How we use
student and parent information
Under General
Data Protection Regulations (GDPR) we are obliged to inform you of the
information we hold on your child/ren, what we use it for, who we share it with
and for how long we keep it. This privacy notice aims to provide you with this
information. If it, or any information linked to it is unclear, please contact
the School Office or the School’s Data Protection Officer. Contact details for
both are available in Section 11 at the end of this privacy notice.
We, Clarendon
Primary School & Nursery, Knapp Road, Ashford, Middlesex, TW15 2HZ are the
Data Controller for the purposes of data protection law. We are registered with
the Information Commissioner’s Office and our registration number is Z8998857.
As
a public body we have appointed a Data Protection Officer (DPO) Mrs Carol
Foley. Our DPO can be contacted at the School address or by email dataprotection@clarendon.surrey.sch.uk.
The categories of pupil
and parent information that we collect, hold and share include but are not
limited to:
Personal
information (such as name, unique pupil number, parents’ national insurance
number)
Contact
details and contact preference order (contact telephone numbers, email
addresses, home addresses)
Characteristics
(such as ethnicity, religion, language, country of birth and free school meal
eligibility)
Safeguarding
information (such as court orders and professional involvement)
Special
educational needs information (including information relating to the specific
needs of a child and any EHCP requests/documentation)
Information
relating to Looked After and previously Looked After Children.
Relevant
medical information and administration (such as doctors’ information, child
health, dental health, allergies, medication, medical conditions, any
disabilities, dietary requirements and information relating to lunch time
arrangements)
Attendance
information (such as sessions attended, number of absences, reasons for absence
and any previous schools attended)
Assessment
& attainment information (such as Early Years Foundation Stage Profile
information, Key Stage 1, Key Stage 2 & phonics results, internal
assessment data for all year groups as well as any other relevant assessment
results)
Behavioural
information (such as exclusions and any relevant alternative provision put in
place)
Personal
information required for the appropriate delivery of offsite trips; these
include residential visits.
Photographs
for internal safeguarding and security purposes, school newsletters, school
data system, media and promotional purposes. (NB. separate consent is also
obtained where required)
Payment
details (collected and processed by WisePay on behalf of the school)
Information
relating to meetings with parents (such as parents’ evenings and other relevant
meetings undertaken with staff at the school or other professionals working on
behalf of the school)
Information
relating to meetings with children (such as concerns raised regarding events in
school or incidents with other children)
We
may also hold data about pupils that we have received from other organisations,
including other schools, local authorities and the Department for Education.
Why we
collect and use pupil and parent information
We
collect and use pupil information, for the following purposes:
To
support pupil learning.
To
monitor and report on pupil attainment progress.
To
provide appropriate pastoral and medical care.
For
safeguarding and pupil welfare purposes.
For
research purposes.
To
inform you about events and other things happening in school.
To
assess the quality of our services.
To
keep children safe (such as details of any food allergies as well as emergency
contact details)
For
the purposes of child protection.
Where
applicable, to ensure the safe and effective delivery of sessions provided by
either the school’s nursery or after school club.
To
meet the statutory duties placed upon us for DfE data collections.
To
ensure any activities occurring offsite are delivered in a safe and efficient
manner.
To
comply with the law regarding data sharing.
The lawful
basis on which we use this information
Our lawful
basis for collecting and processing pupil information is defined under Article
6, and the following sub-paragraphs in the GDPR apply:
Data
subject gives consent for one or more specific purposes.
Processing
is necessary to comply with the legal obligations of the controller.
Processing
is necessary to protect the vital interests of the data subject.
Processing
is necessary for tasks in the public interest or exercise of authority vested
in the controller (the provision of education)
Our lawful
basis for collecting and processing pupil information is also further defined
under Article 9, in that some of the information we process is deemed to be
classified as sensitive or special information and the following sub-paragraphs
in the GDPR apply:
The
data subject has given explicit consent.
It
is necessary to fulfil the obligations of the data controller or of the data
subject.
It
is necessary to protect the vital interests of the data subject.
Processing
is carried out in the course of our legitimate activities.
Reasons
of public interest in the area of public health.
It
is in the public interest.
Where we have
obtained consent to use pupils’ personal data, this consent can be withdrawn at
any time. We will make this clear when we ask for consent and will explain how
consent can be withdrawn.
Some of the
reasons listed above for collecting and using pupils’ personal data overlap,
and there may be several grounds which justify our use of this data.
An example of
how we use the information you provide is for the submission of the school
census returns, including a set of named pupil records, which is a statutory
requirement on schools under Section 537A of the Education Act 1996.
The provision
of statutory information for e.g. school census and data returns:
Means
that schools do not need to obtain parental or pupil consent to the provision
of information.
Ensures
schools are protected from any legal challenge that they are breaching a duty
of confidence to students.
Helps
to ensure that returns are completed by schools.
Collecting
pupil information
Pupil
data is essential for the schools’ operational use. Whilst the majority of
pupil information you provide to us is mandatory, some of it is requested on a
voluntary basis. In order to comply with the data protection legislation, we
will inform you at the point of collection, whether you are required to provide
certain pupil information to us or if you have a choice in this.
