PRIVACY NOTICE FOR PARENTS AND PUPILS

How we use parent and pupil information

Data protection legislation gives parents the right to be informed about what personal data is held on them, how that data is used, who it is shared with and how long it is retained. This privacy notice provides this information, in general terms, in relation to information held on parents and pupils, as well as the lawful basis under which it is collected and retained.

If after reading this notice you have any questions relating to the data we hold or how we use it, please contact our Data Protection Officer, whose contact details are listed at the end of this notice.

Georgeham Church of England Primary School is the Data Controller in charge of the data.

  1. Categories of information

The categories of information that we collect, hold and share include but are not limited to:

 Contact details and preference (such as name, address, telephone numbers, email address)

  • Characteristics (such as ethnicity, religion, first language, nationality, country of birth and free school meal eligibility)
  • Attendance information (such as sessions attended, number of absences and absence
    reasons)
  • Results of internal assessments and externally-set tests
  • Relevant medical information (such as NHS information, health checks, physical and mental
    health care, immunisation program and allergies)
  • Special educational needs information (such as EHCPs, applications for support, care or
    support plans)
  • Safeguarding information
  • Exclusion information
  • Behavioural information
  • Photographs (for internal safeguarding & security purposes, school newsletters, media and promotional purposes)
  • Prior school attended (if applicable) and next school

We may also hold data about pupils that we have received from other organisations, including other schools, local authorities and the Department for Education.

  1. Why we collect and use this information

 We use the pupil and parent data to:

  • Support pupil learning
  • Monitor and report on pupil progress
  • Provide appropriate pastoral and medical care
  • Safeguard pupils’ welfare
  • Administer admissions waiting lists
  • Inform you about events and other things happening in the school
  • Assess the quality of our services
  • Comply with legal obligations regarding the sharing of data

  1. The lawful basis on which we use this information

We only collect and use parents’ or pupils’ personal data when the law allows us to do so. In almost all cases, the lawful basis for our processing information is:

  • Processing is necessary to perform a task in the public interest or for our official functions and the task has a clear basis in law.

Less often, we may also process parents’ or pupils’ personal data in situations where:

  • We have obtained the data subject’s consent to use it in a certain way.
  • We need to protect someone’s vital interests.
  • Processing is necessary to comply with our legal obligations.

Where we have obtained consent to use personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

Some of the reasons listed above for collecting and using parents’ or pupils’ personal data may overlap and there may be several grounds which justify our use of particular personal data.

If we need to process any special category data under Article 9 of the GDPR which is of a more sensitive nature, we will only do so if we have a lawful basis to do so under Paragraph 2 of Article 9 of the General Data Protection Regulation.

  1. Collecting pupil information

Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.

  1. Storing data

We hold data relating to a pupil whilst the child remains at Georgeham Church of England Primary School. The file will follow the pupil when he / she leaves the School. However where there is a legal obligation to retain information beyond that period, it will be retained in line with our retention policy.

We have data protection policies and procedures in place, including strong organisational and technical measures, which are regularly reviewed.  Further information can be found on our website.

  1. Who we share pupil information with

We do not share information about parents or pupils with any third party without consent unless the law and our policies allow us to do so.

We are required to share information about our pupils with our local authority and the Department for Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013. Data shared with the DfE underpins school funding and educational attainment policy and monitoring. An example of the information we share with our local authority would be safeguarding concerns or exclusions.

Where there is a legal requirement to do so, or it is otherwise necessary (and it complies with data protection law), we may also share personal information with:

  • Educators and examining bodies
  • Ofsted
  • Suppliers and service providers – to enable them to provide the services contracted
  • Central government
  • Our auditors
  • Health authorities
  • Security organisations
  • Health and social welfare organisations
  • Professional advisers and consultants
  • Police forces, courts, tribunals
  • Professional bodies
  • The pupil’s family and representatives
  • The pupil’s previous and future schools

Should we need to transfer personal data to a country or territory outside the European Economic Area, we would do so in accordance with data protection law.

  1. Data collection requirements:

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

  1. The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.

The Department for Education may share information about our pupils from the NPD with third parties who promote children’s education or well-being in England. To be granted access to pupil data, such third parties must agree to strict terms and conditions to ensure that the confidentiality of the data is maintained.

For more information about the Department’s data sharing process, please visit:
https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the Department has provided pupil information please visit the following website:
https://www.gov.uk/government/publications/national-pupil-database-requests-received

To contact the DfE please visit: https://www.gov.uk/contact-dfe

  1. Requesting access to your personal data and your data protection rights

Under data protection legislation, parents have the right to request access to information held about them by making a Subject Access Request.

Parents can also make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 13) or where the child has provided consent.

Parents also have the right to make a subject access request with respect to any personal data the school holds about them.

If you make a Subject Access Request and we do hold information about you or your child, we will:

  • Give you a description of the information held
  • Tell you why we are processing it and for how long we will keep it
  • Explain where we got it from, if not from you or your child
  • Tell you who it has been, or will be, shared with
  • Let you know whether any automated decision-making is being applied to the data, and any consequences of this
  • Give you a copy of the information in an intelligible form

Parents and pupils also have the right to:

  • Object to processing of personal data if it is likely to cause, or is causing, damage or distress
  • Prevent processing of your personal for the purpose of direct marketing
  • Object to decisions being taken by automated means
  • In certain circumstances: have personal data erased or destroyed, restrict the processing of data and have inaccurate personal data rectified
  • Seek redress, either through the Information Commissioner’s Office, or through the courts

If you would like to make a Subject Access Request or exercise another of the above rights, please contact our Data Protection Officer whose contact details are listed at the end of this notice.

Individuals also have the right for their personal information to be transmitted electronically to another organisation in certain circumstances.

Parents also have a legal right to access to their child’s educational record. To request access to this, please contact admin@georgeham-primary.devon.sch.uk for the attention of the Headteacher.

  1. Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our Data Protection Officer (see Contact Us below).

Alternatively, you can make a complaint to the Information Commissioner’s Office:

  • Report a concern online at https://ico.org.uk/concerns/
  • Call 0303 123 1113
  • Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

  1. Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our Data Protection Officer (DPO):

Alvin Scott (DPO)
Copplestone Primary School
Bewsley Hill
Copplestone
Crediton
Devon
EX17 5NX

Email: dpo@devonmoorsfederation.devon.sch.uk
Tel: 07557 782389