Privacy Notice

Classlist Privacy Notice

1 Introduction

1.1 Classlist offers a service which allows schools, PTAs and parents to build private, trust-based communities for parents at their school. Members provide and share information (including personal contact information); communicate with other members; create a marketplace for goods and services; help fund-raise; and arrange events for their school community.

1.2 If Classlist offers its service on behalf of your school or PTA, the school or PTA are in data protection terminology the "controller" and Classlist is the "processor". Please direct any queries on how your personal data is used to the appropriate controller. When you register you will be told if the controller is the PTA or the school but if you are unsure, please contact us on support@classlist.com.

1.3 Classlist may send you emails which contain adverts but only where you have given your consent to this. In respect of this activity, Classlist is a "controller" because the adverts are being sent to you on behalf of Classlist, not the school or the PTA.

1.4 Providing personal data online involves a great deal of trust on your part and the Classlist platform places the highest priority on ensuring the security and confidentiality of the personal data you provide. We have designed our processes and procedures to comply with UK data protection laws.

1.5 This Privacy Notice describes how your personal data is used in connection with your use of our website, emails, services, and mobile applications (the "Classlist Platform"). Other aspects of our service and user obligations are contained in Classlist’s Terms & Conditions.

1.6 This Privacy Notice may need to be updated from time to time. We will inform you of such updates either by sending a notice to the e-mail address you provided to us or by placing a prominent notice on our website. .

1.7 In this Privacy Notice the terms "we", "us", "our" and "Classlist" refer to Classlist, the trading name for Intrepid Ant Ltd, a UK private Limited Company, and/or our subsidiaries or corporate affiliates. The term "you" refers to any person or entity that visits our Website or uses the Classlist Platform.

2 Users covered in in this Notice

2.1 This Privacy Notice applies to information we collect about:

registered users of the Classlist Platform. These are generally parents or guardians of students or alumni, or school staff at schools supported by Classlist; and
people who use our platform, e.g. who subscribe to newsletters or request information from us, and visitors to our website.

3 Use of personal data

3.1 Your personal data may be used as follows:

in connection with the creation, registration, management or provision of your account;
to verify that you are a member of the school community and that you are allowed to access the Classlist Platform. Your personal data, including your name and contact details, will be passed to the school and / or the PTA in order to validate your registration;
in connection with the management of your account, including enabling your access to and use of the Classlist Platform. This includes collating your information with that of other school community members for use by members, and where you have configured your preferences to allow for this, to enable you to contact members in other Classlist schools. It also enables us to publish your reviews, forum posts, and other content to the Classlist community, and lets you access messages, invitations and notices from the Classlist community;
to communicate with you in general, for example, to tell you if Classlist will not be available because of scheduled maintenance. We will also add you to the recipient list of our newsletters which contain relevant information that we believe you may find of interest. You can unsubscribe from this at any time; and
to comply with any legal obligation on your school, the PTA or us (for example a court or police order) which necessitates disclosure of personal data, as set out in Section 8.1 of Classlist’s Terms & Conditions, or to access and disclose any information considered necessary to protect Classlist’s systems and customers or to ensure the integrity and operation of Classlist’s business and systems, where such release is consistent with data protection law.

The information you provide through the registration process that is marked with an asterix is necessary to enable your account to be created and to make the Classlist Platform available to you. If you cannot provide this information you will not be able to use the Classlist Platform.

3.2 Your personal data will not be sold to third parties. Nor will it be shared with third parties so they can serve you with advertisements. Third parties cannot collect personal data about you from the Classlist platform.

3.3 If the school or the PTA is the controller (please see the introduction above) then:

they will have additional rules about how they use your personal data in relation to the Classlist platform and you should discuss this with them if you have any questions or concerns; and
they will have a right to access any information held on the platform about you. However, they must comply with data protection law when carrying out such access.

4 Access rights to personal data held within Classlist

4.1 Most of the personal data held within Classlist is contributed by members, who chose what information to share with other members. The table below shows what types of information can be accessed by different categories of Classlist user.

