Under the General Data Protection Regulation (GDPR) individuals have a right to be informed about how we use any personal data that we hold about them. As an academy within The Elliot Foundation Academy Trust we comply with this right by providing a Privacy Notice to individuals where we are processing their personal data.
For the purposes of data protection law The Elliot Foundation Academy Trust is the ‘data controller’. The Data Protection Officer for the trust, who oversees how we collect, use, share and protect your information, is Jem Shuttleworth (firstname.lastname@example.org).
For the purposes of data protection law we, Claremont Primary School are the ‘data processor’.
Our Local Compliance Officer, who works with staff in the school to process and protect your data, is Fiona Rafter.
This Privacy Notice explains how we collect, store and use personal data about pupils.
Categories of pupil information that we process include, but are not restricted to:
- Personal identifiers, contacts and characteristics (such as names, unique pupil number, contact details and address)
- Characteristics (such as ethnicity, language and free school meal / pupil premium eligibility)
- Safeguarding and child protection information (such as court orders and professional involvement)
- Special educational needs (such as professional involvement, care packages, plans and support providers)
- Medical and administration (such as doctors information, child physical and mental health, dental health, allergies, medication and dietary requirements)
- Attendance (such as sessions attended, number of absences, absence reasons and any previous schools or settings attended)
- Assessment and attainment (such as results of internal and externally set tests and teacher judgements)
- Behavioural information (such as reports, exclusions and any support put in place)
GDPR specifically defines ‘special category’ as data relating, but not restricted, to:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
Within our school we also process some sensitive information about our pupils that is not identified as ‘special category’. However we consider it appropriate to treat such information with the same care.
We may also hold data about pupils that we have received from other organisations, including other schools, local authorities and the Department for Education.
Online systems that we use to process pupil information:
We use a variety of online systems to support the day-to-day running of the academy, pupil assessment and behaviour strategies. Access for staff to these systems is determined by their role and whether they have a recognised need to access the information.
The systems listed below all hold and process personal pupil information.
- ScholarPack - used for the day-to-day running of the academy and primarily holds pupil information
- Google Drive - a cloud based service that allows users to store and share files
CCTV system that we use:
We operate a CCTV system. This system is in operation 24 hours per day and runs on a 21 day loop. CCTV is in place to support security of the academy site. The system operated by the academy has no recording facility and the images taken are overwritten after 21 days. The system is monitored by, if you require any further information regarding the CCTV system in operation, please contact the school office by email email@example.com.
Why we collect and use personal data:
We only collect and use pupils’ personal data when the law allows us to.
We obtain pupil information via registration forms/medication forms/Common Transfer Files from previous schools/Child Protection Plans. We do this at the start of each academic year and as is required throughout the academic year.
While the majority of information we collect about pupils is mandatory, there is some information that can be provided voluntarily. Whenever we seek to collect information from you we make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.
Most commonly, we collect and process this pupil information where we need to perform an official task in the public interest and/or we need to comply with a legal obligation.
- To protect and keep safe all pupils
- To provide appropriate pastoral care
- To support pupil learning
- To monitor and report on pupil attainment and progress
- To met the statutory duties placed upon us
- To assess the quality of our services
Less commonly, we may also process pupils’ personal data in situations where we have obtained consent to use it in a certain way and/or we need to protect the individual’s vital interests (or someone else’s interests).
Some of the reasons listed above overlap and there may be several grounds which justify our use of this data.
Where we have obtained consent to use pupils’ personal data this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.
Consent for sharing of images/videos and names of pupils on social media is sought from parents in advance. Consent for sharing these images may be withdrawn at any time. Parents are invited to follow the academy twitter and facebook accounts but do this through their own choice. These social media accounts are not for marketing purposes, and are solely to communicate upcoming events, news and celebrations. Parents can withdraw from the academy twitter and facebook feeds at any time by clicking ‘unfollow’.
We keep personal information about pupils securely for the duration of time they are on-roll. The pupil files are then transferred to the pupil’s next education setting (either to the next primary school or the pupil’s secondary school).
However, specific pupil information is retained if the pupil has been involved with a Child Protection concern, has identified Special Educational Needs or has been involved in a reported accident. In these cases, personal pupil information is held securely for 25 years from the birth date of the pupil.
The Elliot Foundation Academy Trust Records Management and Retention Policy can be found on the trust website and sets out further information about how long we keep information about pupils.
Who we share this data with:
We do not share information about pupils with any third party without consent unless the law and our policies allow us to do so.
Where it is legally required or necessary (and it complies with data protection law) we may share personal information about pupils with:
The National Pupil Database
We are required to provide information about pupils to the Department for Education as part of statutory data collections such as the school census.
Some of this information is then stored in the National Pupil Database (NPD) which is owned and managed by the Department and provides evidence on school performance to inform research.
The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.
The Department may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.
For more information please contact the Department - https://www.gov.uk/contact-dfe
Requesting access to your child’s personal information:
Individuals have a right to make a ‘subject access request’ (SAR) to gain access to personal information that the school holds about them.
Parents/carers can make a request with respect to your child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12).
If you make a SAR, and if we do hold information about your child, we will:
- Give you a description of it
- Tell you why we are holding and processing it, and how long we will keep it for
- Explain where we got it from, if not from you or your child
- Tell you who it has been, or will be, shared with
- Let you know whether any automated decision-making (by a computer or machine, rather than by a person) is being applied to the data, and any consequences of this
- Give you a copy of the information in an intelligible form
To make a request for your child’s personal information, or be given access to your child’s educational record, please contact Fiona Rafter (Local Compliance Officer).
We will not charge for carrying out a SAR unless the request is ‘excessive’ or a copy of information that has already been given. SARs may take up to one month to action.
Under GDPR individuals have certain rights regarding how their personal data is used and kept safe, including the right to:
As a school, and as part of The Elliot Foundation Academies Trust, we take any complaints about our collection and use of personal information very seriously.
If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with the Local Compliance Officer in the first instance.
To make a formal complaint please contact the Data Protection Officer for the trust.
If you have any questions, concerns or would like more information about anything mentioned in this Privacy Notice, please contact the Local Compliance Officer on 020 8455 4013 or by email firstname.lastname@example.org.