PRIVACY POLICY

Shrewsbury International School Phnom Penh (SISPP) Website

Last updated: 16/02/2026

1. Who we are

This Privacy Policy explains how Shrewsbury International School Phnom Penh (“SISPP”, “we”, “us”, “our”) collects, uses, stores, and protects personal data when you use our website.

1. Website: https://shrewsbury.edu.kh/
2. School: Shrewsbury International School Phnom Penh
3. Address: No. 88, Mekong River Street, Phum 3, Sangkat Chroy Changvar, Khan Chroy Changvar, Phnom Penh, Cambodia
4. Phone: +855 (0)86 268 555
5. Email: info@shrewsbury.edu.kh

If you have questions about this policy or your data, contact us using the details in Section 12.

2. What personal data we collect and why we collect it

We collect (a) personal data you choose to provide to us and (b) limited technical data that may be collected automatically when you use the website.

A) Data you provide (typical examples)

When you enquire, book a tour, request information, or contact us, we may collect:

• Parent/carer name
• Email address
• Phone number (including WhatsApp/Telegram)
• Child’s name (if provided)
• Child’s date of birth (if provided, for year-group guidance)
• Preferred start date (if provided)
• Current school (optional)
• Languages at home (optional)
• Any information you choose to share about learning support needs (optional)
• Any other information you include in your message

Why we collect it (purpose)

• We use this information to:
• Respond to enquiries and provide admissions guidance
• Arrange tours and follow up appropriately
• Support year-group guidance and planning
• Manage our relationship with families (including keeping records of communications)
• Meet safeguarding and operational responsibilities where relevant

Legal basis (how we are allowed to do this)

• We process personal data on one or more of the following grounds, depending on the situation:
• Legitimate interests: responding to enquiries, providing school information, improving communications and services
• Steps prior to enrolment: taking steps at your request before enrolment (for example, admissions discussions and tour arrangements)
• Consent: where you choose to opt in to marketing communications (if used)
• Legal obligations: where we are required to retain information or respond to lawful requests

B) Technical data collected automatically

When you use the website, we may collect:

• IP address (often in a limited/aggregated form depending on tools used)
• Browser type, device type, operating system
• Pages visited, time spent, referral source
• Cookies and similar technologies (see Section 6)

Why we collect it

We use this information to:

• Keep the website secure and functioning
• Understand website performance and improve content and user experience
• Measure the effectiveness of communications and campaigns (where applicable)

3. Comments

If comments are enabled on the website:

• When visitors leave comments, we collect the data shown in the comments form and also the visitor’s IP address and browser user agent string to help spam detection.
• An anonymised string (hash) created from your email address may be provided to the Gravatar service (if used) to see if you are using it.
• If comments are not enabled, this section does not apply.

4. Media

If users can upload images to the website:

• Avoid uploading images with embedded location data (EXIF GPS), as visitors may be able to download and extract location data from images.
• Uploaded files may be publicly accessible depending on site settings.
• If public uploads are not allowed, this section may be treated as guidance only.

5. Contact forms and enquiry forms

If you submit an enquiry form, tour request, or contact form, we collect the details you submit (see Section 2A). We use this information only to:

• Respond to you
• Support admissions guidance and tour planning
• Manage communications related to your request
• We do not sell your personal data.

Important note for parents

If you include information about your child’s learning needs or wellbeing, we will treat it carefully and restrict access to appropriate staff. Please share only what you believe is necessary for us to support your enquiry.

6. Cookies

Cookies are small text files placed on your device. We use cookies to help the website work properly and, where enabled, to understand how the website is used.

A) Essential cookies

These may be required for basic site functions such as security and page navigation.

B) Preference/functional cookies

These remember choices you make (if enabled), such as language or region settings.

C) Analytics cookies (if used)

These help us understand how visitors use our site (for example, which pages are most visited). See Section 7.

D) Marketing/advertising cookies (if used)

These may be used to measure campaign effectiveness or support retargeting. If used, this should be implemented with appropriate consent settings.

Managing cookies

You can control and delete cookies through your browser settings. If the website provides a cookie banner/consent tool, you can use it to manage optional cookies.

7. Analytics

We may use analytics tools to understand website traffic and improve performance. If analytics are used, we will:

• Use them to improve the website and measure content effectiveness; and
• Where required, use consent controls for analytics cookies.
• Analytics provider(s): Google Analytics
• Opt-out method: cookie banner preferences / browser add-on / browser settings (as applicable)

8. Who we share your data with

We may share personal data only where necessary to operate the website, deliver services, or comply with legal obligations. This may include:

• Website hosting provider
• Website administrator/IT support (maintenance and security)
• Email service provider (to deliver enquiry responses and communications)
• Admissions/CRM tools used by the school (if any)
• Analytics provider (if any)
• Form providers or spam prevention tools (if any)
• Professional advisers (legal/IT) where needed
• Authorities or regulators where we are legally required to do so, or to protect children and the school community
• We require service providers to handle personal data securely and only for authorised purposes.

9. How long we retain your data

We keep personal data only as long as necessary for the purposes we collected it for, including legal, safeguarding, and operational requirements.

Typical retention periods

• Website enquiry / contact form submissions: up to 24 months
• Tour booking requests: up to 24 months
• Admissions-related communications prior to enrolment: up to 24 months (or longer if needed for safeguarding/operational reasons)
• Analytics data: up to 14 months (or per provider settings)
• Technical/security logs: typically 6–12 months
• If you become a family at the school: relevant records move into the school’s student/family record systems and are retained according to SISPP’s records retention policies

10. What rights you have over your data

Depending on your jurisdiction, you may have rights to:

• Request access to personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (where we are not required to keep it)
• Object to certain uses of your data
• Request restriction of processing
• Withdraw consent (where we rely on consent)
• Request a copy of your data in a portable format (in some cases)

To make a request, contact us using the details in Section 12. We may need to verify your identity before responding.

11. Where your data is sent

Website data may be processed by service providers in Cambodia or other countries (for example, where hosting, email, form, or analytics providers are located).

If data is transferred internationally, we take steps to ensure appropriate safeguards are in place, such as contractual protections and security controls.

12. Contact information (privacy requests)

For privacy questions or requests, please contact:

Email: info@shrewsbury.edu.kh

If your request relates to safeguarding or child protection, you may also contact the Designated Safeguarding Lead using the safeguarding contacts published on the school website.

13. Additional information

A) How we protect your data

We use reasonable organisational and technical measures to protect personal data, which may include:

• Access controls (only authorised staff)
• Password protection and role-based permissions
• Secure storage and secure transmission where available (for example, HTTPS)
• Regular updates and security monitoring
• Staff awareness and safeguarding culture around confidential information

B) What data breach procedures we have in place

If we become aware of a security incident involving personal data, we will take steps to contain it, assess risk, and notify affected individuals and relevant authorities where required.

C) What third parties we receive data from

We may receive data from:

• Families who contact us via email, phone, messaging apps, or referrals
• Analytics/advertising platforms (if enabled) in aggregated form (for example, campaign performance)

D) What automated decision-making and/or profiling we do

• We do not use automated decision-making that produces legal or similarly significant effects based solely on automated processing through the website.
• If advertising tools are used, they may support audience measurement or retargeting. This does not determine admissions outcomes.

E) Industry regulatory disclosure requirements

As a school, SISPP has safeguarding duties and record-handling responsibilities. Where necessary, we may process and share information to protect children and meet safeguarding obligations.

14. Changes to this Privacy Policy

We may update this policy from time to time. The “Last updated” date at the top shows when changes were made. We encourage you to review it periodically.