Privacy notice for parents and pupils

(How we use student information)

What is personal data?

Personal data is any information relating to an identified, or identifiable, living individual. This may include the individual’s:

Name (including initials)
Identification number
Location data
Online identifier, such as a username

Why do we collect and use pupil information?

There are several reasons why we collect, hold, process and share pupils’ personal data. We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so. Under data protection laws, the lawful reasons for processing personal data include:

Consent.
For the performance of a contract.
To comply with a legal obligation.
To protect the vital interests of the pupil or another person.
For a task carried out in the public interest.
For a legitimate interest of the school or one of the organisations it shares data with (eg legal adviser) except where those rights are overridden by the interests or fundamental rights and freedoms of the data subject which require protection, particularly in the case of a child.

Sometimes the handling of pupils’ personal data falls within several of the above lawful grounds. We use pupil data:

to support pupil learning
to monitor and report on pupil progress
to provide appropriate pastoral care
to assess the quality of our services
to comply with the law regarding data sharing

The categories of pupil information that we collect, hold and share include (but are not limited to):

Personal information (such as name, unique student number and address)
Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)
Attendance information (such as sessions attended, number of absences and absence reasons)
Assessment information
Relevant medical information
Special educational needs information
Exclusions / behavioural information

Collecting pupil information

Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.

Storing pupil data

We will only retain the data we collect for as long as is necessary to satisfy the purpose for which it has been collected and/or our required retention period. Other than in exceptional circumstances, information on pupils will only be retained up to their 25th birthday.

Who do we share pupil information with?

The other parties we routinely share pupil information with can include, but is not limited to:

a pupil’s parent/carer.
external examination boards
institutions that a pupil attends after leaving us
relevant local authorities
the Department for Education (DfE)

Why we share pupil information

We share pupil’ data with the DFE on a statutory basis under the Education (Information About Individual Students) (England) Regulations 2013. This data sharing underpins school funding and educational attainment policy and monitoring.

Pupils’ data, where it is reasonable to do so, may also be shared with other professionals contracted by the school such as legal and professional advisers or insurers. In addition, a data security contract with a third-party IT services provider or as part of cloud-based storage may also process your personal data for the purpose of securely holding and protecting your data.

Data collection requirements

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to their website, for further information regarding the National Pupil Database (NPD) see the attached.

Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. You also have the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress
prevent processing for the purpose of direct marketing
object to decisions being taken by automated means
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
claim compensation for damages caused by a breach of the Data Protection regulations.

To make a request for your personal information, or be given access to your child’s educational record, or if you have a concern about the way we are collecting or using your personal data or you would like to discuss anything in this privacy notice, please contact:

Mike Robeson, Director of Finance and Resources via email. Mike is also contactable on our Contact us page.