GovernorHub is a secure, cloud-based tool that provides online resources aimed at school governors. Our customers are schools, academies, trusts and local authorities or other resellers which purchase subscriptions to the service for their users. This Privacy Policy applies to information about you as a user and anyone else’s data which is stored using our services.

Whenever you provide us with your personal information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal information, including the UK Data Protection Act 2018 and the EC General Data Protection Regulation 2016/679 (“GDPR”) as those laws may be replaced or amended from time to time. These laws are referred to collectively in this policy as the “data protection laws”.
​

GovernorHub is committed to protecting your personal information when you are using GovernorHub services. We want our services to be safe and useful environments for our audience. This Privacy Notice applies to information held about you (in the variety of roles in which you may be a data subject under this Policy (see the Section below on Capacity in which ‘You’ may be a ‘Data Subject’)) and individuals connected to your organisation by GovernorHub which acts as either a data controller or a processor depending on its role, as described below.

This Privacy Policy explains the following (amongst other things):

We may need to update this policy and we will give you notice of this where reasonably possible; where you have given us your email address, we may use this to notify you of such changes and we will post a note on the sites to inform you that this policy has been updated.

Please check this policy regularly to ensure you always understand how we use your information. All terms that are defined in this policy have the meanings given to them in the User Terms.

We recognise that we hold personal information in relation to a range of Data Subjects, all of which may be referred to as ‘You’ for the purposes of this Policy. We anticipate that ‘You’ are likely to fall into one of the following defined sub-categories of ‘Data Subject’ and the definitions used for the purposes of these sub-categories will be used in this Policy clarify the way in which we will use your data (in addition to other definitions as described in this document):

GovernorHub, (“GovernorHub”, “us”, “we” or “our”), is a trading division of The Key Support Services Limited, (“The Key”) a company registered in England at 8th Floor, HYLO 103, 105 Bunhill Row, London, EC1Y 8LZ with company number 0268303.

In addition to GovernorHub The Key offers various online resources to school and trust leaders. Depending on the access rights granted as part of any subscription to GovernorHub users may be granted access to these online resources.

The Key through its group companies ScholarPack Ltd and Arbor Education Ltd offer a management information system to schools. Separate privacy policies are maintained for each of these other products.

Our data protection lead (DPL) responsible for communicating with you about our use of your data can be contacted at dataprotection@governorhub.com .

This Privacy Policy relates to our use of any personal information we collect from you:

You give us your personal data directly through:

To understand the types of this direct information we collect about you see Schedule 2: Fields Collected
​

In particular we collect diversity information which allows us to report on diversity across governing boards on an anonymised basis. This is a voluntary collection of information and is done with your consent and reported on if you have an active term of office. For more information see. See Schedule 2: Profile Information: Personal Information/Diversity Information

We also may collect data from the following third-party data sources (provided such collection and use is in accordance with data protection laws):

A fundamental feature of the data protection laws is the establishment of privacy principles at Article 5 of the GDPR including the principles of lawful basis, transparency, purpose-limitation, data accuracy, retention/storage, data security, data integrity, and data minimisation. We operate our business in accordance with these principles.

The six forms of lawful basis that are available are summarised in the table below:

​Lawfulness of processing

GovernorHub relies on three main legal bases for its use of your data.

Firstly, that our use is necessary in order to perform our contract with you (being our User) taking into consideration our terms and conditions (along with any commercial contract) and is reasonably proportionate and integral use of your data. For example, this applies when we use your data to provide you with access to our resources and to fulfil orders for the products you have requested, to manage product and technical support, to bill you and to run integral support tools including engagement of essential third party providers, for example our cloud hosting partners.

Secondly, specifically relating to your diversity information we rely on “Consent” when we collect and process this information. This covers the anonymised reports we provide concerning diversity of governing boards. We may also rely on your explicit consent on occasion during your online journey – for example to send you certain SMS messages, email messages, certain news briefings, some survey requests or where you wish us to help you share your professional experience with others.

Finally, we rely on the ‘legitimate interests’ basis where our use of the data has been analysed to be balanced. This would cover our marketing and business intelligence and certain sales functions, certain of our analytics tools, our personalisation of your content, our processing of auto renewals and our engagement of third-party providers to provide any non-essential functions.

We will continually assess our legitimate business needs against the need to maintain and protect your individual rights and freedoms. We are happy to make our assessment of our legitimate interests available to you upon request.

In summary, we conduct a 3-stage test to challenge ourselves and confirm our legitimate interests to hold personal data as follows:

When we do use your data and whichever legal basis we rely on, we will always ensure we consider that it is necessary and proportionate.

