Data Protection
Pupil & Parent Privacy Notice
This notice is intended to provide information about how the academy will use, or ‘process’, personal data about individuals including: its current, past and prospective pupils and their parents, carers, guardians or wider family members (for instance siblings or other extended family members who may be named as emergency contacts) – referred to in this notice as ‘parents’.
Personal information is information that identifies you as an individual and relates to you. This makes the academy a data controller of your personal information, and this Privacy Notice sets out how we will use that information and what your rights are. Parents are encouraged to read this Privacy Notice and understand the academy’s obligations.
This Privacy Notice applies alongside any other information the academy may provide about a particular use of personal data, for example when collecting data via an online form, or images captured on closed circuit television (CCTV).
This Privacy Notice applies in addition to the academy’s other relevant policies, including REAch2’s policy on information and records retention, safeguarding, pastoral, or health and safety policies and IT policies.
Anyone who works for, or acts on behalf of, the academy, including staff, volunteers, governors and service providers, should also be aware of and comply with this Privacy Notice and the academy’s data protection policy for staff, which provides further information about how personal data on those individuals will be used.
Responsibility for Data Protection
Peter Noskiw has been appointed as Interim Data Protection Officer for REAch2 Multi Academy Trust. He can be contacted at [email protected]. Requests and enquiries concerning the academy’s uses of your personal data (see section on Your Rights below) should be directed to the academy in the first instance.
How the school collects your information
Generally, an academy receives personal data from the individual directly (including, in the case of pupils, from their parents). This may be via a form, through our website or simply in the ordinary course of interaction or communication, such as email.
In some cases, personal data will be supplied by third parties (for example another school, or other professionals or authorities working with that individual); or collected from publicly available resources.
The types of information we collect
We may collect the following types of personal data about you (and your family members and ‘next of kin’, where relevant):
· names, addresses, telephone numbers, e-mail addresses and other contact details;
· gender, nationality and date of birth;
· past, present and prospective pupils’ academic, disciplinary, admissions and attendance records (including information about any special needs), and examination scripts and marks;
· where appropriate, information about individuals’ health and welfare, and contact details for their next of kin;
· references given or received by the academy about pupils, and relevant information provided by previous educational establishments and/or other professionals or organisations working with pupils;
· correspondence with and concerning pupils and parents past and present;
· images of pupils (and occasionally other individuals) engaging in school activities, and images captured by the academy’s CCTV system; and
· a pupil’s interests and extra-curricular activities (e.g. out of school sports activities).
Where it is necessary for pupil welfare, safeguarding or other statutory or regulatory requirements, we may also collect special categories of data, including:
· information revealing racial or ethnic origin;
· information concerning health and medical conditions (for example, where requested to administer medication, meet dietary needs, to make reasonable adjustments to working conditions or environment or as part of an Educational Health and Care Plan);
· information about certain criminal convictions, for example, where a parent volunteer requires a check with the Disclosure and Barring Service (DBS). However, this will only be undertaken where and to the extent it is necessary for a lawful purpose in connection with attending an academy or volunteering at an academy.
Why it is necessary for the school to collect Personal Data
In order to carry out its ordinary duties to pupils and parents, the academy needs to process a wide range of personal data about individuals, including current, past and prospective pupils or parents, as part of its daily operation.
Our legal bases for using your information
This section contains information about the legal bases that we are relying on when handling your information.
The information below contains a general description of the different legal bases.
Legal obligation (“LO”)
Where the academy needs to use your information in order to comply with a legal obligation, for example to report a concern to Children’s Services. We may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so.
Necessary for contract (“CT”)
We will need to use your information in order to perform our obligations under any contract we have with you, for example, if you buy tickets for an event.
Vital interests (“VI”)
In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt).
Performance of a task carried out in the public interest (“PI”)
The following are examples of when we use your information to perform tasks in the public interest:
providing your child with an education;
· safeguarding and promoting your welfare, your child’s welfare and the welfare of other children;
· facilitating the efficient operation of the academy; and
· ensuring that we comply with all of our legal obligations. Legitimate interests (“LI”)
This means that the academy is using your information when this is necessary for the academy’s legitimate interests except when your interests and fundamental rights override our legitimate interests.
