GDPR & Privacy Notices

Subject Access Requests

Procedure & Protocol

As an organisation we collect and process data about individuals. We explain what information we collect, and why in our Privacy Notices.

Any individual, or person with parental responsibility, or young person with sufficient capacity to make a request is entitled to ask what information is held. Copies of the information shall also be made available on request. A form to complete is available.

To ensure that requests are dealt with in an effective and timely manner we may seek to clarify the terms of a request.

To collate and manage requests we have designated persons to co-ordinate all requests.

Evidence of their identity, based on the information set out and the signature on the identity must be cross-checked to that on the application form. Discretion about employees and persons known to the school may be applicable but if ID evidence is not required an explanation must be provided by school staff and signed and dated accordingly

Exemptions to a SAR exist and may include

Education, Health, Social Work records
Examination marks and scripts
Safeguarding records
Special educational needs
Parental records and reports
Legal advice and proceedings
Adoption and Court records and/or reports
Regulatory activity and official requests e.g. DfE statistical information
National security, Crime and taxation
Journalism, literature and art
Research history, and statistics
Confidential references

All data subjects have the right to know: -

What information is held?
Who holds it?
Why is it held?
What are the retention periods?
That each data subject has rights. Consent can be withdrawn at any time (to some things).
A right to request rectification, erasure or to limit or stop processing
A right to complain

Much of this will be contained within the Privacy Notices on the website.

The information will be provided in an electronic format, usually within one calendar month of the request. However, in some circumstances, for example the school is closed for holidays, this may be extended by up to another calendar month.

Following delivery of the information the requester has the right to ask for a review or use the complaint process if they feel that information has not been provided.

Subject Access Request Form

Common to all privacy notices

The legal grounds for using your information

This is common for all personal and sensitive data we collect and process about staff, volunteers, pupils, parents, carers and any other individuals.

Some data is more sensitive than other types of data. These special categories are as follows: personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation.

Consent

The school will ask for consent to process data about you or a pupil. The type of data that is to be used, and how it is to be used will be specified on the consent forms.

You have the choice to opt in for certain types of data usage, and this is made clear. However, some data that is collected and processed in schools is not optional.

Legitimate interests

This means that the processing is necessary for legitimate interests except where the processing is unfair to you. The School relies on legitimate interests for many of the ways in which it uses information.

Specifically, the school has a legitimate interest in:

Providing educational services to pupils
Safeguarding and promoting the welfare of pupils and staff
Promoting the objects and interests of the school
Ensuring the efficient operation of the school
Compliance with all relevant legal obligations of the school
Keeping the whole school community informed about events, news and activities

Necessary for a contract

Information about individuals may be necessary to perform our obligations under our contracts.

For example, maintaining the school Management Information System database.

Legal obligation

Much of school life is governed by legal obligations to supply information to organisations such as the Department for Education or Local Authority or HMRC. We may also have to disclose information to third parties such as the courts, Disclosure and Barring Service or the police where legally obliged to do so.

Vital interests

For example, to prevent someone from being seriously harmed or killed.

Public interest

The School considers that it is acting in the public interest when providing education. Certain regulations, DfE and Local Authority, health and other guidance may require the school to process data in the public interest.

Legal claims:

The processing is necessary for the establishment, exercise or defence of legal claims. This allows us to share information with our legal advisors and insurers.

Your rights

What decisions can you make about your information?

From May 2018 data protection legislation gives you a number of rights regarding your information. Some of these are new rights whilst others build on your existing rights.

Your rights are as follows:

you can ask what information we hold about you and be provided with a copy. Sometimes we are not able to share all the information, but this is set out in our Subject Access Policy
if information is incorrect you can ask us to correct it
you can ask us to delete the information that we hold about you or your child in certain circumstances. For example, where we no longer need the information;
you can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer – this does not apply to pupil records as these are transferred by a DfE process called the Common Transfer File
our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy

If you disagree with any decision we make about your data you can use our complaints policy, you also have the right to make a complaint to the Information Commissioner, and sometimes to the Information Tribunal or through the court process. Our complaints policy is available on the website.

School Workforce

This privacy notice explains how we collect, process and manage information for the school workforce. That includes employed members of staff, volunteers, including trustees and governors, trainee teachers, apprentices and work experience/workplace placements.

