Last updated: 6 September 2026
This notice explains what personal data the KCA Lost and Found website collects, why, and what you can do about it.
King's College Alicante (KCA) is the data controller. That means KCA is responsible for deciding how and why personal data is processed through the Lost and Found website.
If you have any question about your personal data, ask any member of KCA staff at school. Speak to a teacher in person — your form tutor, a teacher you know, or the school office. They can pass it on to whoever needs to deal with it.
The website was built and is maintained by pupils (Jun Cui and Hailong Dai). They are the development team, not the data controller, and cannot decide requests about your data. Please ask a teacher rather than the pupils who built it.
When you use the Lost and Found website, we may collect:
Please do not include unnecessary personal or sensitive information in descriptions or photographs.
What other users can see. Your school email address is shown to other signed-in users when you post a found item and when you claim an item. The proof of ownership you write when claiming is not public — it is visible only to you and to staff. The collection location of an item is hidden until a claim is made. Nobody outside the school can see any of it: the whole site requires a KCA account to view.
Uploaded photographs and text may be checked using automated content moderation technology, and may also be reviewed manually where necessary.
Where applicable, we process personal data on the basis of legitimate interests under Article 6(1)(f) of the EU General Data Protection Regulation (GDPR), as applicable to KCA.
Those legitimate interests include providing a functioning Lost and Found service and protecting the safety, security and integrity of the school community.
Before relying on legitimate interests, the school will consider whether the processing is necessary for those interests, and whether the rights and freedoms of the individuals concerned override them. Where another legal basis is required for a particular type of processing, we will rely on the appropriate legal basis.
Photographs and text uploaded to the website may be checked using automated content moderation technology provided by a third party, including Google Gemini.
Where necessary, photographs or reports may also be reviewed manually by authorised members of KCA staff or authorised members of the development team.
Access to personal data is limited to people who need it for the operation, security, moderation or maintenance of the website.
Lost and Found posts are removed once the relevant item has been resolved.
Information about found items may be retained for a limited period where necessary to help prevent miscollection, fraudulent claiming, or disputes about ownership. Personal data will be deleted when it is no longer necessary for those purposes, subject to applicable retention requirements.
Where information is no longer required for the purposes described in this notice, it will be securely deleted or otherwise disposed of in accordance with the school's retention policies.
Data collected through the website is stored using Supabase, a cloud service.
Access to stored data is restricted to authorised persons who require it for legitimate purposes, including KCA staff and authorised members of the development team.
Appropriate technical and organisational security measures are used to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure.
The website uses third party service providers to operate parts of the service. These include:
Where third party providers process personal data on behalf of KCA, appropriate data processing and security arrangements will be in place.
Some service providers may process personal data outside the European Economic Area (EEA), including in countries such as the United States. Where personal data is transferred internationally, KCA will ensure that an appropriate legal mechanism and safeguards are used as required by applicable data protection legislation, including Standard Contractual Clauses (SCCs) together with applicable Data Processing Addenda (DPAs) where applicable.
Depending on the circumstances and the applicable data protection law, you may have the following rights:
The Your data page in this website lets you do three things straight away, without asking anyone:
For anything else — correcting information, deleting a post that has already been claimed, deleting your account entirely, restricting or objecting to processing — ask any member of KCA staff at school and they will pass it on. Requests are answered within one month, as required by the GDPR. If a request cannot be granted, you will be told why.
Where we process your personal data on the basis of legitimate interests under Article 6(1)(f), you have the right to object under Article 21 GDPR.
If you object, KCA will consider your request in accordance with applicable data protection legislation. We may continue processing where there are compelling legitimate grounds that override your interests, rights and freedoms, or where another lawful basis permits us to continue.
If you choose not to provide information necessary to operate the service, or object to processing that is necessary for it, we may be unable to provide some or all of the service to you.
KCA takes the security of your personal data seriously and will take appropriate measures to reduce the risk of data breaches. A personal data breach may include accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data.
If a personal data breach occurs, KCA will assess the incident and take appropriate steps in accordance with applicable data protection law. Where a breach is likely to result in a risk to individuals' rights and freedoms, the relevant supervisory authority will generally need to be notified without undue delay and, where feasible, within 72 hours of KCA becoming aware of it. Where a breach is likely to result in a high risk to affected individuals, those individuals may also need to be informed in accordance with applicable law.
Records of personal data breaches and the actions taken in response will be maintained where required.
KCA uses appropriate technical and organisational measures to protect personal data, including:
No online service can guarantee that data will always be secure. However, reasonable measures are taken to protect personal data from unauthorised access, loss, misuse or disclosure.
Personal data is only accessed by authorised people who need it for legitimate purposes. This may include:
Access is limited according to the person's role and requirements.
If you have concerns about how your personal information is being used, speak to a member of KCA staff at school first.
You also have the right to lodge a complaint with the data protection supervisory authority for Spain:
We may update this notice if the website, the information we collect, the services we use, or our data processing practices change. The latest version is always available here on the Lost and Found website.
See also the Terms of Service.