We have a legitimate interest in using your information to:
i. promote the academy including fundraising and publicity;
ii. preserve historical school records.
We set out below examples of the different ways in which we use personal information and the legal basis for doing so:
· For the purposes of pupil assessment and to confirm the identity of prospective pupils and their parents LO, PI;
· To provide education services, including meeting special educational needs (SEN), providing musical education, physical training or spiritual development, career services, and extra-curricular activities to pupils, and monitoring pupils’ progress and educational needs LO, PI;
· Maintaining relationships with alumni and the community, including direct marketing or fundraising activity LI.
To confirm the identity of prospective donors and their background and relevant interests LO, PI;
For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as diversity analysis) LO, PI;
To enable relevant authorities to monitor the school’s performance and to intervene or assist with incidents as appropriate LO, PI;
To give and receive information and references about past, current and prospective pupils LO, PI,
To enable pupils to take part in national or other assessments LO, PI, and
To publish test results or other achievements of pupils at the academy LO, PI;
To safeguard pupils’ welfare and provide appropriate pastoral care LO, PI;
To monitor, as appropriate, use of the school’s IT and communications systems in accordance with the academy’s IT acceptable use policy LO, PI;
· To make use of photographic images of pupils in academy, and REAch2 publications, on the academy and REAch2’s website and on the academy and REAch2’s social media channels LO, PI;
For security purposes, including CCTV in accordance with the REAch2 CCTV policy CT, LO, PI;
· To carry out or cooperate with any external complaints, disciplinary or investigation process LO, PI; and
· Where otherwise reasonably necessary for the academy purposes, including to obtain appropriate professional advice and insurance for the academy LO, PI.
In addition, the academy will, on occasion, need to process special category personal data (concerning health, ethnicity or religion) or criminal records information (such as when carrying out DBS checks) in accordance with rights or duties imposed on it by law, including as regards safeguarding and employment, or from time to time by explicit consent where required. These reasons will include: · To safeguard pupils’ welfare and provide appropriate pastoral and medical care;
· To take appropriate action in the event of an emergency, incident or accident, including the disclosure of an individual’s medical condition or other relevant information where it is in the individual’s interests to do so: for example, for medical advice, for social protection, safeguarding, and cooperation with police or social services, for insurance purposes or to caterers or organisers of academy trips who need to be made aware of dietary or medical needs;
· To provide educational services in the context of any special educational needs of a pupil;
· As part of any academy or external complaints, disciplinary or investigation process that involves such data, for example if there are SEN, health or safeguarding elements; or
· For legal and regulatory purposes (for example child protection, diversity monitoring and health and safety) and to comply with its legal obligations and duties of care.
Sharing information with others
Occasionally, the academy will need to share personal information relating with third parties, such as:
· professional advisers, e.g. lawyers, insurers, auditors;
· government authorities, e.g. HMRC, Department for Education, police or the local authority;
· the Health and Safety Executive if there is a health and safety issue at the academy, and
· appropriate regulatory bodies, e.g. the Charity Commission or the Information Commissioner.
For the most part, personal data collected by the academy will remain within the academy, and will be processed by appropriate individuals only in accordance with access protocols on a ‘need to know’ basis. Particularly strict rules of access apply in the context of medical records and pastoral or safeguarding files.
However, a certain amount of any SEN pupil’s relevant information will need to be provided to staff more widely in the context of providing the necessary care and education that the pupil requires.
Staff, pupils and parents are reminded that the academy is under duties imposed by law and statutory guidance (including Keeping Children Safe in Education) to record or report incidents and concerns that arise or are reported to it, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness in their nature or regularity. This is likely to include file notes and, in some cases, referrals to relevant authorities such as the Local Authority Designated Officer (LADO) or the police. For further information about this, please view the academy’s Safeguarding Policy.
