This policy describes the intended approach to handling personal information. The school must confirm that the practices described here match the website's actual operation before publication.
Introduction
Christ the King High School, located in Roma, Lesotho, recognises the importance of protecting personal information belonging to students, parents and guardians, teachers, staff, applicants, and other visitors to its website.
This Privacy Policy explains the types of information that may be collected through the website, the purposes for which that information may be used, how it may be protected, and the circumstances in which it may be shared.
This policy applies to the school's website and its online features, including contact forms, admissions-related submissions, accounts, educational resources, and student discussions where those features are available.
Personal information must be handled in accordance with applicable laws in Lesotho and the school's approved data-protection practices.
Information We Collect
The information collected depends on how a person uses the website and which services are available. The school should collect only information that is reasonably necessary for a legitimate purpose.
Information provided by users
This may include:
- Names and other identifying details submitted through forms.
- Contact details, such as an email address or telephone number, where requested.
- Information included in enquiries or messages sent to the school.
- Information submitted through admissions or other school-related forms.
- Documents or supporting files submitted through authorised upload features.
- Information voluntarily included in forum posts, questions, or replies.
Account information
Where authenticated services are available, the website may process account identifiers, usernames, role assignments, authentication-related information, and other details required to manage authorised access.
Passwords should be stored using an appropriate one-way password-hashing mechanism rather than as readable plain text.
Technical information
Depending on the hosting environment and security configuration, the website or its infrastructure may process technical information such as access timestamps, requested pages, browser information, error records, and IP addresses.
Technical information should be collected and retained only as necessary for the disclosed operational, diagnostic, or security purposes.
How Information Is Collected
Information may be collected through several website interactions, depending on the features provided.
- When a visitor submits a contact or enquiry form.
- When an authorised user signs in or uses a protected service.
- When a user submits an admissions document or another school-related file.
- When a user posts a question or reply in a discussion feature.
- When a visitor browses pages and technical records are generated by the website or hosting infrastructure.
- When a person contacts the school through an official communication channel.
The website should explain any additional collection method where it materially affects users' privacy. Information should not be collected through hidden methods that are inconsistent with applicable law or the purposes communicated to users.
How We Use Information
Subject to applicable law and the school's actual practices, information may be used for purposes such as:
- Responding to enquiries and communicating with visitors.
- Providing educational information and school-related services.
- Processing admissions-related or administrative submissions.
- Managing authorised user accounts and access permissions.
- Supporting educational discussions and addressing reports of inappropriate content.
- Maintaining website functionality, diagnosing errors, and improving reliability.
- Detecting, investigating, and responding to suspected security incidents or misuse.
- Meeting applicable legal, regulatory, or legitimate school-administration obligations.
The school should identify an appropriate lawful basis for each relevant processing activity. Information should not be reused for unrelated purposes in a manner that is incompatible with the purpose for which it was collected.
Students and Minors
The website may be used by school-age students, including individuals under the age of 18. Their privacy, dignity, and safety require particular care.
The school should take appropriate steps to limit the collection and disclosure of student information to what is necessary for legitimate educational and administrative purposes.
Students are encouraged not to publish:
- Home addresses or personal telephone numbers.
- Passwords, authentication codes, or account credentials.
- Private information about themselves or other students.
- Medical, family, financial, or other sensitive details.
- Photographs or documents containing personal information without appropriate permission.
Where consent, parental or guardian involvement, or additional safeguards are required by applicable law, the school should implement the appropriate process before collecting or using the relevant information.
The school should also ensure that any arrangements for student accounts, public posts, moderation, and access to records are suitable for the age groups using the website.
Student Forum and Public Content
Where a Student Forum or similar discussion feature is provided, submitted questions, replies, display names, timestamps, and associated discussion information may be processed to operate the feature.
Depending on how the forum is configured, some contributions may be visible to other visitors. Users should therefore treat forum posts as potentially public unless the interface clearly indicates otherwise.
