Privacy Policy & Student Data Protection

1Scope & who we are

Bright Beginnings Academy — Oxford International School, located at Rua 17 de Julho, Bairro Emília Dausse, Chimoio, Manica, Mozambique, is the controller of personal information described in this policy. We have served families since 2015 across Early Years (ages 2–5), Primary (Grades 1–7) and Secondary (Grades 8–10), teaching in English with Portuguese-language support.

This policy covers information we handle when you enquire about admission, enrol a child, visit our campus, call or message us on WhatsApp +258 844 277 021, email admin@bbamoz.com, or browse this website. It does not cover independent third-party sites you may reach through links.

2Information we collect

We collect only what a school genuinely needs to teach, protect and administer its pupils. We never ask for more than the purpose requires, and we explain at the point of collection why each item is needed.

2.1 Student records

• Identity and enrolment details: full name, date of birth, gender, nationality, home language, previous school and grade.
• Academic records: assessments, reports, attendance, behaviour notes and learning-support plans.
• Health and welfare information: allergies, medical conditions, medication needs, emergency contacts, doctor details and vaccination records where required by school health rules.

2.2 Parent and guardian contacts

• Names, relationship to the child, phone numbers, email addresses and home address.
• Authorised pick-up persons and any court or custody arrangements affecting collection.
• Billing contact details needed for fee administration.

2.3 Admissions enquiries

• Details you share in enquiry forms, campus-visit bookings, phone calls, WhatsApp messages and emails — typically the child's age, desired grade, start date and your questions.
• Copies of documents you choose to submit, such as birth certificates, prior reports and transfer letters.

2.4 Website and cookie data

• Basic technical data: pages visited, device type, approximate location derived from IP address, and cookie preferences. See Section 6 for full detail.

3How we use personal information

Every use below is tied to a clear purpose and a lawful basis — in practice, providing education under our enrolment contract, protecting children, meeting legal duties, or acting on your consent. We do not use student data for unrelated marketing.

4Children & student safeguarding

Children's data receives our highest level of protection. We collect information about pupils only from a parent or legal guardian, except for classroom work the child produces as part of normal learning. Staff are trained to handle disclosures sensitively and to share information internally strictly on a need-to-know basis.

Parental consent is required before enrolment for the routine processing of a child's school records, medical-safety information and attendance data. Where a child is old enough to express a view — particularly in Secondary (Grades 8–10) — we explain in age-appropriate language what we hold and why, and we respect their dignity in every conversation.

• Photographs and videos of children are handled separately under Section 5 — never bundled silently into general enrolment consent.
• Sensitive health details are accessible only to designated staff (class teacher, school nurse/first-aider, leadership) and are never posted on public boards.
• Any safeguarding concern is documented factually, stored securely, and shared externally only with the relevant authorities or emergency services where the child's welfare requires it.

5Photos & media consent

We love celebrating learning, but no child is photographed for public use without clear written permission. At enrolment you receive a separate photo-and-media consent form with simple opt-in / opt-out choices for each channel: classroom displays inside the school, the school website and social pages, and printed materials such as brochures.

• Opting out has no effect on admission, grades or treatment — your child simply will not appear in public-facing images.
• Class photos sent privately to parents of that class are treated differently from public marketing images and are labelled as such.
• We never publish a child's full name together with a photograph without additional explicit consent.

6Cookies & website data

This demonstration website uses only a minimal set of cookies: a strictly necessary cookie that remembers whether you accepted or dismissed the cookie notice, and — if enabled — basic anonymised analytics that help us understand which pages parents find useful. We do not run advertising trackers or cross-site profiling on these pages.

• Strictly necessary: cookie-banner choice (12 months). The site works without it, but the banner will reappear.
• Functional: remembering "back to top" or display preferences during a visit (session only).
• Analytics (if enabled): aggregated, anonymised page views. No names, no student records, no advertising IDs.

You can block or delete cookies in your browser settings at any time; the site remains readable. Embedded content such as maps may set their own cookies when you interact with them — check the provider's notice before clicking. Our contact links (telephone, email, WhatsApp) simply open your own app; we receive only the message you choose to send.

7Sharing & third parties

We never sell personal information. We share it only where running the school genuinely requires it, and only the minimum necessary for that task. Every processor we use is instructed in writing to handle data solely on our directions and to protect it appropriately.

• Essential processors: email hosting, website hosting, and printing of reports or ID cards. They see only what the task requires.
• Education and assessment: Oxford curriculum-related bodies or examination services, where entries or certification require pupil details.
• Authorities and emergencies: education inspectors, health services or emergency responders where the law or a child's safety requires disclosure.
• With your permission: a new school receiving a transfer reference, or a service provider you have asked us to contact.

We do not share class contact lists between families without permission. If a parent association or event organiser requests contacts, we ask each family first or share only aggregated, non-identifying information.

8International transfers

As an Oxford-curriculum school, limited transfers outside Mozambique can occur — for example, registering a pupil for an Oxford assessment, corresponding with a curriculum support office, or using email and hosting infrastructure located abroad. Such transfers involve only the fields strictly required for that purpose.

Where a transfer occurs, we prioritise providers with appropriate safeguards, limit the data to the minimum, and document the transfer. Parents may ask at any time which categories of data are transferred for their child and for what exact purpose, and we will answer in plain language via the contacts in Section 12.

9Retention of records

We keep information only as long as its purpose — or the law — requires, then we securely delete or anonymise it. The table below summarises our standard periods; statutory or safeguarding duties may require a longer hold in individual cases, which we will explain if asked.

10Security

We protect personal information with practical, layered measures suited to a school office: locked storage for paper files, password-protected devices, role-based access so staff see only their own pupils' records, and regular reminders about phishing and safe handling of parent contacts.

No system is perfectly secure, so we plan for incidents. If a breach is likely to affect your rights — for example, loss of a device holding unencrypted parent contacts — we will inform the affected families promptly, explain what happened in plain language, describe what we are doing about it, and advise practical steps. We also record and review every incident to prevent recurrence.

• Parents can help: keep your contact details current, use strong passwords on shared portals, and report suspicious messages claiming to be from the school.
• Staff devices used for school communication are subject to access controls; personal devices are never the system of record for pupil data.

11Your rights

Parents and guardians — and pupils where age-appropriate — may exercise the following rights over their personal information. We respond in plain language, normally within 30 days, and we never charge for a reasonable request.

• Access: ask what information we hold about you or your child and receive a copy.
• Rectification: ask us to correct inaccurate details, such as a misspelled name, wrong class or outdated phone number.
• Erasure: ask us to delete information that is no longer needed — subject to records we must keep by law (for example, fee books or safeguarding files).
• Objection and restriction: object to specific uses such as optional newsletters or public photos, or ask us to pause processing while a concern is reviewed.
• Withdraw consent: withdraw photo, WhatsApp-marketing or other consent at any time; withdrawal applies going forward.

12Contact & updates

Questions about this policy, a privacy concern, or a complaint should come to us first — we aim to resolve matters quickly and amicably. If we change this policy, we will post the updated version here with a new "Last updated" date and, for material changes affecting enrolled families, announce it through our normal school channels.