The categories of school workforce information that we collect, process, hold and share include:

personal information (such as name, employee or teacher number, national insurance number)
special categories of data including characteristics information such as gender, age, ethnic group
contract information (such as start dates, hours worked, post, roles and salary information)
work absence information (such as number of absences and reasons)
qualifications (and, where relevant, subjects taught)
medical information
other personal information
references

We use and share information to comply with statutory, regulatory, practice and contractual obligations. These may include, but are not limited to:-

improving the management of workforce data across the sector
enabling development of a comprehensive picture of the workforce and how it is deployed
pay salaries and pension contributions
informing the development of recruitment and retention policies
allowing better financial modelling and planning
enabling ethnicity and disability monitoring
supporting the work of the School Teachers’ Review Body
comply with guidance such as ‘Working Together’ and safeguarding obligations
facilitating good governance
internal reviews and quality monitoring
CPD and staffing issues

If we are required to comply with other legal obligations not listed above we will share data only when it is lawful to do so.

The lawful basis on which we collect and process this information

We must make sure that information we collect and use about pupils is in line with the UK GDPR and Data Protection Act. This means that we must have a lawful reason to collect the data, and that if we share that with another organisation or individual we must have a legal basis to do so.

The lawful basis for schools to collecting and processing information comes from a variety of sources, such as the Article 6 and Article 9 of the UK GDPR, the Safeguarding of Vulnerable Groups Act 2006. We also have obligations to organisations such as HMRC and the Department of Work and Pensions.

Collecting this information

Whilst the majority of information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with data protection legislation, we will inform you whether you are required to provide certain school workforce information to us or if you have a choice in this.

Storing this information

We hold school workforce data for in accordance with our HR and Retention Policy

Who we share this information with

We may share this information with organisations such as:

our local authority
the Department for Education (DfE)
Safeguarding and protection for children and vulnerable adults
Payroll services
Legal Advisers
Insurance providers
HMRC
Teacher Pension Scheme and the Local Government Pension Scheme (and other pension providers
Health professionals

Why we share school workforce information

We do not share information about workforce members with anyone without consent unless the law and our policies allow us to do so.

Local authority

We are required to share information about our workforce members with our local authority (LA) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.

Department for Education (DfE)

We share personal data with the Department for Education (DfE) on a statutory basis. This data sharing underpins workforce policy monitoring, evaluation, and links to school funding / expenditure and the assessment educational attainment.

We are required to share information about our school employees with our local authority (LA) and the Department for Education (DfE) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.

Data collection requirements

The department may share information about school employees with third parties who promote the education or well-being of children or the effective deployment of school staff in England by:

conducting research or analysis
producing statistics
providing information, advice or guidance

The department has robust processes in place to ensure that the confidentiality of personal data is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether DfE releases personal data to third parties are subject to a strict approval process and based on a detailed assessment of:

who is requesting the data
the purpose for which it is required
the level and sensitivity of data requested; and
the arrangements in place to securely store and handle the data

To be granted access to school workforce information, organisations must comply with its strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

To contact the department: https://www.gov.uk/contact-dfe

Requesting access to your personal data

Under data protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information, contact the School Business Manager, email: office@westgate.leicester.sch.uk or the Data Protection Officer, J A Walker, Solicitor email: info@jawalker.co.uk telephone: 0333 7729763

You also have the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress
prevent processing for the purpose of direct marketing
object to decisions being taken by automated means
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
claim compensation for damages caused by a breach of the Data Protection regulations

More details about how we use and manage data can be found in the ‘Data Processing Notices – Common Principles and Processes’, the Data protection Policy and other relevant polices for the School Workforce on the website.

Pupil Data

Introduction

As a school we collect a significant amount of information about our pupils. This notice explains why we collect the information, how we use it, the type of information we collect and our lawful reasons to do so.

Why do we collect data?

We collect and use pupil data to:-

Fulfil our statutory obligations to safeguard and protect children and vulnerable people
Enable targeted, personalised learning for pupils
Manage behaviour and effective discipline
Monitor our effectiveness
Comply with our legal obligations to share data
Support pupils to fulfil their potential
Keep pupils, parents and carers informed about school events and school news

Our Legal Obligations

The lawful basis for schools to collect information comes from a variety of sources, such as the Education Act 1996, Regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013, Article 6 and Article 9 of the UK GDPR.

The Department for Education and Local Authorities require us to collect certain information and report back to them. This is called a ‘public task’ and is recognised in law as it is necessary to provide the information.