Table 1: Access by different categories of Classlist user

Parties able to access parent data	Scope and purpose of access
1 General Public	No access to any parent personal data.
2 Classlist Advertisers	No access to any parent personal data. Information may be provided on an anonymised basis.
3 Parents at each Classlist school	Another parent cannot see any information about you unless and until your registration has been approved (except for parents who are Class Reps or Ambassadors, please see below). Once your registration has been approved parents can see information about you as detailed in Table 2 below. Your data is not shared with parents at other schools.
4 Class Representative	Similar access to parents. In order to authenticate joiners they can also see data about who is applying to join their class and who is awaiting approval.
5 Classlist Ambassador	Each Classlist school site is set up and managed by one or more Classlist Ambassador, generally a parent but occasionally a member of the school staff. Classlist Ambassadors can see the personal data supplied by all parents at the school with certain safeguarding exceptions detailed below. They can also see email details for parents who have been invited to join Classlist by Ambassadors or Class Reps. This latter excludes invitations sent directly from individual parents within the Classlist system, which are not visible. Please note that if you are a parent and you invite other parents to join then you must do so only where the other parent has previously consented to joining Classlist.
6 School Administrator	School administrators have the same level of data access as Classlist Ambassadors. They may also validate and update data (for example, which class a pupil is in) using school records. They also inform the Classlist Safeguarding Officer if exclusion orders or other special circumstances require that specific parents may not access Classlist. These interchanges are not visible to other users including Classlist Ambassadors. Users registering with Classlist will have their details checked against personal data held by the school or on occasion the PTA for purposes of user verification and authentication.
7 Classlist Staff	Classlist staff have access to all parent personal data which has been supplied by parents or directly by the school or the PTA. However, in practice Classlist Staff will only access such data in limited circumstances for specific reasons (for example if your school asked Classlist to investigate abusive comments posted by another parent). They may not have access to data provided by school authorities to Classlist’s Safeguarding Officer (please see below). Please note that if the controller is your school or the PTA (please see the introduction above) then any safeguarding issues must be reported direct to them.
8 Classlist Safeguarding Officer	Classlist’s Safeguarding Officer is employed by Classlist to assist schools and other members with safeguarding concerns. This officer has access to all parent personal data and any additional data provided in relation to safeguarding issues.

Note : When Class Reps and Ambassadors are assigned these roles, their attention is specifically drawn to the sections highlighting their special responsibilities in handling personal data set out in section 4 of the Terms & Conditions.

Table 2: What data will be visible on the Classlist Platform

Category of data	Mandatory?	Shared with whom, when?
		Note: all details are shared with Classlist administrators (which may include school and PTA staff) during registration for verification purposes
Name	Yes	Shared with your Year Group and discoverable by all year groups. When you join Classlist your first name and first initial of your last name, and your child's first name and class, along with your profile picture, may be shared with other members of your class in the weekly digest
Email	Yes	You will need to provide an email address as part of the registration process but this will only be visible to other users if you chose to make it so through your account settings.
Relationship with Child	Yes	Shared with your Year Group and discoverable by all year groups
Street Address	No	If you choose to provide this information then it will be visible to your Year Group but can be hidden
Telephone Number	No	If you choose to provide this information then it will be visible to your Year Group but can be hidden
Child’s Name	Yes	Shared with your Year Group and discoverable by all year groups
Child’s Gender	No	Shared with your Year Group but not discoverable by other Year Groups
Child’s Class/House	Yes	Shared with your Year Group and discoverable by all year groups
Child’s Month of Birth	No	Shared with your Year Group, not discoverable by other Year Groups
Family Contacts	No	Shared with your Year Group, not discoverable by other Year Groups
Parent Map	No	Separate affirmative consent required for this. Shared with all Year Groups as dot on map with parent name and child(ren) name displayed.

