LONDON GRAMMARS C H O O LPRIVACY & DATA PROTECTION
How London Grammar School handles information through this website and school services.
London Grammar School (LGS) is responsible for the school information it collects through this website and its school services. This notice covers website visitors, applicants, parents/guardians, students and authorised staff. Last updated: 12 November 2026.
Depending on the service you use, records may include your name, email, telephone number, enquiry, visit request, application details, pupil name, date of birth, learning stage, class, guardian relationship, attendance, academic reports, learning resources, notices, school fee and payment references, and authorised staff role. Restricted welfare information may be recorded by authorised safeguarding staff. Do not put medical, identity or financial documents in public website uploads or social messages.
We use information to answer enquiries, administer visits and admissions, deliver learning materials and schedules, manage verified student/family access, maintain education and attendance records, administer permitted school finance records, protect pupil welfare, investigate misuse and maintain an audit trail. Optional marketing activity is separate from access to education and requires the choices described below. We do not sell school records or use students’ private portal records for advertising audiences.
Student accounts are issued by the school and linked to a pupil and current class. A student sees published material for that class, school-wide resources and their own released reports and attendance. Staff access is based on role and, for teachers, class assignment. Owner/administrator previews are clearly labelled and logged. Parents or guardians should contact the school about a child’s information or permissions. Public photographs, video and testimonials must be approved by the school with appropriate permission; withdrawal requests can be made through the contact details below.
Some website learning images are AI-generated representations of educational activities. They do not identify enrolled pupils or document the school campus. Identifiable school photographs, videos and testimonials require appropriate school approval and media permissions.
Staff and student accounts use school-issued email/password access. Administrators can enable authenticator protection; its secret is encrypted, and recovery codes are stored as one-way hashes. Recovery codes are single-use, and password recovery preserves enabled authenticator protection. Passwords are stored as salted password hashes, not readable passwords. Session cookies are Secure, HttpOnly and SameSite=Strict and are limited to the website domain where you signed in. Sessions expire after eight hours or thirty minutes of inactivity. The application also records security/audit events and hashed rate-limit identifiers; hosting providers may process IP addresses, browser information and request logs for operation and security. Private learning files require an authorised account and resource/class access. Public media uploaded through Website Management is intentionally visible to visitors. No online system can guarantee complete security.
Staff and student portals use school-issued email/password accounts. Visiting the website or submitting an admissions request does not give the school access to your Google or Microsoft account. A separate external-account feature requires an explicit permission request explaining the provider, data and purpose. Identity-only sign-in should use only basic identity details such as account identifier, name and email. Mail, Drive/OneDrive, calendar or classroom access requires a separately described feature and the permissions shown by the provider. The school will not ask you to give it your Google or Microsoft password. School access rights remain subject to school approval even after provider consent.
Any authorised external-account data access is limited to the school feature and purpose described when permission is requested. Such data must not be sold, used for targeted advertising, disclosed for unrelated purposes or used to train general-purpose AI models. Access should be limited to authorised staff, necessary service providers, security investigations and disclosures required by law. You may revoke a connection in the provider account’s app-permission settings and ask the school to remove stored tokens and connected data, subject to records the school must retain. Revoking a provider connection does not automatically delete separately held school records.
This website uses OpenAI Sites hosting services and Cloudflare infrastructure for application delivery, database and file storage. The admissions request form and staff/student email-and-password logins do not require a ChatGPT account. Information is shared with authorised school personnel and service providers only as needed to operate the relevant feature, protect safety/security or comply with applicable requirements. Infrastructure providers may process data outside Bangladesh under their own service arrangements. Google, Microsoft, Meta and other external platforms also have their own privacy notices when you use their services.
The website chat records the name, optional contact details and messages you provide so authorised admissions staff can respond. An online indicator reflects adviser availability, not a guaranteed response time. This browser keeps a private conversation token in session storage; visitor access to a conversation expires after seven days. Messages are retained as school enquiry records under the retention principles in this notice. Do not share passwords, medical documents or confidential pupil records in chat.
Social links and the optional WhatsApp chat button open an external service only when selected; the service may then receive your IP address and information you send. Do not send sensitive pupil records through social messaging. If an approved Meta Pixel ID is enabled, the public website asks for marketing-cookie permission before loading Meta tracking. Refusing does not block school access. When accepted, Meta may receive a public-page view, browser/device or network information and its cookie identifiers. This implementation does not enable advanced matching or send student names, emails, reports or private portal page views to Meta. School forms and private account pages do not load the pixel. Marketing choices are saved in this browser for 180 days and can be changed using “Cookie preferences”. Withdrawing stops future tracking on this website and removes accessible Meta cookies; it cannot undo data already received by Meta. Browser settings and Meta account controls can also manage provider cookies.
When school service email is enabled, the configured email delivery provider processes the recipient address, message content and delivery identifiers for admissions receipts, staff alerts and private account recovery. Staff alerts use a reference and authorised inbox link rather than pupil documents. Delivery logs distinguish pending, failed and provider-accepted messages. Owner-created backups encrypt school records and account password hashes with an owner-chosen passphrase; copies of referenced media are held in restricted backup storage. Active sessions, activation links, provider credentials and website conversations are excluded from this backup tool. Backup retention and recovery access are controlled by school management.
Session access is time-limited as described above, but expiry does not itself erase database records. School records, uploaded files, audit events and security records remain until an authorised review/deletion process determines they are no longer needed for education, administration, safeguarding, legal requirements or disputes. Retention depends on the record category, its purpose and applicable school obligations. Contact the school for the retention period relevant to your request. Contact the school to request the applicable retention period, account closure or deletion. Where removal is appropriate, the school must review related database records, stored files and provider connections; provider backups and legal retention may delay complete erasure. Public media removed from the site may remain in external caches or copies outside school control.
Contact the school to request access, correction, restriction, account closure, a copy of information, deletion, withdrawal of media permission or a privacy complaint. Explain the account or pupil concerned without including passwords or unnecessary documents. The school will verify your identity and authority for a child, consider applicable obligations, and explain the action it can take or why a record must be retained. Contact the administrator immediately if you suspect an account or data incident. This privacy notice is separate from the school’s safeguarding procedures and is not an emergency-reporting service.
We will update this page when data practices change, including before a new account integration or tracking feature is introduced. Material changes should be brought to affected users’ attention. For privacy requests, telephone the school administration or write to the campus address below and mark the request “Privacy”.
House: 6/11, Block: F, Lalmatia Housing Estate, Satmasjid Road, Dhaka-1207
+880 1322-891462