We
collect pupil information via:
Information
provided by parents, e.g. when completing registration forms at your child’s
point of entry to the school or when your child takes part in a specific
activity (this information is updated annually to ensure it remains accurate)
Information
provided by parents when requesting a place in either the school’s nursery, breakfast
or after school clubs.
Information
received via a CTF (Common Transfer File) provided by your child’s previous
school.
Other
information provided by your child’s previous school.
Information
provided by other external agencies (these include, but are not limited to, health,
children’s services, speech and language, occupational therapy, educational
psychology and CAMHS)
How we
store pupil data
We
hold pupil data securely for a set amount of time whilst the child remains at
Clarendon Primary School & Nursery and in some instances for a set period
of time after leaving, for example when a pupil does not transfer immediately
to another school. Clarendon Primary
School & Nursery retains information in accordance with the Information
Records Management Society guidance on data retention schedules. (Further
information can be found in the ‘Information Management Toolkit for Schools’ at
www.irms.org.uk )
We
have data protection policies and procedures in place which are regularly
reviewed.
Who we
share pupil information with
We
routinely share pupil information with appropriate third parties. These
include:
The
local authority in order to meet legal obligations with regards to sharing
certain information, such as safeguarding concerns and exclusions.
Department
for Education.
The
pupil’s family and representatives.
Educators
and the STA (Standards Testing Agency)
Ofsted.
Suppliers
and service providers to enable them to provide the service we have contracted
them for, e.g. Target Tracker, SIMS, WisePay, Teachers2Parents and carefully
selected providers who offer a range of supporting educational software used by
the school to support each child’s education.
Financial
organisations.
Central
and local government.
Auditors.
Survey
and research organisations.
Health
authorities.
Health
and social welfare organisations.
School
nursing team.
Professional
advisers and consultants.
Charities
and voluntary organisations.
Police
forces, courts, tribunals.
Professional
bodies.
Schools
that the pupils attend after leaving us.
Where
we transfer personal data to a country or territory outside the European
Economic Area, we will do so in accordance with data protection law.
Why we regularly share
pupil information
We
do not share information about our pupils with anyone without consent unless
the law and our policies allow us to do so.
The
Department for Education (DfE) collects personal data from educational settings
and local authorities via various statutory data collections. We are required
to share information about our pupils with the Department for Education (DfE)
either directly or via the local authority:
We
are required to share information about pupils with the local authority (LA)
and the Department for Education under section 3 of The Education (Information
about Individual Students) (England) Regulations 2013.
We
are also required to share information about pupils with the Department for
Education under regulation 5 of The Education (Information about Individual
Students) (England) Regulations 2013.
This
data sharing underpins a range of functions which include school funding and
educational attainment policy and monitoring.
To find out more about
the data collection requirements placed on us by the Department for Education
(for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools or see Appendix 2a ‘How Government uses your Data’.
National Pupil Database
As
identified above, we are required by law to provide information about pupils to
the Department for Education as part of statutory data collections such as the
school census. Some of this information is then stored in the National Pupil
Database (NPD), which is owned and managed by the Department for Education and
provides evidence on school performance to inform research.
The
law that allows this is the Education (Information about Individual Pupils)
(England) Regulations 2013. The database is held electronically so it can
easily be turned into statistics. The information is securely collected from a
range of sources including schools, local authorities and exam boards. The
Department for Education may share information from the NPD with other organisations
which promote children’s education or wellbeing in England. Such organisations
must agree to strict terms and conditions about how they will use the data.
Decisions
on whether the DfE releases data to third parties are subject to a strict
approval process and based on a detailed assessment of:
who
is requesting the data
the
purpose for which it is required
the
level and sensitivity of data requested
the
arrangements in place to store and handle the data
To
be granted access to pupil information, organisations must comply with strict
terms and conditions covering the confidentiality and handling of the data,
security arrangements and retention and use of the data.
For
more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-howwe-collect-and-share-research-data.
Requesting
access to your personal data
Under
data protection legislation parents and pupils have the right to request access
to information about them that we hold through a Subject Access Request. To make a request for your personal
information or to be given access to your child’s educational record, contact
the Data Protection Officer whose details can be found in Section 11.
If
you make a subject access request, and if we do hold information about you or
your child, we will:
Give
you a description of it.
Tell
you why we are holding and processing it and how long we will keep it for.
Explain
where we got it from; if not from you or your child.
Tell
you who it has or will be shared with.
Give
you a copy of the information in an intelligible form.
In
certain circumstances, individuals also have the right for their personal
information to be transmitted electronically to another organisation.
If
you’d like to make a request please contact our Data Protection Officer using
the contact details provided in Section 11.
You
also have the right to:
Object
to processing of personal data that is likely to cause, or is causing, damage
or distress.
Prevent
processing for the purpose of direct marketing.
Object
to decisions being taken by automated means.
In
certain circumstances, have inaccurate personal data rectified, blocked, erased
or destroyed.
A
right to seek redress, either through the ICO, or through the courts.
Making
a complaint
If
you have a concern or wish to make a complaint about the way we are collecting
or using your personal data, you should raise your concern with us in the first
instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/
Contact
If you would like to discuss
anything in this privacy notice, please contact the DPO:
Mrs Carol Foley
Clarendon Primary School
& Nursery
Knapp Road
Ashford
Middlesex
TW15 2HZ
Tel: 01784 253379