Culmstock Primary School

 

1 Privacy Notice October 2020

CULMSTOCK PRIMARY SCHOOL

PRIVACY NOTICE FOR PARENTS AND PUPILS

1. How we use parent and pupil information

Data protection legislation gives parents and pupils the right to be informed about what personal data is held on them, how that data is used, who it is shared with and how long it is retained. This privacy notice provides this information, in general terms, in relation to information held on parents and pupils, as well as the lawful basis under which it is collected and retained.

If after reading this notice you have any questions relating to the data we hold or how we use it, please contact our Data Protection Officer, whose contact details are listed at the end of this notice.

Culmstock Primary School is the Data Controller in charge of the data.

2. Categories of information

The categories of information that we collect, hold and share include but are not limited to:

 contact details and personal identifiers (such as name, address, telephone numbers, email address)

 characteristics (such as ethnicity, religion, first language, nationality, country of birth and free school meal eligibility)

 attendance information (such as sessions attended, number of absences, absence reasons, prior school attended and next school)

 assessment and attainment (such as key stage 1 and phonics results)

 medical information (such as doctors’ information, health checks, allergies, medication and dietary requirements)

 special educational needs information (including EHCPs)

 safeguarding information (such as court orders and professional involvement)

 exclusion information

 behavioural information (such as exclusions & any relevant alternative provision put in place)

 correspondence and records of contact

 photographs (for internal safeguarding & security purposes, school newsletters, media and promotional purposes)

We may also hold data about parents and pupils that we have received from other organisations, including other schools, local authorities and the Department for Education.

3. Why we collect and use this information

It is essential for the school to collect personal data in order for the school to fulfil their official functions and meet legal requirements.

We collect and use parent and pupil information in order to:

a) support pupil learning

b) monitor and report on pupil attainment progress

c) provide appropriate pastoral care

d) assess the quality of our services

e) keep children safe (food allergies, medical conditions or emergency contact details)

f) to meet statutory duties placed upon us, e.g. by the Department for Education

2 Privacy Notice October 2020

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing parent and pupil information are:

 for the purposes of (a), (b), (c) & (d) above; in accordance with the legal basis of public task. Collecting this data is necessary to perform tasks that the school are required to perform as part of their statutory function

 for the purposes of (e) above; in accordance with the legal basis of vital interests. Processing this data is necessary in order to protect someone’s life

 for the purposes of (f) above; in accordance with the legal basis of legal obligation. Data collected for the DfE census information is covered by:

o section 537A of the Education Act 1996

o the Education Act 1996 s29(3)

o the Education (School Performance Information)(England) Regulations 2007

o regulations 5 and 8 School Information (England) Regulations 2008

o the Education (Pupil Registration) (England) (Amendment) Regulations 2013

We may also process personal data where we have obtained the parent’s or pupil’s consent to use the data in a certain manner. Where we have obtained consent to use personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

Occasionally, where the processing is not part of our performing tasks as a public authority, we may process data under the lawful basis that it is in our legitimate interests or the legitimate interests of a third party to do so. In these circumstances we would be using the data in a way that would be reasonably expected by the parent or pupil concerned and the processing will have a minimal privacy impact or there will be a compelling justification for the processing.

If we need to process any special category data under Article 9 of the GDPR which is of a more sensitive nature, we will only do so if we have a lawful basis to do so under Paragraph 2 of Article 9 of the General Data Protection Regulation.

Some of the reasons listed above for collecting and using parents’ or pupils’ personal data may overlap and it may be that more than one lawful basis applies to our processing of the data.

No decisions are made by the school through automated decision making (including profiling).

4. Collecting parent and pupil information

Whilst the majority of personal information provided to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with data protection legislation, we will inform you at the point of collection whether you are required to provide certain information to us or if you have a choice in this.

We collect the majority of parent and pupil information via enrolment forms or a Common Transfer File (CTF) or other secure file transfer from a pupil’s previous school. As well as holding personal data that has been provided by the parent or pupil, we may also hold data provided by other sources, such as:

 local authorities

 government departments or agencies

 police forces, courts and tribunals.

3 Privacy Notice October 2020

5. Storing data

We hold personal data relating to a parent or pupil throughout the duration of a pupil’s attendance at Culmstock Primary School. The pupil file will follow the pupil when that pupil leaves the school. However it will be necessary to retain some data and this will be kept in line with our retention policy which can be viewed upon request by contacting the school. When personal data is no longer needed, we will dispose of it in a secure manner.