We also have obligations to collect data about children who are at risk of suffering harm, and to share that with other agencies who have a responsibility to safeguard children, such as the police and social care.

We also share information about pupils who may need or have an Education Health and Care Plan (or Statement of Special Educational Needs). Medical teams have access to some information about pupils, either by agreement or because the law says we must share that information, for example school nurses may visit the school.

Sharing Information

Other services, organisations and people we may share information with include:-

schools or Academies that the students attend after leaving us
relevant local authority/(ies)
youth support services (students aged 13+)
the Department for Education (DfE)
the NHS as required
School nursing service
Parent/Carer
Suppliers and service providers
Health professionals
Health & Social Welfare organisations
Professional bodies
Charities and voluntary organisations
Auditors
Survey & research organisations
Social Care Organisations
Police forces and Court services
Suppliers of software and apps that are used in school

We must keep up to date information about parents and carers for emergency contacts.

How we use the data

In school we also use various third party tools to make sure that pupils best interests are advanced. We also record details about progress, attainment and pupil development to support future planning and learning.

We use data to manage and monitor pastoral needs and attendance/absences so that suitable strategies can be planned if required.

We use systems to take electronic payments for school meals. This includes financial software to manage school budgets, which may include some pupil data. We use software to track progress and attainment.

Data can be used to monitor school effectiveness, the impact of intervention and learning styles across groups of pupils as well as individual children.

We may use consultants, experts and other advisors to assist the school in fulfilling its obligations and to help run the School properly. We might need to share pupil information with them if this is relevant to their work.

We also use contact information to keep pupils, parents, carers up to date about school events.

What type of data is collected?

The DfE and government requires us to collect a lot of data by law, so that they can monitor and support schools more widely, as well as checking on individual schools effectiveness.

The categories of pupil information that the school collects, holds and shares include the following:

Personal information – e.g. names, pupil numbers and addresses

Characteristics – e.g. ethnicity, language, nationality, country of birth and free school meal eligibility

Attendance information – e.g. number of absences and absence reasons

Assessment information – e.g. national curriculum assessment results

Relevant medical information and social care

Information relating to SEND and health needs

Behavioural information – e.g. number of temporary exclusions

CCTV, photos and video recordings of you are also personal information.

The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the pupil information we share with the department, for the purpose of data collections, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

conducting research or analysis
producing statistics
providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

who is requesting the data
the purpose for which it is required
the level and sensitivity of data requested: and
the arrangements in place to store and handle the data

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received

To contact DfE: https://www.gov.uk/contact-dfe

Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact the School Business Manager, email: office@westgate.leicester.sch.uk or the Data Protection Officer, J A Walker, Solicitor, email: info@jawalker.co.uk telephone: 0333 7729763

You also have the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress
prevent processing for the purpose of direct marketing
object to decisions being taken by automated means
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
claim compensation for damages caused by a breach of the Data Protection regulations

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/

Contact:

If you would like to discuss anything in this privacy notice, please contact the Data Protection Officer, J A Walker, Solicitor, email: info@jawalker.co.uk telephone: 0333 7729763

More information about Data Protection and Our Policies

How we manage the data and our responsibilities to look after and share data is explained in our Data protection Policy, and connected policies, which are also available on our website.

If you feel that data about your child is not accurate, or no longer needed please contact the schools office. Our complaints policy explains what to do if there is a dispute. Subject Access Requests are dealt with by the specific policy on the website.

Careers & Post 16 Data Sharing

Post 16 Reference Consent Form

Post 16 & 18 Destinations Data Consent Form

To support students and provide advice and guidance about potential career opportunities, and to make sure that their next phase of education or training is as successful as possible, it is essential that the right information is shared.

As part of our work with other organisations to provide careers and youth service support, information will be shared with those providers.

When students are preparing to leave us, and upon confirmation of acceptance of a place or enrolment at the student’s chosen placement, personal data will be made available to that organisation. The purpose of processing the data is to ensure that on transfer to the next setting, all relevant student information is provided. This is to support students during the transition process and to settle into the next setting.

We will not give information about you to anyone outside of West Gate School without your consent unless the law allows or requires us to do so.

Information we have to pass on by law

Legally we are obliged to pass Intended Destination, September Guarantee and Annual Activity processes to the Local Authority and Careers services. This may be direct to the Local Authority or via a Local Authority approved Post-16 Transition Portal. Further processing of the data will be undertaken by agreed third parties.