In common with most businesses, we handle your data in two different ways – firstly as a data controller when we handle your data for our own business purposes, to provide you with the service you have subscribed to or signed up for. This includes when we use it for marketing, invoicing and to improve our products and services.

We may also process your data as a data processor on behalf of your school organisation. For example, when you use our site to manage your calendar or to store notes, training and compliance records or when you use our systems to record personal data about third parties such as teaching professionals and students. When we handle this data, we are processing it on your behalf and it is your school organisation that is the data controller. Please check your school’s privacy policy in relation to our processing of such personal data in these circumstances.

The diagram below outlines the role and relationship of GovernorHub to the personal data accessed through our services. We may need to share parts of your profile information (name, etc.) with your Local Authority, Academy Trust, or government agencies. In relation to diversity information we are the data controller because we are capturing this data to provide aggregated diversity information on governing boards.

When is GovernorHub a data controller and when are we a data processor?

Data processor:

We may also (directly or through third party providers) use your information to contact you about renewals. GovernorHub may operate an auto renewal policy from time to time and, where this applies, we will advise you in good time before your due subscription renewal date of its expiry and if we do not hear from you informing us that you wish to cancel, we will automatically renew your subscription for a further year.

We may use automated systems or triggers to help us identify your compliance with the User Terms and to help us make decisions, for example helping us to identify the relevance of products or services to users or to help us understand the renewal risk profile of an individual user or group of users. These decisions do not have a legal or significant effect on you and do not affect the price offered to you. Individuals may have a right to certain information about automated decisions we make about them and may also have a right to request human intervention and to challenge the decision. More details can be found in the ‘Rights of individuals’ section below.

Where you are a Marketing Contact we may contact you to follow up on your inquiries for GovernorHub products and services.

For all User Types, GovernorHub has two key reasons for contacting you (we may contact you in-app, in-product, using online live chat, by telephone, SMS or email, by post or social media as described in this policy):

Firstly, to provide you with service messages. Examples of these messages may be requests to verify user credentials, to confirm your orders, to inform you of renewal options, to communicate security, product and policy updates, to assist you with technical support or in relation to any correspondence we receive from you or any comment or complaint you make about GovernorHub products or services. Our products also permit in-product communication between users (e.g. members of the same governing board).

Secondly, GovernorHub may need to contact you for its marketing purposes. This may take the form of:

We do not track your online behaviour once you leave our site.

You may opt out of receiving marketing by amending your preferences. You can do this by clicking the link on any marketing emails or Emailing us at dataprotection@governorhub.com

We may use analytics and business intelligence tools for the legitimate business interests of supporting our marketing, design, research and product development functions. This means:

Some emails that we send you have no tracking in at all e.g. support or service emails. Other emails we send include tracking so that we can tell how much traffic those emails send to our site. In some emails we can track, at an individual level, whether the user has opened and clicked on links in the email.

There are times when we might share information such as account contact, billing contact, headteacher or marketing contact info within The Key Group. This will be relevant when some of our internal support services are shared for example, Business Intelligence, Finance, Information Security and IT. It will also apply where we have your consent to give you access to online content forming part of a wider Group product suite and to market The Key group products and services to you.

In addition, we hope the group will continue to expand. So, eventually, we may have additional group companies (we will be under common ownership, though). If this happens, we may want to share your information around our group so they can use it for the same internal purposes as we do, as described in this policy.

In the unlikely event that we sell our business to a third party, or re-organise our business or become insolvent. In that scenario, our database of customers is a significant asset of our business and we might need to share elements of the database to a buyer and their advisers.

Governor Admins (such as your governing board or academy trust) are able to set permissions on the GovernorHub product that allows sharing of Governor Information which they may use for lawful purposes. You can set your own permissions on your profile page – however admins will be able to access all content. They are also able to grant permission to the reseller of the GovernorHub product to access your profile. Governor Admins are responsible for allocating the specific permissions (e.g. member level/admin level/account holder level) to their personnel.

All these third parties are data controllers in relation to the data we share with them and we urge you to review their privacy policies.

For specific purposes GovernorHub uses third parties to process your information on our behalf, for example to provide services such as email deployment or cloud storage services or analysis of the technical data we use. Please contact us for a list of these providers. They fall into the following categories:

Accounts and billing, payment and card providers (we do not view or store your card details in the GovernorHub system. Anyone involved with the processing, transmission, or storage of card data must comply with the Payment Card Industry Data Security Standards (PCI DSS));

Alternative methods of logging into our Site through accredited providers such as Google and Microsoft. Please review their privacy policies for an explanation of how these providers use the log in credentials you provide to them. We do not receive any personal data from these providers other than confirmation that your log-in has been successful.