In order to protect data whilst it is in our possession we have data protection policies and procedures in place. These include strong organisational and technical measures and these are reviewed regularly. For further information on how data is protected please contact the school’s Data Protection Officer whose contact details can be found at the end of this privacy notice.

6. Who we share parent and pupil information with

We do not share information about parents or pupils with any third party without consent unless the law and our policies allow us to do so.

The Department for Education (DfE) collects personal data from educational settings and local authorities via various statutory data collections. We are required to share information about our pupils with the DfE either directly or via our local authority for the purpose of those data collections, under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013. Data shared with the DfE underpins school funding and educational attainment policy and monitoring. An example of the information we share with our local authority would be safeguarding concerns or exclusions. We may also be required to share information about our pupils with the local authority to ensure that they can conduct their statutory duties under the Schools Admission Code, including conducting Fair Access Panels. All data is transferred securely and held by the DfE under a combination of software and hardware controls, which meet the current government security policy framework. For more information, please see section 10 ‘How Government uses your data’.

Where there is a legal requirement to do so, or it is otherwise necessary and it complies with data protection law, we may also share personal information with:

 educators and examining bodies

 Ofsted

 suppliers and service providers – to enable them to provide the services contracted

 central government departments or agencies

 local authorities

 our auditors

 health authorities

 security organisations

 health and social welfare organisations

 professional advisers and consultants

 police forces, courts, tribunals

 professional bodies

 the pupil’s previous and future schools

4 Privacy Notice October 2020

Culmstock Primary School contracts with a number of carefully vetted suppliers and service providers with whom personal data is also shared. Such data is only shared once appropriate assurances have been obtained regarding the way in which the shared data will be processed and protected. The school shares data with the following suppliers and service providers:

 Babcock LDP (Specialist support services in partnership with Devon County Council)

 Capita SIMS (Primary data processor for administration – parent & pupil records)

 Cool Milk (School milk supplier – registered parent and pupil names)

 CPOMS (Safeguarding monitoring software)

 Education Shed Ltd (EdShed) (Maths and English support materials - pupil names & classes)

 EduFOCUS (Evolve – Risk assessment program)

 Eduspot (Teachers2Parents – contact information of those with parental responsibility)

 Egress (Secure email and file sharing service)

 Google (Pupil accounts to access learning/teaching tools – pupil name & registration group)

 Hodder Education (Rising Stars - pupil name and registration group)

 Maths Circle Ltd (Times Tables Rock Stars – pupil names and classes)

 Microsoft Office 365 (Cloud service – curriculum and assessment information)

 Nessy (Reading support – pupil names, classes, logins and d.o.b.)

 New Era Technology (DB Primary: website provider – pupil names, year groups and classes)

 Optima (Oshens - Health & safety management system)

 Oxford University Press (MyMaths – pupil names and classes)

 ParentPay (School meals & payment system- registered parent and pupil names)

 Pearson Education (Active Learn Primary online reading books for Reception, Y1 and older SEND children – pupil names and cohort date)

 SpeechLink (Speech, language and communication needs (SLCN) – pupil names, d.o.b. & assessment information)

 Tempest Photography (School photographs)

For further information please click on the links above to read each company’s own privacy notice.

Should we need to transfer personal data to a country or territory outside the European Economic Area, we would do so in accordance with data protection law.

7. Additional information for children in need and looked-after children

In addition to the details set out in this privacy notice, this section explains how we use supplementary information relating to children in need and looked-after children.

The categories of children in need and looked-after children information that we collect, hold and share include: 5 Privacy Notice October 2020

　

 episodes of being a child in need (such as referral information, assessment information, Section 47 information, Initial Child Protection information and Child Protection Plan information)

 episodes of being looked after (such as important dates and information on placements)

 outcomes for looked after children (such as whether health and dental assessments are up to date, strengths and difficulties questionnaire scores and offending)

 adoptions (such as dates of key court orders and decisions)

 care leavers (such as their activity and what type of accommodation they have)

We use this additional personal data to:

a) support these children and monitor their progress

b) provide them with pastoral care

c) assess the quality of our services

d) evaluate and improve our policies on children’s social care

Under the General Data Protection Regulation (GDPR) the lawful basis we rely on for all of these purposes when processing this additional information is that it is processed in accordance with the legal basis of public task. Collecting this data is necessary to perform tasks that the school are required to perform as part of their statutory function.

We share children in need and looked-after children information with:

 the Department for Education (DfE)

 our local authority

 the National Health Service (NHS)

 other appropriate support services as necessary to meet a pupil’s individual needs.