The Local Authority has legal obligations under the Education and Skills Act 2008 and the Apprenticeship, Skills, Children and Learning Act 2009 to assist, encourage and enable young people to participate in education or training. Statutory Guidance in force from 1 September 2022 requires school to provide careers guidance from Year 7 onwards (and young adults with learning difficulties or disabilities up to the age of 25). The Local Authority may pass on the information we share with them to the Department of Education.

The relevant legislation is: -

Section 42A, 42B, 45 and 45A of the Education Act 1997
Section 72 of the Education and Skills Act 2008
Schedule 4 (15) of the School Information (England) Regulations 2008
The Education (Careers Guidance in Schools) Act 2022 in force 1 September 2022.

We share the following information about you:

What you are intending to do after Year 11 in terms of education, training or employment (your Intended Destination).
Which post-16 provider made you an offer of a place on a course at the end of Year 11 and whether you took up the offer and started a course in Year 12 (referred to as the September Guarantee).
What your destination is after you leave Year 11 if we are aware of this (as part of the Annual Activity Survey).

What information do we share about you with other providers and settings?

To support your careers support provision and/or transition to post-16 education we, or the Local Authority, may also need to share further information this may include:

Personal information (such as name, unique pupil number and address)
Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)
Contact details, including parental contact details
Attendance information (such as, but not limited to, attendance percentages, number of absences and absence reasons)
Assessment information (such as, but not limited to, exam results and teacher assessment judgements)
Relevant medical information
Special Education Needs information
Behavioural information (such as, but not limited, exclusions, attitudes to learning)
Safeguarding information (such as, but not limited to, involvement of other agencies)
Post-16 destination and enrolment information

Depending on your next destination, some categories above may be shared by consent rather than us being obliged to do so. If upon selecting your next destination, there are categories of data you would prefer to withhold, please contact office@westgate.leicester.sch.uk in writing. We will then advise you if we must pass the data on or not.

How we keep your information safe

Both the school and Local Authority keep information about you on computer systems and sometimes on paper. There are strict controls on who can see your information. Other organisations are required to comply with the Data Protection Act 2018.

Need to know more about how we process your information?

There are more details on this webpage above the privacy notices in the GDPR and Data Protection policy.

We are required by law to pass on certain information of students aged 16+ to providers of (youth) support services in your area. This is the local authority support service for young people aged 13-19 in England Section 507B of the Education Act 1996. For example, where disclosure of learning support need has been declared, we are required to provide the names and address of you and your parents/carer, along with any further information relevant to the support services’ role.

However, if you are over 16, you or your parents/carer can ask that no information beyond names, addresses and your date of birth can be passed to the support services. Please contact office@westgate.leicester.sch.uk in writing to let us know that you do not want this information to be shared with the support services.

Please note that safeguarding and child protection legislations takes precedency over this request so this information will be shared.

For more information about young people’s services, please go to the National Careers Service page at https://nationalcareersservice.direct.gov.uk/aboutus/Pages/default.aspx

What happens next?

The College or University will have their own Data Protection Policy and Privacy Notices – you will need to contact them with any queries. The data we have supplied to them will only be retained on our systems to manage the transition and also in line with our data retention responsibilities, and these are set out in our retention schedule.

Job Applicant

Introduction

When applying for a position in school, as an organisation we are the Data Controller. That means we have a statutory responsibility to explain how we collect, manage, use and store information about applicants.

You have a right to be informed about how our trust uses any personal data that we collect about you. This privacy notice, and our Data Protection Policy, explains our data usage when you apply for a job with us.

What information do we collect?

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Name, address and contact details, including email address and telephone number

Copies of right to work documentation

References

Evidence of qualifications

information about your current role, level of remuneration, including benefit entitlements

Employment records, including work history, job titles, training records and professional memberships

We may also request and collect, use, store and share (when appropriate) information about you that falls into "special categories" of more sensitive personal data. This includes, but is not restricted to:

Information about race, ethnicity, religious beliefs, sexual orientation and political opinions

Whether or not you have a disability for which the school needs to make reasonable adjustments during the recruitment process

Photographs and CCTV images captured in school

We may also collect, use, store and share (when appropriate) information about criminal convictions and offences.

We may also hold data about you that we have received from other organisations, including other schools and social services, and the Disclosure and Barring Service in respect of criminal offence data.

Every school has statutory obligations that are set out in ‘Keeping Children Safe in Education’ and other guidance and regulations.