Further categories of personal data may be processed through parents' interaction with the Classlist Platform, for example, when a parent sends a message to other parents using the Classlist Platform.

5 User access to personal data

5.1 Each Classlist member can access their profile at any time. This contains the personal data which is held on them.

6 Your rights

Data protection legislation gives you a number of rights regarding your information. Your rights are as follows:

if your information is incorrect you can ask that it be corrected or if your information is incomplete you can ask that it be completed;
you can ask what information is held about you and be provided with a copy. You are also entitled to be given extra information, such as why your information is used, where it came from and what types of people it has been shared with;
you can ask for information about you to be deleted without undue delay in certain circumstances. This is known as the "right to be forgotten";
you can object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms;
to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent. Withdrawal of your consent will not affect the lawfulness of processing before the withdrawal. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent;
you can complain about our processing of your personal data to a supervisory authority responsible for data protection (please see Sections 16.4 and 16.5 for further details);
you can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer (please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you); and
the use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate it can only use it for limited purposes whilst its accuracy is checked, or where you have objected to our use of your data but we need to verify whether we have overriding grounds to use it.

If you would like to exercise any of the above rights, please contact Classlist. Our preference is that you contact us via support@classlist.com. Please note that if the school or the PTA is the controller (please see the introduction above) then it is the school or the PTA (as the case may be) who is legally responsible for providing a response, so we would discuss your request with them.

7 Children and other family members

7.1 Classlist holds information on children (their name and, if shared by the parent, the family address and month of birth) through their parent record. This information is uploaded by the child’s parent or guardian as part of their profile. This means that a child's name is visible to other parents in the same year group, and can be searched and found by parents in other year groups at the school.

7.2 Information on children may also be shared as part of ongoing communications and posts on the platform.

7.3 Data protection legislation also gives children rights in respect of their personal data. By registering, you confirm that the following is true: Either each child you have added is under twelve or, in respect of any child aged over twelve, you have made them aware that you will enter their details into Classlist, that their names, gender, class/house and month of birth will be visible to other registered parents, and they have not objected to this. You have also told them that they can find out more in the Classlist Privacy Notice.

7.4 You must also tell other family members before sharing personal data about them (for example, your spouse).

8 Legal basis for processing personal data and parties involved

8.1 You are entitled to know the legal basis on which personal data are processed.

“Legitimate interests” –

o In respect of any personal data processed before users register on the Classlist Platform. This applies where your school or PTA use the Classlist Platform to send you emails but before you have registered. The school community, which may be represented by the school or by the PTA, has a legitimate interest in building up an inclusive, properly validated and regularly updated set of parent contact details, in order to communicate with parents.

o Legitimate interest also applies in respect of personal data processed about children and other family members. The school or the PTA (as the case may be) has a legitimate interest in developing the school / parent community which will necessarily involve sharing personal data about children and other family members through parents' interaction with the Classlist website

o Also where we (in our capacity as a Data Controller) generally communicate with you (as described in paragraph 3.1 above).

“Consent” – in respect of your personal data being shared with other parents as described in part 4 above. If a user withdraws their consent then they may not be able to access the Classlist Platform. Any withdrawal of consent will not affect the lawfulness of the use of personal data prior to consent being withdrawn. Occasionally personal data may continue to be used even if consent has been withdrawn, for example, if an individual makes a complaint.
“Necessary for performance of a contract" - The school or the PTA (acting through Classlist), or Classlist itself if the school or the PTA are not the controller, will need to use your personal data in order to provide the Classlist Platform, for example so that it can register your account and allocate you to the correct year group. As part of this, it may be necessary for the School to provide information to Classlist or the PTA in order to verify that you are able to join the Classlist group and, in future years, so that you can be allocated to the class group that you child is in before the start of the new school year.
"Necessary for compliance with a legal obligation” – this basis applies in special circumstances such as a police or other legal investigation or serious complaint requiring the school, the PTA or Classlist to release personal data, or the final bullet point set out at Section 3.1 above, where such release is consistent with data protection law.
"Public interest": In limited circumstances, your school may use personal data to help it discharge its functions relating to providing an education to pupils and looking after their welfare. For example, where a school decided to take action because something posted could affect a child's welfare.

