Privacy Notices

Website Privacy Policy

This website is operated by Boston Grammar School. This policy sets out how our websites process your data and applies to bostongrammarschool.co.uk, bostongrammar.co.uk and all subdomains.

Technical Information & Identifiers

When you visit our website, our servers automatically log standard technical data, including your IP address, browser type, and time of access.

Data Processors: Your technical data is processed by our third-party website hosting provider located in the UK for the purposes of site security and performance.
Lawful Basis: This data is processed based on our legitimate interest in ensuring the security and stability of our website.
Data Retention: These logs are stored temporarily for security purposes and are typically deleted or anonymised after 12 weeks.

To protect our website from malicious activity and automated bot attacks, we may temporarily process technical data (such as your IP address and browser configuration) to verify you are a human user.

Lawful Basis: This data is processed based on our legitimate interest in ensuring the security and stability of our website.
Anonymisation: To protect your privacy, the raw data is immediately anonymised and is not retained by our servers.
Data Retention: This data is used in real-time to calculate security metrics that are stored in our logs. These logs are stored temporarily and are automatically deleted after 12 weeks.

Your Right to Object

You have the right to object to this processing. However, because this logging is strictly necessary for the technical operation and security of the site, our legitimate interest typically overrides an individual objection to ensure a safe environment for all users.

Automated Security Decisions

To protect our website from malicious activity, we use automated systems to analyse traffic patterns and verify that requests are made by human users rather than bots.

These systems evaluate technical signals (such as your IP address, browser configuration, and request frequency) to determine if a visit is suspicious. If our system identifies a high risk of automated or malicious behaviour, it may automatically restrict your access to certain site features or file downloads.

While these automated decisions are necessary for site security, you have the right to request human intervention and to contest the decision. If you believe you have been incorrectly blocked or prevented from downloading a file by our automated security, please contact the school data protection administrator for assistance (contact details provided at the end of this policy).

Storage and Access Technologies

Our website only uses essential cookies and storage. Under UK law, we do not need to show a popup consent banner since we only use essential cookies and storage. We do not use any storage and access technologies for tracking purposes.

Cookies and storage we use:

Security clearance cookies: These cookies contain temporary tokens that allow our automated systems to recognise that our site has verified you are human. This prevents you from being blocked by our automated systems during your visit and helps us to ensure that we are compliant with our accessibility regulations. These cookies are temporary session cookies and are not tracked or retained by our servers in any way.
User preference and appearance settings: We use local storage technologies to remember choices you have made to customise your experience, such as your preferred colour overlay settings for accessibility. This ensures the site appears exactly as you requested across different pages and future visits. These settings are stored locally on your device and are used solely to provide the interface you have selected.

Third-Party Embedded Content

To enrich our website, we sometimes include content from third-party sites like YouTube (videos), Google Maps, or social media feeds. These services often use their own cookies to track views or user behaviour.

Because these providers may collect technical information or set tracking cookies, we do not load them automatically. No third-party cookies will be placed on your device unless you choose to interact with the content by clicking the 'Accept Cookies' button on the specific widget. Once you click this button, you are giving explicit consent for that specific provider to set cookies on your device for that session. You can find more information in the privacy policies of these providers.

Operational Website Analytics

We analyse server logs to understand how our website is used (e.g. which pages are most popular and where users encounter errors). This process does not use cookies and does not store information on your device.

Data Processed: We record your IP address alongside the specific pages you visit, the time of access, your browser type and security metrics.
Lawful Basis: This processing is based on our legitimate interest in improving our website’s performance and content based on actual usage patterns.
Anonymisation: To protect your privacy, we anonymise (truncate) IP addresses to ensure the data cannot be used to identify you personally in our long-term analytics reports.
Data Retention: These logs are stored temporarily and are automatically deleted after 12 weeks.

Your Right to Object

You may object to this analysis by contacting the school data protection administrator (contact details provided at the end of this policy). While we cannot stop the server from receiving your IP address to deliver the webpage, we will ensure your specific visit data is excluded from our analytics processing upon a valid request.

Internal Sites and Subdomains

Our school operates internal subdomains and related domains used exclusively by staff and students. In addition to the standard technical logs, these sites collect your school login credentials and records of user activity on these sites. Where users are required to log in, a secure session cookie is stored on your device to keep you logged in as you navigate the site. This cookie is essential for the correct functionality of the site.

Lawful Basis: We process this information as a public task as it is necessary for our official function of providing an education and maintaining a secure learning environment.
Access: These sites are not accessible to the public, but the privacy information within this policy applies to all users of these platforms.

International Data Transfers

While our primary website data is stored on secure servers located within the United Kingdom, we may occasionally transfer or provide access to technical data (such as your IP address) to recipients in countries outside of the UK. This occurs primarily through our use of a Global Content Delivery Network (CDN) and certain administrative sub-processors used by our hosting provider.

Recipients and Destinations

CDN Nodes: To ensure our website loads quickly for visitors regardless of their location, static content is cached at secure nodes globally. These include locations in the USA, European Economic Area (EEA), Asia-Pacific, and the Middle East.
Sub-Processors: Our hosting provider may use administrative sub-processors located outside the UK for tasks such as domain registration or technical infrastructure support.

Level of Protection and Safeguards

All transfer of your data outside the UK is protected by at least one of the following mechanisms:

Adequacy Decisions: For transfers to the EEA (e.g. France, Germany, Netherlands) and other countries like Switzerland, Israel, and New Zealand, the UK Government has issued "adequacy regulations." This means these countries are recognized as providing a level of data protection essentially equivalent to the UK.
UK-US Data Bridge: For transfers to the USA, we prioritize recipients certified under the UK Extension to the Data Privacy Framework, which provides an adequacy-based mechanism for secure transfers.
Standard Contractual Safeguards: Where no adequacy decision exists (e.g. certain nodes in Asia or the Middle East), we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. These are legally binding contracts that require the recipient to protect your data to UK standards.

Residual Risks

In the absence of an adequacy decision or where specific local laws might conflict with UK standards, there is a theoretical risk that your technical data (like an IP address) could be accessed by local authorities in those jurisdictions. However, because the data transferred is limited to standard technical identifiers used for website delivery and security, we consider the risk to your individual privacy rights to be minimal.

Contacting Us About Your Data

The Trust has the responsibility to ensure that your personal data is protected. It is called the data controller. All members of staff work for the data controller.

We recommend that you contact the data protection administrator:

Name of Person: Debbie Davidson
Email address: Debbie.Davidson@bostongrammarschool.co.uk
Contact number: 01205 366444
Contact address: Boston Grammar School, South End, Boston, PE21 6JY

Schools are also required to have someone called a Data Protection Officer or DPO. The DPO advises the school about issues to do with data protection, but can also help you, if you have a problem.

Our Data Protection Officer is:

Name of DPO: GDPR Sentry Limited
Email address: support@gdprsentry.com
Contact number: 0113 804 2035
Contact address: Unit 434 Birch Park, Thorp Arch Estate, Wetherby, West Yorkshire, LS23 7FG

If you have a concern about the way we are collecting or using your personal data, you must raise your concern with us in the first instance. If you remain dissatisfied with our response, or if we fail to respond to your complaint within 30 days, you then have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.

This statement was last updated on 26/01/2026 and is reviewed annually.