Why we use this data?

The school needs to process data to take steps at your request prior to entering into a contract with you. It may also need to process your data to enter into a contract with you.

The school needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicant's eligibility to work in the UK before employment starts.

The school has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the school to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job. The school may also need to process data from job applicants to respond to and defend against legal claims.

The school may process information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability. This is to carry out its obligations and exercise specific rights in relation to employment.

Where the school processes other special categories of data, such as information about ethnic origin, sexual orientation, disability or religion or belief, this is for equal opportunities monitoring purposes.

For some roles, the school is obliged to seek information about criminal convictions and offences. Where the school seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment.

The school will not use your data for any purpose other than the recruitment exercise for which you have applied.

How do we use the data?

Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, shortlisting and interview panel members involved in the recruitment process (this may include external panel members), and IT staff if access to the data is necessary for the performance of their roles.

The school will not share your data with third parties, unless your application for employment is successful and it makes you an offer of employment. As well as circulating your application and related materials to the appropriate staff at the school, we will share your personal information for the above purposes as relevant and necessary with:

your referees.
Disclosure & Barring Service (DBS) in order to administer relevant recruitment checks and procedures.
UK Visas & Immigration (UKVI) in order to administer relevant recruitment checks and procedures.
Where relevant and as required for some posts, the Teacher Regulation Authority checks

Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent, and explain how you would go about withdrawing consent if you wish to do so.

Automated Decision Making and Profiling

We do not currently process any personal data through automated decision making or profiling. If this changes in the future, we will amend any relevant privacy notices in order to explain the processing to you, including your right to object to it.

Collecting this data

As a school, we have a legal obligation to safeguard and protect our pupils and also staff, volunteers and visitors to our setting. We collect the data for specific purposes.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the school during the recruitment process. However, if you do not provide the information, the school may not be able to process your application properly or at all.

Whenever we seek to collect information from you, we make it clear whether you must provide this information for us to process your application (and if so, what the possible consequences are of not complying), or whether you have a choice.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities

Government departments or agencies

Police forces, courts, tribunals

How we store this data

The school takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

We will dispose of your personal data securely when we no longer need it.

We keep applicant data for a period of up to 6 months if an applicant is not successful.

Successful applicants who secure a position then come within the employee/school workforce provisions.

Transferring data internationally

We do not share personal information internationally.

Your rights

You have a right to access and obtain a copy of your data on request;

You can:

require the school to change incorrect or incomplete data;
require the school to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
object to the processing of your data where the school is relying on its legitimate interests as the legal ground for processing.

If you would like to exercise any of these rights, please contact the school office. If you believe that the school has not complied with your data protection rights, you can complain to the Information Commissioner.

Complaints

We take any complaints about our collection and use of personal information seriously.

Our complaints policy deals with the different stages of any complaint, and how this is managed within school. You can also contact our Data Protection Officer or contact the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/

Call 0303 123 1113

Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data protection officer:

Our data protection officer is:

John Walker of J.A.Walker, Solicitor – info@jawalker.co.uk

However, our data protection lead has day-to-day responsibility for data protection issues in our school.

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact the Data Protection Officer, J A Walker, Solicitor, email: info@jawalker.co.uk telephone: 0333 7729763

School Trips

When organising a school trip for pupils offsite, for any duration, it is important that necessary information is available or is shared with relevant third parties.

Information that may be shared will include both personal and special category, that is to say, more sensitive, data about pupils, staff and any volunteer helpers.

This may include, but is not limited to:-

name;
address;
dates of birth;
next of kin/emergency contact details;
mobile numbers;
landline numbers;
email and other contact details;
health and medication information;
child protection information;
pupil premium or other special status information;
passport or other identity information as required.

This information will be contained securely as both hard copy and electronic information. This information will be shared as required with other third parties that can include transport providers, travel agency staff, venues, accommodation providers, immigration and/or police, and medical staff if it is necessary.

It is the responsibility of parents and carers for pupils attending trips to ensure that the relevant information is provided as requested.

Provision of this information is a requirement, failure to do so may result in the pupil’s place on the trip being cancelled. Cancellation in these circumstances would not necessarily lead to a refund of any monies paid.

As we are processing data for the purposes of managing the school trip, the school’s usual UK GDPR and data protection policy applies. Information about how the school controls and uses data is found within the main policy and also contained in the privacy notice that is on the school website in addition to the content of this notice.

