherwise reasonably necessary for the company’s purposes, including to obtain appropriate professional advice and insurance for AHA
- To use tools like Google Analytics to combine anonymous data that we use to develop new services and ensure that our existing services can be delivered safely and efficiently.
WHAT INFORMATION WE COLLECT AND HOW
The information we collect via the Website, or on paper forms, third parties such as schools or health professionals, or through ordinary conversation or through photographic device, may include:
Any personal details you knowingly provide us with through forms and email, such as name, address, telephone number, family detail, financial details, education, passport, insurance and employment details. We also process sensitive classes of information that may include physical or mental health details.
In order to effectively process credit or debit card transactions it may be necessary for the bank or card processing agency to verify your personal details for authorisation outside the European Economic Area (EEA). Such information will not be transferred out of the EEA for any other purpose.
We collect and store correspondence connected with the registration and conduct of students and clients on courses or tours. This will include tutorials or accident reports in compliance with our health and safety policy. We also collect images related to our courses and tours.
Your preferences and use of email updates, recorded by emails we send you (if you select to receive email updates on products and offers).
Your IP Address, this is a string of numbers unique to your computer that is recorded by our web server when you request any page or component on the Website. This information is used to monitor your usage of the Website.
Data recorded by the Website which allows us to recognise you and your preferred settings, this saves you from re-entering information on return visits to the site. Such data is recorded locally on your computer through the use of cookies. Most browsers can be programmed to reject, or warn you before downloading cookies, information regarding this may be found in your browser’s ‘help’ facility.
WHAT WE DO WITH YOUR INFORMATION
Any personal information we collect will be used in accordance with GDPR regulations from May 25, 2108. The details we collect will be used exclusively in connection with AHA courses and events and the marketing thereof.
We may need to pass the information we collect to other companies or institutions for administrative purposes, such as museums or hotels, in the ordinary running of our events.
We may use third parties to carry out certain activities, such as processing and sorting data, monitoring how customers use the Website and issuing our emails or mailshots for us.
Third parties will not be allowed to use your personal information for their own purposes.
WHERE WE STORE YOUR INFORMATION AND FOR HOW LONG
The digital and paper information you give us is stored in our operations office and on our secure server which has password access only from all terminals located both in the office and remotely.
The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us. Such staff may be engaged in the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.
All information you provide to us is stored on secure servers. Any payment transactions will be encrypted. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access, improper use or disclosure, unauthorised modification, unlawful destruction or accidental loss.
For prospective students and clients, we store your details for no more than five years with September (or the academic year) taken as the start of each year.
For clients and alumni we hold your information as long as you are happy for this to happen. In the event of a liability claim against our insurance, we would need your details and correspondence. Furthermore, it is often the case that a student or alumni in later years becomes a client on our adult courses. Our alumni form an important part of the AHA community for convivial friendship, fundraising and the archive history of AHA Courses Ltd.
YOUR RIGHTS
You have the right to request a copy of any information that we currently hold about you. In order to receive such information please send your contact details including address to the following address. As per the GDPR we will respond within one calendar month but may refuse or charge for requests that are manifestly unfounded or excessive.
Requests that cannot be fulfilled
You should be aware that the right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information which identifies other individuals, and parents need to be aware this may include their own children, or information which is subject to legal privilege.
Parental requests.
It should be clearly understood that the rules on subject access are not the sole basis on which information requests are handled. Parents may not have a statutory right to information,for example if the student concerned is over 18 or the issue is of a sexual nature.However,parents will often have a legitimate interest or expectation in receiving certain information about studentswithout the latter’sconsent. AHA Courses Ltdmay consider there are lawful grounds for sharing information with or without reference to that student especially if AHA believes it is in the best interests of the student’s safety or wellbeing.
All information requests from, on behalf of, or concerning students– whether made under subject access or simply as an incidental request – will be considered on a case by case basis.
Privacy, Art History Abroad
The Red House
1 Lambseth Street
Eye
Suffolk
IP23 7AG
OTHER WEBSITES
This privacy policy only covers this Website. Any other websites which may be linked to by our Website are subject to their own policy, which may differ from ours.
May 2018