Your account profile sets out the relevant permissions to access your data. Please also refer to the section above which addresses sharing within your organisation. Certain permitted administrators will be able (and must be able) to view certain information relating to your profile.

On occasion, or upon receiving a request, we will email the account holder’s nominated lead user/admin and/or the individual (or body) who authorised or organised membership on behalf of your school, to inform them that a new user has requested registration with us. This is intended to help ensure that people who register are eligible to use the service.

In line with the organisational and technical measures and techniques of anonymisation and/or pseudonymisation advocated by the data protection laws, we may share aggregated or anonymised information within and outside of GovernorHub - with members of our Group and with partners such as research groups, policy groups or the DfE, or Ofsted. You will not be able to be identified from this information.

In addition we collect on a voluntary basis Diversity information, an aggregate of this information will be made available to your governing board or trust board. For more information click here.

We may also use and disclose information in aggregate (so that no individuals are identified) for marketing and strategic development purposes.

We may use all or any part of your information and combine it with other user’s information to produce anonymous statistical data which we may use internally or share with third parties. Such data will not identify you or any other user personally. For example, such data may show: popularity of news items, popularity of discussion topics, demand for training materials, frequency of calendar events, numbers of documents stored. These examples are illustrative only and are not intended to be an exhaustive list.

We may also process your data where we have a legal duty to do so (this includes exchanging information with other companies and organisations for the purposes of fraud protection) or in connection with regulatory reporting, litigation or asserting or defending legal rights and interests.

GovernorHub’s group companies are currently all located within the UK and our internal servers are there also or within the EEA.

The only occasions when we may transfer your personal data outside the UK are:

The User Terms shall govern the behaviour, standards and acceptable uses of our Sites. If a User posts or uploads content which is disruptive or may reasonably be deemed to be offensive, inappropriate or objectionable or otherwise in breach of our User Terms, we may remove such content and may deny you access to the Site temporarily or permanently as we see fit.

Where we reasonably believe that you are or may be in breach of any applicable laws, in respect of hate-speech for example we may disclose your personal information to the relevant data controller, who may inform law enforcement agencies.

We will store the information linked to your account during the term for your subscription but we will keep this information under regular review to ensure we still need to use it. Individual governors: Where your account is no longer associated with a subscription you can request your account be removed by contacting your Governor Admin or your account will automatically be removed after a period of inactivity of up-to 2 years.

We will disable your account if your account is terminated for any reason. We may then keep limited data about your account for a period in line with our data retention policy. To determine the appropriate period, we consider the amount of data, its nature and sensitivity, the potential for harm and whether we can achieve our purposes through other means as well as our applicable legal requirements. Details of our records retention policy is available upon request. We will regularly cleanse this data. We will also delete your data on your request though we may hold a list of the ‘opt out’ requests to administer your request.

We have implemented reasonable and appropriate Technological and Organisational security measures to protect the data we hold about you on our servers including; HTTPS the industry standard for encryption and SSL technology. In addition, we are UKAS ISO27001 & CyberEssentials accredited, our certificates can be requested by contacting us. We undertake periodic internal and external audits to maintain the standards. We also undertake annual penetration tests by an external Crest accredited penetration tester. Details of our latest Technological and Organisational measures can be provided upon request.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted.

Unfortunately, the transmission of information via the internet is not completely secure and we cannot guarantee that data breaches will never occur. Please keep your account details and your device safe from unauthorised use or intervention at all times – and remember to log out or close down stale or inactive pages after use.

You should not allow others to access your account, for example by sharing your login details with a colleague. All users at your organisation are entitled under the licensing agreement to set up their own account which they can do on governor.hub.com

GovernorHub strongly recommends you activate and protect your account with multi factor authentication.

No online service or website can be completely secure; if you have any concerns that your GovernorHub account could have been compromised e.g. someone could have discovered your password, please get in touch straight away via governorhub.com.

GovernorHub websites contain hyperlinks to websites owned and operated by third parties. These third-party websites have their own privacy and security policies, and are also likely to use cookies, and we therefore urge you to review them. They will govern the use of personal information you submit when visiting these websites, which may also be collected by cookies. We do not accept any responsibility or liability for the privacy practices of such third-party websites and your use of such websites is at your own risk.

You have a number of rights in relation to the information that we hold about you which are summarised below. You can exercise your rights by contacting us at dataprotection@governorhub.com. You may also wish to contact your school for information.

If we have got something wrong please do contact us in the first instance. However individuals have a right to complain to the UK Information Commissioner’s Office by visiting www.ico.org.uk, or to the data protection regulator in the country where they live or work.