Governors

Under data protection law, individuals have a right to be informed about how our school/trust use any personal data that we hold about them.

School governors and trustees provide a vital role within our setting. Governors/trustees provide us with personal data and on occasion we share personal data with governors/trustees so that they can fulfil their obligations.

This privacy notice explains how we collect, store and use personal data about individuals who are governors/trustees.

The personal data we hold

We process data relating to those we appoint, or otherwise engage as governors/trustees, this may processing data about current office holders, or retaining data about those individuals who are no longer in role. Personal data that we may collect, use, store and share (when appropriate) about you may include, but is not restricted to:

Contact details and copies of identification documents, including names, addresses, telephone numbers, email addresses, passport and birth certificates, visa details and other contact details;
Date of birth, marital status and gender;
Next of kin and emergency contact numbers;
Bank account details (for the payment of expenses);
Appointment information, including copies of right to work documentation, references and other information included in a CV or covering letter or as part of the appointment process;
Qualifications and employment records, including work history, job titles, and professional memberships;
DBS Certificate number and date of issue, prohibition from teaching and management checks, disqualification from childcare declaration form;
Medical questionnaires and, where appropriate, information about an individual’s health;
Records of attendance at governing body and sub-committee meetings;
Records and outcomes of any disciplinary, complaints and/or grievance procedures or other performance issues;
Specimen signatures/signed mandates for delegated financial authority;
Photographs and videos of participation in Schools’ activities;
CCTV footage captured by the Schools’ CCTV system;
Vehicle details for those who use the Schools’ car parking facilities;

Special Category data

Some of the information we hold is what is classed as special category data. Special category data includes any information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health, genetic or biometric data, and trade union membership. Where we need to process special category data we must fulfil an additional lawfully process, which is detailed below.

Why we use this data

The purpose of processing this data is to help us run the School/Trust, including to:

Enable governors/trustees to be paid for any expenses they have incurred;
Enable appropriate organisational contact (for example, lists of governors/trustees for both internal and external use, including publication on the School’s website);
Allow for delegated financial authority (for example, cheque signing, bank mandates, contract signing);
Facilitate safe appointment of governors/trustees, as part of our safeguarding obligations towards pupils;
Support effective assessment and monitoring of governor/trustee performance;
Inform our appointment and retention policies;
Assist with management planning and forecasting, research and statistical analysis, including that imposed by law (such as diversity or gender pay gap analysis and taxation records);
Arrange travel and accommodation for training courses, meetings, conferences, excursions, trips, visits and tours;
Provide access to and use of the Schools’ IT systems and to monitor use thereof, in accordance with the Schools’ Acceptable Use Policy;
Order goods and services, including appropriate insurance and professional advice for the Schools;
Maintain relationships with alumni and the Schools’ community;
Meet the legal requirements of the Charity Commission and Companies House if necessary;
Ensure security of the School site (for example, governor passes, issue of access fobs) and including CCTV in accordance with the Schools’ CCTV policy.

Our lawful basis for using this data

We only collect and use personal information about you when the law allows us to. Most commonly, we use it:

When you have given us consent to use it in a certain way;
To fulfil a contract we have entered into with you;
To comply with a legal obligation;
To carry out a task in the public interest.

Less commonly, we may also use personal information about you where:

We need to protect your vital interests (or someone else’s interests);
We have legitimate interests in processing the data.

To process special category data we need an additional lawful basis. We will process special category data most commonly where:

We have your explicit consent;

The processing is necessary under social security or social protection law;
We are processing it in the vital interests of an individual;
We are providing health care or treatment under the responsibility of a health professional.

Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent, and explain how you go about withdrawing consent if you wish to do so.

Some of the reasons listed above for collecting and using personal information about you overlap, and there may be several grounds which justify the school’s use of your data.

Where we are processing data on a legal or contractual basis, if you choose not to share this data with us, we may not be able to carry out our obligations under our contractual relationship with you, or engage you as a governor.

Collecting this information

While the majority of information we collect from you is mandatory, there is some information that you can choose whether or not to provide.

Whenever we seek to collect information from you, we make it clear whether you must provide this information (and if so, what the possible consequences are of not complying), or whether you have a choice.

How we store this data

We create and maintain a personnel file for each governor in paper copy and/or electronic form on the Schools’ computer system. The information contained in this file is kept secure and is only used for purposes directly relevant to you holding the position of governor.