Users should not publish personal information about themselves or other people in public discussion areas.
Moderation and reports
Authorised school personnel may need to review reported posts or associated records to address bullying, inappropriate content, security concerns, or violations of school policy.
Access to moderation information should be limited to authorised personnel who need it for their responsibilities.
The school should clearly communicate how forum posts are displayed, what information accompanies them, and how users can request assistance or report a privacy concern.
Documents and File Uploads
Some website features may allow authorised users to submit or access documents, including admissions-related files and educational materials.
Uploaded files may contain personal information. Users should ensure that they are authorised to submit a document and should avoid uploading unrelated or unnecessary personal details.
The school should apply suitable safeguards to uploaded files, including access restrictions, file-type validation, size limits, and appropriate storage and backup practices.
Documents containing private student or applicant information should not be made publicly accessible unless there is a lawful and authorised reason to do so.
Users should contact the school if they believe that a file has been submitted to the wrong place, exposed to unauthorised people, or published without appropriate permission.
Information Security
The school should implement reasonable technical and organisational safeguards to protect personal information against unauthorised access, loss, alteration, disclosure, or destruction.
Depending on the information and the risks involved, safeguards may include:
- Role-based access controls and appropriate account permissions.
- Secure password storage and authentication controls.
- Encrypted connections for data transmitted over the network.
- Appropriate server, application, and database security measures.
- Monitoring and review of relevant security events.
- Suitable backups and recovery procedures.
- Restricting access to uploaded files and sensitive records.
- Procedures for investigating and responding to security incidents.
No internet-connected system can be guaranteed completely secure. The school should respond appropriately to confirmed incidents and comply with any applicable notification requirements.
Users should promptly report suspected unauthorised access, lost credentials, or the exposure of personal information through an official school contact channel.
Data Retention
Personal information should be retained only for as long as necessary for the purpose for which it was collected, subject to applicable legal, regulatory, educational, and recordkeeping requirements.
Different types of information may require different retention periods. For example, enquiries, account records, admissions documents, forum contributions, and security logs may be subject to different requirements.
When information is no longer required, it should be securely deleted, anonymised, or otherwise disposed of in accordance with the school's approved retention procedures and applicable law.
The school should establish and document actual retention periods rather than assume that all records can be retained indefinitely or deleted immediately.
Privacy Rights and Requests
Depending on applicable law and the circumstances, individuals may have rights relating to their personal information. These may include the right to request access to information, correction of inaccurate information, or deletion where appropriate.
Individuals may also be entitled to raise objections or complaints, or request information about how their personal data is being handled, where provided for by applicable law.
Requests should be directed to the school through its official communication channels. The school may need to verify the identity and authority of the person making a request before responding.
Some records may need to be retained or may be subject to lawful restrictions. The school should explain any applicable limitations when responding to a request.
A parent or guardian's ability to request information concerning a student depends on applicable law, the student's circumstances, and the authority of the person making the request.
External Websites and Services
The website may link to third-party websites or rely on external services for certain functions. Those services may collect information under their own privacy policies.
The school does not control the privacy practices of every external service. Users should review the relevant provider's privacy information before submitting personal details.
The school should review third-party services used on its website to understand what information they receive and whether additional safeguards or disclosures are necessary.
Changes to This Privacy Policy
This policy may be updated to reflect changes in the website's features, the information processed, the school's practices, or applicable law.
The latest approved version should be published on this page. Where appropriate, significant changes should be communicated through the website or another suitable school channel.
Users should review this page periodically. Where a change requires renewed consent or another specific action under applicable law, the school should take that action.
Contact the School
If you have questions about this Privacy Policy, want to raise a privacy concern, or believe that personal information has been exposed or handled incorrectly, please contact Christ the King High School through its official communication channels.
Protecting the privacy of students, families, staff, and visitors is an important part of maintaining a safe and trustworthy school community.