We do not share information about our children in need or looked-after children with anyone without consent unless the law and our policies allow us to do so. We share children in need and looked-after children’s data with the Department for Education on a statutory basis; under Section 83 of the 1989 Children’s Act, Section 7 of the Young People’s Act 2008 and also under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013. The data that we lawfully share with the DfE through data collections helps to develop national policies, manage local authority performance, administer and allocate funding and identify and encourage good practice. To find out more about the data collection requirements placed on us by the DfE go to:

Looked-after children: https://www.gov.uk/guidance/children-looked-after-return

Children in need: https://www.gov.uk/guidance/children-in-need-census.

8. Requesting access to your personal data and your data protection rights

Under data protection legislation, parents have the right to request access to information held about them by making a Subject Access Request.

Parents can also make a Subject Access Request with respect to their child’s data where the child is not considered mature enough to exercise their rights over their own data (widely considered to be under the age of 12) or where the child has provided consent.

If you make a Subject Access Request and we do hold information about you or your child, we will:

 give you a description of the information held

 tell you why we are processing it and for how long we will keep it

 explain where we got it from, if not from you or your child

6 Privacy Notice October 2020

　

 tell you who it has been, or will be, shared with

 let you know whether any automated decision-making is being applied to the data, and any consequences of this

 give you a copy of the information in an intelligible form

Depending on the lawful basis under which personal data is held, parents and pupils also have the right to:

 object to processing of personal data if it is likely to cause, or is causing, damage or distress

 prevent processing of your personal data for the purpose of direct marketing

 object to decisions being taken by automated means

 in certain circumstances: have personal data erased or destroyed, restrict the processing of data and have inaccurate personal data rectified

 seek redress, either through the Information Commissioner’s Office, or through the courts

In certain circumstances individuals also have the right for their personal information to be transmitted electronically to another organisation.

If you would like to make a Subject Access Request or exercise another of the above rights, please contact the school or our Data Protection Officer whose contact details are listed at the end of this notice.

9. Withdrawal of consent and the right to lodge a complaint

Where we have obtained consent to use personal data, this consent can be withdrawn at any time by contacting the school:

Culmstock Primary School

Culmstock

Cullompton

Devon

EX15 3JP

Email: admin@culmstock-primary.devon.sch.uk

Telephone: 01884 840598.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with the school in the first instance. Please contact our Data Protection Officer (see Contact Us below) to express your concerns.

Alternatively, you can contact the Information Commissioner’s Office:

 report a concern online at https://ico.org.uk/concerns/

 call 0303 123 1113

 or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Last updated

We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated on 6th October 2020. 7 Privacy Notice October 2020

11. Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our Data Protection Officer (DPO):

Alvin Scott (DPO)

Copplestone Primary School

Bewsley Hill

Copplestone

Crediton

Devon

EX17 5NX

Email: dpo@devonmoorsfederation.devon.sch.uk

12. How the Government uses your data

The pupil data that we lawfully share with the DfE through data collections:

 underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school.

 informs ‘short term’ education policy monitoring and school accountability and intervention (for example, school GCSE results or Pupil Progress measures).

 supports ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school)

Data collection requirements

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools

The National Pupil Database (NPD)

Much of the data about pupils in England goes on to be held in the National Pupil Database (NPD).

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the department.

It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information

Sharing by the Department

The law allows the Department to share pupils’ personal data with certain third parties, including:

 schools

 local authorities

 researchers

 organisations connected with promoting the education or wellbeing of children in England

 other government departments and agencies

8 Privacy Notice October 2020

　

 organisations fighting or identifying crime

For more information about the Department’s NPD data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

Organisations fighting or identifying crime may use their legal powers to contact the DfE to request access to individual level information relevant to detecting that crime. Whilst numbers fluctuate slightly over time, the DfE typically supplies data on around 600 pupils per year to the Home Office and roughly 1 per year to the Police.

For information about which organisations the Department has provided pupil information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the police please visit the following website: https://www.gov.uk/government/publications/dfe-external-data-shares

How to find out what personal information the DfE holds about you

Under the terms of the Data Protection Act 2018, you are entitled to ask the Department:

 if they are processing your personal data

 for a description of the data they hold about you

 the reasons they’re holding it and any recipient it may be disclosed to

 for a copy of your personal data and any details of its source

If you want to see the personal data held about you by the Department, you should make a ‘subject access request’. Further information on how to do this can be found within the Department’s personal information charter that is published at the address below:

https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter

To contact the DfE: https://www.gov.uk/contact-dfe