Once your appointment as a governor/trustee of the School/Trust has ended, we will retain this file and delete the information in it in accordance with our Retention of Records Policy, a copy of which is available by contacting the Data Protection Co-ordinator or the HR Manager at the Schools.

Data sharing

We do not share information about you with any third party, without your consent, unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about you with a number of organisations and agencies that may include (but is not limited to):

All relevant local authorities – to meet our legal obligations to share certain information with it, such as safeguarding concerns;
The Department for Education;
Educators and examining bodies;
Our regulator, the Independent Schools Inspectorate;
Suppliers and service providers – to enable them to provide the service we have contracted them for;
Central and local government;
Financial organisations, such as HMRC;
Our auditors;
Survey and research organisations, including universities;
Police forces, courts, tribunals;

Other Information

There is more information about how we manage, store and protect data in the Data Protection Policy on the website. This also includes details about how to access your data, how to contact the Information Commissioner or our Data Protection Officer if you have a query or concern about how data is being used or retained.

This notice is based on the Department for Education’s model privacy notice for school governors, amended to reflect the way we use data in this school/trust.

This Notice

The Schools will update this Privacy Notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.

My Rights

In a school setting, personal data is stored and used for a variety of reasons. You may be a parent, carer, pupil, staff member, governor, visitor or anyone else who the school store data about. There are a number of categories of people, and many different types of data that is used in schools on a daily basis.

Whilst Privacy Notices set out details about why data may be collected, stored and used, there are some overriding principles that apply to every person (the Data Subject) when a school stores data. As Data Subjects, sometimes our consent is necessary for a school to process data about us. That might relate to photographs in school, reports in local press or similar. Consent is dealt with in the separate parts of the policy and can be accessed on the website or through the school office.

There are other occasions when data about us or our children may be used by the school to fulfil a legal obligation, a contract or some other lawful usage.

We all have other rights.

The right to rectification. Where data held about us is inaccurate, we have a right to apply for it to be amended and put right. This has to be done within one month, or within three months if it was complex. To do this we have to contact the data compliance manager within school, or the data protection officer. We have a right to complain if this is not done.
The right of access. This is a subject access request and is dealt with in more detail as part of the data protection policy. In essence, we have a right to see information about us that is classed as “personal data”. There is a separate process for us to make this request within school, and the school may ask us to clarify or be more specific about what kind of data we are asking for if there is a lot of it. Again, there is a one month timeframe for this that can be extended for three months in complex cases.
We have a right to erasure. This means that in certain circumstances we can ask for data about us to be permanently deleted. However, this can be limited if the data needs to be kept for some official or lawful purpose. The right to erasure sometimes occurs if we withdraw consent to a process.
We sometimes have the right to restrict processing. If we believe that data is inaccurate, and we have asked for it to be erased, we can ask the data processor and controller to stop any processing until the investigation into erasure or amendment has taken place.
There is also the right to data portability, this has little bearing in the school setting. Transfer of data for pupils is regulated by guidance from the Department for Education. Data about staff is part of HMRC contractual obligations. Data portability would usually apply to things like utility companies or bank accounts.
Individuals also have the right to object to personal data being used for marketing. Again, in the school setting this is likely to be very limited as the only marketing tends to be limited to school fetes, fairs and plays. Schools and academy trusts should not be sharing data with commercial third party entities to enable direct marketing of individuals. If this was the case, then an individual could object and ensure that the data was no longer used for that purpose.
As individuals we also have the right to ask that decisions are made about us on the basis of our data, rather than by an automated process. Again, any application of this in schools would be extremely limited. This tends to be regarding situations such as reference agency checks for loans and mortgages for example.

These rights are important and sit alongside the school or trust’s legal obligations to manage our data properly.

Please also see the Privacy Notices and Data Protection Policy.

If you feel that any of the Rights set out here are not being managed properly, or if that information held of our files is inaccurate or should not be there or should be changed or amended, please do let us know.

There is a form to complete at the end of this document. By providing us with as much detail as you can about why you think we have got something wrong, or why we are holding information that we should not be keeping, it makes the process much simpler for you.

We will respond within 28 days of receiving the form, and we will give our reasons in writing for any decision we make.

When you get the decision you can accept it, and you need do nothing more. You can ask for a review by us and our Data Protection Officer, you can complain using our policy if you feel that we have not acted properly or you can make a referral to the Information Commissioner – whose details are found at https://ico.org.uk/ or by phone 0303 123 1113

My Rights - Query form