Privacy Notice

Privacy Notice (Pupils, Parents/Guardians, Prospective Families & Website Users)

Last updated: 26 January 2026

1. Who we are and the purpose of this Privacy Notice

This Privacy Notice explains how we collect, use and protect personal data when you interact with Thames British School (the “School”), including when you:

• visit our website thamesbritishschool.es,
• make an enquiry / request information / book a visit,
• apply for admission,
• are a pupil (current or former), or a parent/guardian, and
• receive School communications.

Data Controller: ENDAZE BRITISH INTERNATIONAL SCHOOL S.L.
CIF: B-87486171
Address: Calle Barbero de Sevilla, nº 16, Majadahonda, Madrid, Spain
Privacy / DPO contact email: info@thamesbritishschool.es

This Privacy Notice should be read alongside our Cookies Policy, Cookie Preferences, and any other specific notices we may provide at the time you give us your data (for example, on forms).

2. What personal data we collect

Depending on your relationship with the School, we may collect the following categories of personal data:

A) Website users and prospective families

• Identification and contact details: name, email, phone number, address (if provided)
  
  
• Enquiry/admissions information: child’s age/year group, prior school, language needs, preferred start date, information you share in messages
• Technical/usage data: IP address, device/browser data, pages visited, cookies and similar technologies (subject to your cookie choices)

B) Pupils and parents/guardians (including applicants)

• Pupil and family identification data: pupil name, date of birth, parent/guardian details
• Photos/videos of pupils in School activities (where used)

3. How we collect personal data

We collect personal data primarily:

• directly from you (forms, emails, calls, meetings, admissions paperwork),
  
  
• And via the website and cookies, where permitted by your settings.

4. Why we process personal data and our legal bases

We process personal data to operate the School, provide education, safeguard pupils, and communicate with families.

Typical purposes and legal bases include:

A) Contract / steps prior to contract (Art. 6(1)(b))

• handling enquiries and admissions processes
  
  
• enrolling pupils and providing educational services
  
  
• managing School operations related to the pupil’s education and participation

B) Legal obligation (Art. 6(1)(c))

• compliance with education, safeguarding, health and safety, tax/accounting and other applicable legal requirements

C) Legitimate interests (Art. 6(1)(f))

• running the School effectively (planning, quality assurance, internal administration)
  
  
• maintaining School security and IT integrity
  
  
• responding to requests and improving our website and services

D) Consent (Art. 6(1)(a))

• optional cookies/analytics (where required)
  
  
• certain marketing communications (where required)
  
  
• use of pupil images in external promotional materials, where we rely on consent

Where we process special category data, we will rely on an additional condition under Art. 9 GDPR (for example, safeguarding and provision of care/education support, substantial public interest where applicable, or explicit consent when requir

5. Who we share personal data with

We keep personal data confidential and only share it on a need-to-know basis. We may share personal data with:

• Service providers (data processors) who support our operations (IT, cloud services, website hosting, communications tools, admissions systems, learning platforms, etc.) under contracts requiring security and confidentiality
  
  
• Professional advisers (legal, insurance, auditing/accounting)
  
  
• Authorities and regulators where we are required to do so (e.g., safeguarding, legal compliance)

6. International data transfers

If any of our service providers process data outside the European Economic Area, we will ensure appropriate safeguards are in place (for example, Standard Contractual Clauses) and carry out transfers in accordance with data protection law. (This can apply to some online/analytics providers, depending on configuration.)

7. How long we keep personal data

We retain personal data only for as long as necessary for the purposes described in this notice, including legal, regulatory, safeguarding, and operational requirements. Retention periods vary depending on the type of record (e.g., admissions records).

8. Keeping in touch (School community communications)

We may contact parents/guardians and (where appropriate) with School information such as events, newsletters, and activities. You can opt out of direct marketing at any time by using the unsubscribe option (if provided) or contacting us at info@thamesbritishschool.es.

9. Your data protection rights

You have rights under GDPR, including:

• Access (request a copy of your data)
  
  
• Rectification (correct inaccurate data)
  
  
• Erasure (delete data in certain cases)
  
  
• Restriction (limit processing in certain cases)
  
  
• Data portability (in certain cases)
  
  
• Objection (where we rely on legitimate interests)
  
  
• Withdraw consent at any time (where processing is based on consent)

To exercise your rights, contact info@thamesbritishschool.es. We will respond within the legal time limits.

10. Complaints

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD).

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure.

12. Children’s data

We process children’s data in order to provide education and ensure wellbeing and safeguarding. Where consent is required, we obtain it from the parent/guardian (or as otherwise permitted/required by law).

13. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. The updated version will be published on this page with a revised “Last updated” date.