8.2 In some circumstances Classlist will itself act as a Data Controller. This will be the case if you provide your details to Classlist directly where your school or the PTA are not involved. Classlist will also be a Data Controller where it uses your personal data to send you emails containing adverts (please see paragraph 1.3 above). Classlist is the trading name of Intrepid Ant Ltd, Company no. 08621032. Intrepid Ant is registered as a Data Controller with the UK Information Commissioner’s Office (registration number: ZB288796). The registered office is 77 Kingston Road, Oxford OX2 6RJ.

9 Use of third party services in processing your data

9.1 The Classlist Platform uses a range of specialised third party services to offer the best possible user experience; ensure the security and efficiency of the website and app, and perform some statistical and analytic tasks. Where such third parties act as data processors in respect of your personal data, our contracts with them ensure that any information is protected in the manner required by current data protection legislation. The categories of third party service provider we use are as follows:

Analytic services to collect standard internet log information and details of visitor behaviour patterns to our website classlist.com. This information is only processed in a way which does not identify anyone. We do not make, and do not allow our providers to make, any attempt to find out the identities of those visiting our website.
Performance management services to help maintain the security and performance of the Classlist website and apps. To deliver this service they process the IP addresses of visitors.
Enquiry handling software to help us respond quickly to set-up and registration requests.
Blog hosting services which collect anonymous information about users' activity on the site, for example the number of users viewing pages on the site. Visitors that want to post a comment are required to enter a name and email address.
Helpdesk services which collect your name, email address (optional) and the contents of your helpdesk session. Users can request a transcript of each helpdesk session if you provide your email address at the start of your session or when prompted at the end.
Social media services. If you send us a private or direct message via social media the message will be stored for a limited period, typically three months.
Survey services to gather user feedback. These are generally anonymous and if any personal data is required users will be asked to consent to this in advance. Such information will be stored for a limited period, typically three months. It will not be shared with any other organisations
Inbound email services. Email monitoring and blocking software is used to manage inbound email. Any email and attachments sent to our various Classlist addresses may be monitored for security and content. Users should be aware that any email sent to us must be within the bounds of the law.
Outbound email services to deliver regular email updates and e-newsletters to Classlist members. As described below under cookies, we gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve this service.
Payment services to enable purchase of tickets and other items. We use payment providers who in our view provide high levels of user security and keep any personal or payment data private and confidential.
Third party hosting services to hold your personal data in secure data centres located within the UK and the European Economic Area.

10 How long we keep your personal data for

10.1 Usual retention periods are as follows:

Data will ordinarily be retained for three years after the parent’s child leaves the school, but may be subject to shorter retention periods (for example, if a parent requests that their account should be deleted).
If you use the helpdesk services described above then this information will be kept for two years.
If you make a complaint where Classlist is the controller then information on the complaint file will usually be kept for two years.
Users can update, amend, or delete information contained in this record, and alter some of what is shared with other parents, at any time. When a parent deletes a particular piece of information or requests deletion of their entire account, some data may be retained for a limited period to enable data recovery in the event of an error. This data is not visible to other users and is transferred to a backup storage file which is deleted every six months. Data may also be kept by your school or PTA where they are the controller, please see paragraph 10.2 below.
If you send us a message through social media it will be stored for a limited period, typically three months. Personal data collected through surveys will also usually be kept for this period as well.

10.2 Where the school or the PTA are acting as controller then they may keep your information for longer, in accordance with their retention periods. This includes any information about you held in the Classlist Platform.

11 Use of cookies and web beacons

11.1 Cookies are small data text files stored on your computer's hard drive, depending on the configuration of your Web browser. Web beacons (also known as clear gifs, pixel tags or Web bugs), are small graphics with a unique identifier, similar in function to cookies and included under the term cookies below.