In accordance with Data Protection Law, some of the academy’s processing activity is carried out on its behalf by third parties, such as IT systems, web developers or cloud storage providers. This is always subject to contractual assurances that personal data will be kept securely.
Criminal offence information
We may only use information relating to criminal convictions and offences where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations. Less commonly, we may use information relating to criminal convictions and offences where it is necessary in relation to legal claims, where it is necessary to protect a pupil and you are not capable of giving your consent, or when you have already made the information public.
Multiple legal grounds
As you will see from this Notice, in some cases we will rely on more than one basis above for a particular use of your information. In addition, we may move from one of the legal bases listed above to another as circumstances change. For example, as a safeguarding matter becomes more serious, we may rely on a legal obligation to share personal information with the local authority in addition to the other legal bases which are noted for safeguarding purposes.
How long we keep personal data
The academy will retain personal data for as long as necessary in order to educate and look after your child. The academy will keep some information after a child has left, for example to refer back to a complaint. If you have any specific queries about how our Information and Records Retention policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact the academy.
Keeping in touch and supporting the academy
The academy may retain contact details of parents and past pupils to keep them updated about the activities of the academy, or to promote events of interest, or to promote and raise funds for the academy. You have the right to withdraw consent, where given, or otherwise object to direct marketing or fundraising.
Your rights
Rights of access, rectification, portability and deletion
Individuals have various rights under Data Protection Law to access personal data about them held by the academy, and in some cases to ask for it to be erased or amended or have it transferred to others, or for the academy to stop processing it – subject to certain exemptions and limitations.
· Rectification: if information is incorrect you can ask us to correct it.
· Access: you can ask what information we hold about you and be provided with a copy. This is commonly known as making a subject access request. We will also give you extra information, such as why we use this information about you, where it came from and who we have sent it to.
· Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.
· Portability: you can request the transfer of your information to you or to a third party in a format that can be read by computer. This applies where (a) the information has been provided by you; (b) the basis that we are relying on to process your information is consent (please see ‘Our legal bases for using your information’ above); and (c) the information is being processed by us on computer.
· Restriction: our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.
· Object: you may object to us using your information where:
a. we are using it for direct marketing purposes;
b. the legal basis on which we are relying is either legitimate interests or performance of a task carried out in the public interest. Please see the section ‘Our legal bases for using your information’ above; and
c. we are using it for historical or scientific research purposes or archiving purposes.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
Requests that cannot be fulfilled
You should be aware that the right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information which identifies other individuals or information which is subject to legal privilege.
The academy is also not required to disclose any pupil test scripts or provide test marks ahead of any ordinary publication, nor share any confidential reference given by the academy itself for the purposes of the education, training or employment of any individual.
However, we may have a compelling reason to refuse a request to amend, delete or stop processing your, or your child’s, personal data: for example, a legal requirement, or where it falls within a legitimate interest identified in this Privacy Notice. All such requests will be considered on their own merits.
Consent
Where the academy is relying on consent as a means to process personal data, any person may withdraw this consent at any time (Any use of your information before you withdraw your consent remains valid). We may ask for your consent to use your information as an alternative to relying on any of the bases above.
You can find out more about your rights under applicable data protection legislation from the Information Commissioner’s Office website available at www.ico.org.uk.
Data accuracy and security
The academy will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals should notify the academy of any significant changes to important information, such as contact details, held about them.
An individual has the right to request that any out-of-date, irrelevant or inaccurate or information about them is erased or corrected. The academy will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to systems. All staff and governors will be made aware of this policy and their duties under Data Protection Law and receive relevant training.
This notice
The academy will update this Privacy Notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.
Contact and complaints
Any comments or queries on this policy should be directed to the academy in the first instance, or to the Trust’s Data Protection Officer, Peter Noskiw at [email protected].
If an individual believes that the academy has not complied with this policy or acted otherwise than in accordance with Data Protection Law, they should use the academy’s complaints procedure. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), www.ico.org.uk – although the ICO recommends that steps are taken to resolve the matter with the academy before involving the regulator.
