All Saints’ CE Primary School
Privacy Notice
Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ or ‘fair processing notices’ to individuals where we are processing their personal data. The school is committed to protecting pupils’ and families’ privacy and this is a legal requirement under the Data Protection Act and General Data Protection Regulation 2018. This privacy notice explains how we collect, store and use personal data about pupils and parents.
All Saints’ C of E Primary School, Ilkley is a Data Processor and a Data Controller for the purposes of the Data Protection Act and GDPR 2018. The Data Protection Act, 2018 and the Education Act, 1996, form the lawful basis for collecting and using pupil information for general purposes (and from
Article 6 and Article 9 where data processed is special category data from the General Data
Protection Regulation, 2018). The law requires that we keep data (personal information) confidential and secure. We must also inform families about what data we keep, why we keep it, and how we intend to keep it secure.
The GDPR requires school to appoint a Data Protection Officer (DPO). The DPO role is being fulfilled by Ben Cain of Staff Absence Management Ltd in association with Impero. The school will coordinate data protection practice through the School Business Manager.
We use pupil data to:
- Support pupil teaching and learning
- Monitor and report on pupil progress
- Provide appropriate pastoral care
- Assess the quality of our schools’ services
- Comply with the law regarding data sharing
- Aid our administration functions, e.g. communication via text/email, parents’ evening booking, and our online payment system
The categories of pupil information that we collect, hold and share include:
- Personal information (such as name, date of birth, unique pupil number and address)
- Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)
- Attendance information[1] (such as sessions attended, number of absences and reasons for)
- Assessment information (such as attainment, progress records)
- Relevant medical/dietary information
- Special Educational Needs information
- Safeguarding information (detail of disclosures, outcomes of meetings, various plans and sensitive information regarding court proceedings, child protection plans and correspondence with outside agencies)
- Exclusions & Behavioural information
- Biometrics including CCTV images and photographs
We use parent data to:
- Provide essential contact information
- Comply with the law regarding data sharing
- To aid our administration functions, e.g. communication via text/email, parents’ evening booking, and our online payment system
The categories of parent information that we collect, hold and share include:
- Personal information (name, address, telephone and mobile numbers and email address)
- CCTV images
Collecting pupil and parent information
Whilst the majority of information you provide to us is mandatory, some of it is shared as a legitimate business use and some is provided to us on a voluntary basis, with your consent. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice and we require consent. We will also make clear how your consent can be withdrawn. Further information on giving provision and withdrawal of consent is contained in our Request for Consent Form.
Storing pupil data
We keep personal information about pupils while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary in order to comply with our legal obligations. Legal retention schedules are followed for the retention of personal information in line with the Information Records Management Society http://irms.org.uk.
Who do we share information with?
- Schools that the pupils attend after leaving us
- Our local authority (LA), or the LA of the school your child moves to
- The Department for Education (DfE)
- Health authorities
- Ofsted
- Police forces, courts, tribunals
- Our IT support provider can view our computer systems where pupil data is stored as part of their service level agreement with us to maintain our IT systems
- We have a legitimate business interest to share pupil names with our 3rd party processors: online payment provider Arbor, CPOMS (Child Protection Online Monitoring System), Junior Librarian (Micro Librarian Systems), Discovery Education, Education City, Compare4Kids Ltd, Odizzy, Classroom Monitor, website host Primary Technology, Karen Ross School of Photography, Times Tables Rock Stars and Numbots (Maths Circle), PE Partner, RM Unify, Microsoft 365, FFT Aspire (FFT Educational Data) and educational visits software provider Evolve. This information is not passed onto anyone else.
- We have a legitimate business interest to share parent name, mobile telephone and email address with our online payment provider Arbor and online booking system parentseveningsystem provided by School Cloud Systems. This information is not passed onto anyone else.
The school receives confirmation from other parties who have access to pupil data that they comply with the GDPR.
Why we share pupil information
We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.
We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring. We are required to share information about our pupils with our LA and the DfE under section 3 of The Education (Information about Individual Pupils) (England) Regulations 2013.
Data collection requirements
To find out more about the DfE data collection requirements and the information we share please visit: https://www.gov.uk/education/data-collection-and-censuses-for-schools
The National Pupil Database (NPD)
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information about Individual Pupils) (England) Regulations 2013. To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupildatabase-user-guide-andsupporting-information
The DfE may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
- Conducting research or analysis
- Producing statistics
- Providing information, advice or guidance
The DfE has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether the DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
- Who is requesting the data
- The purpose for which it is required
- The level and sensitivity of data requested, and
- The arrangements in place to store and handle the data
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data. For more information about the DfE’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data
For information about which organisations the DfE has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/nationalpupil-database-requests-received
Requesting access to your personal data
Under data protection legislation, parents and pupils have the right to make a ‘Subject Access Request’ (SAR) to gain access to personal information that we hold about them. To make a SAR please contact the Data Protection Officer. Contact details can be found at the end of this document.
You also have the right to:
- Object to processing of personal data that is likely to cause, or is causing, damage or distress
- Prevent processing for the purpose of direct marketing
- Object to decisions being taken by automated means
- In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and Claim compensation for damages caused by a breach of the Data Protection regulations
Complaints
We take any complaints about our collection and use of personal information very seriously. If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this directly with the school in the first instance.
To make a complaint, please contact our Data Protection Officer.
Alternatively, you can make a complaint to the Information Commissioner’s Office (ICO) by:
Reporting a concern online at https://ico.org.uk/concerns/
Calling 0303 123 1113
Or writing to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Contact Information
If you would like to discuss anything in this privacy notice, please contact:
School Contact Details:
Data Protection Officer
All Saints’ C of E Primary School Easby Drive, Ilkley, LS29 9BE dpo@allsaintsilkley.bradford.sch.uk 01943 607852
School Data Protection Contact: School Business Manager
DPO Contact Details:
Ben Cain
Staff Absence Management Ltd
First Floor, Unit A, Cedar Court Office Park, Denby Dale Road, Wakefield, WF4 3FU dpo@staffabsencemanagement.co.uk
01924 907319
Local Authority Contact Details: City of Bradford MDC
Information Management Team
Margaret McMillian Tower, Bradford, BD1 1NN
IMTdatateam@bradford.gov.uk 01274 439652
Department for Education Contact Details:
Public Communications Unit
Department for Education
Sanctuary Buildings, Great Smith Street, London, SW1P 3BT
https://www.gov.uk/government/organisations/department-for-education http://www.education.gov.uk/help/contactus
0370 000 2288
If you are unable to access any of the websites in this document, please contact the school office.
[1] Attendance is not collected for pupils under 5 at Early Years Settings or Maintained Schools as part of Censuses for the
DfE. This footnote will be removed where Las collect attendance for under 5’s for their own specific purposes. PN1-DfE (2011-07)