11.2 All users applying to join Classlist are given the opportunity to review our cookie policy and are asked to consent to their use during the registration process. We use these cookies as follows:

To help us recognise your browser identity as a previous visitor and recall any preferences which have been set. For example registration information can be retained to avoid the need to log into our Website each time you visit. We also may record your password in a cookie. Member IDs, passwords, and any other account-related data included in such cookies are encrypted for security purposes.
To monitor the traffic patterns of users from one page within our Website to another, to deliver or communicate with cookies, to understand where users have come from, and to improve Website performance.
To help us and third party providers to track visitor traffic and actions on our Website, including which pages have been visited and which emails have been opened. This helps us measure and improve the effectiveness of our offerings.

11.3. Users can set cookie preferences through their browser. This may include the ability to refuse new cookies; to be notified when you receive a new cookie, or to disable most types of cookies. Please note that if you refuse to accept or disable cookies, you may not be able to access some of the tools offered on our Website.

11.4 To supplement this cookie and web beacon information we may also collect device data about the type of computer or phone you are using; the browser software and version installed, and the time and duration of your sessions. This data is needed to diagnose and resolve any access, compatibility or other technical problems users may encounter whilst visiting the site.

12 Sending information to other countries

We may send your information to countries which do not have the same level of protection for personal information as there is in the UK. For example, when you (or another Classlist user) accesses the Classlist Platform when on holiday.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
Where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

We can provide you with details about the safeguards which we have in place. If you have any questions about the safeguards that are in place please contact us on dataprotection@classlist.com.

13 Advertisements

13.1 We use in-house software to position advertising material on our website and app. Adverts are not targeted at individual users and are not linked to user browsing history. They are typically served up on a per year group or per school basis. Adverts are also displayed in certain emails from Classlist where specific consent has been received for this from the user but we will not do this otherwise. Users have the option of unsubscribing to emails which contain adverts.

13.2 Advertisers have no access to any personal data on Classlist users and cannot communicate directly with parents in any manner.

14 Links to other websites

14.1 This privacy notice does not cover the links within our site and app linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

15 Safeguards in the event of company sale or closure

15.1 Any entity acquiring the assets of Classlist will be subject to the same legislative restrictions regarding use of personal data as Classlist is now.

16 Enquiries and Complaints

16.1 Where we receive a complaint where the school or the PTA is the data controller then we will pass that complaint onto them.

16.2 When we receive a complaint where we are a controller (for example, if we receive a complaint from a parent who signed up directly to Classlist rather than going through the school or the PTA) then we make up a file containing the details of the enquiry. This normally contains the identity of the person submitting the enquiry or complaint and any other individuals involved. If the enquirer doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not always be possible to handle enquiries or complaints on a completely anonymous basis. Information on enquiries and complaints is kept in line with our retention policy, which means detailed files are kept for two years from closure of the enquiry. These files are retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle. Aggregate data on enquiries may be retained for a longer period for trend analysis.

16.3 Secure management of personal data is central to Classlist’s business mission. We try to meet the highest standards and therefore take enquiries and complaints concerning this very seriously. We encourage people to alert us if they believe our practices in collection or use of personal data is unfair, misleading or inappropriate. We also welcome suggestions for improvement.

16.4 Nothing in this Privacy Notice affects the rights of users to lodge complaints with any relevant authority.

16.5 If you have a complaint about how your personal data has been used in relation to the Classlist Platform you can contact the Information Commissioner's Office: ico.org.uk.

17 Scope of this privacy notice and further information

17.1 If you have any questions, we can be contacted at:

support@classlist.com or:

Classlist Enquiries

228 Banbury Road

Oxford OX2 7BY

United Kingdom

If required this Privacy Notice is also available as a Privacy Policy.pdf (Last updated 18 January 2022)

Privacy Policy

We take your privacy seriously