Privacy Notice for Students

1. Introduction     

Under UK data protection law, individuals have a right to be informed about how our school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about students at our school.

Our trust, East Midlands Education Trust is the ‘data controller’ for the purposes of UK data protection law.

Our data protection officer is

             Data Protection Education Limited

Telephone:          0800 0862018

Email:                    dpo@dataprotection.education

 

2. The categories of student information that we process include:

• personal identifiers and contacts (such as name, unique student number, contact details and address)
• characteristics (such as ethnicity, language, and free school meal eligibility)
• safeguarding information (such as court orders and professional involvement)
• special educational needs (including the needs and ranking)
• medical and administration (such as doctors information, child health, dental health, allergies, medication and dietary requirements)
• attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
• assessment and attainment (such as end of EYFS assessment, key stage 1 and phonics results, key stages 2, 3, 4 and 5.
• behavioural information (such as exclusions and any relevant alternative provision put in place)
• photographs for identification
• Free school meal management
• CCTV images that have been captured, to keep our premises safe and secure for all users.

We may also hold data about your child that we have received from other organisations, including other schools and social services.

 

3. Why we use this data

We use the data listed above to:

1. Support student learning
2. Monitor and report on student attainment progress
3. Provide appropriate pastoral care
4. Assess the quality of our services
5. Keep children safe
6. Ensure proper management of school trips and afterschool clubs and activities
7. Administer admissions waiting lists
8. Comply with the law regarding data sharing: Such as the Dfe data collections.

 

3.1 Use of your child’s personal data in automated decision making and profiling

We do not currently process any personal data through automated decision making or profiling. If this changes in the future, we will amend any relevant privacy notices in order to explain the processing to you, including your right to object to it.

 

4. Our lawful basis for using this data

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing student information are:

• for the purposes of (a), (b) & (c) in accordance with the legal basis of Public task: collecting the data is necessary to perform tasks that schools are required to perform as part of their statutory function
• for the purposes of (e) in accordance with the legal basis of Vital interests: to keep children safe (food allergies, or medical conditions)
• for the purposes of (f) in accordance with the legal basis of Legal obligation: data collected for the Department for Education (DfE) census information
• Section 537A of the Education Act 1996
• the Education Act 1996 s29(3)
• the Education (School Performance Information)(England) Regulations 2007 o regulations 5 and 8 School Information (England) Regulations 2008
• the Education (Student Registration) (England) (Amendment) Regulations 2013

 

 In addition, concerning any special category data:

• In the case of ethnicity. condition a: the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.

• We need to protect an individual’s vital interests (i.e. protect your child’s life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
• We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
• We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
• We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

 

5. Collecting student information

We obtain student information via registration forms at the start of each academic year. In addition, when a child joins us from another school, we are sent a secure file containing relevant information.

Student data is essential for the schools’ operational use. Whilst most of the student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with UK GDPR we will inform you at the point of collection, whether you are required to provide certain student information to us or if you have a choice in this and we will tell you what you need to do if you do not want to share this information with us.

 

6. How we store this data

We keep personal information about your child while they are attending our school. This is outlined in the trust retention policy.

A copy of the trust retention schedule is available on request.

We have put in place appropriate security measures to prevent your child’s personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your child’s personal data securely when we no longer need it.

 

7. Who we share data with

We do not share information about your child with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required or necessary (and it complies with UK data protection law), we may share personal information about your child with:

• Our local authority to meet our legal obligations to share certain information with it, such as safeguarding concerns and information about exclusions.
• Our local authority to improve the pre-school to reception and primary to secondary transition.
• Government departments or agencies
• Our regulator, (Ofsted)
• Suppliers, service providers and educational software providers in support of teaching and learning to enable them to provide the service we have contracted them for such as:

• parent communication facilities (Parent Pay, Go4Schools)
• specialist teachers (e.g. Sports coaches, Peripatetic music teachers)
• online learning platforms
• online assessment tools
• providers of the school software systems such as:  information management (SIMS), data analytic (FFT, SISRA), safeguarding systems (CPOMS)

• Our auditors
• Survey and research organisations
• Health authorities
• Security organisations
• Health and social welfare organisations
• Professional advisers and consultants
• Charities and voluntary organisations in support of children’s needs.
• Police forces, courts, tribunals

 

The Department for Education (DfE)

We are required to share information about our students with the Department for Education (DfE) either

directly or via our local authority for the purpose of data collections, under:

• Section 537A of the Education Act 1996
• the Education Act 1996 s29(3)
• the Education (School Performance Information) (England) Regulations 2007
• regulations 5 and 8 School Information (England) Regulations 2008
• the Education (Student Registration) (England) (Amendment) Regulations 2013

All data is transferred securely and held by the Department for Education (DfE) under a combination of software and hardware controls, which meet the current government security policy framework. For more information, please see ‘How Government uses your data’ section. Local Authorities

We may be required to share information about our students with the local authority to ensure that they can conduct their statutory duties under

• the Schools Admission Code, including conducting Fair Access Panels.

 

Requesting access to your personal data

 Under UK GDPR, parents and students have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact:

Data Lead:  Becky Hutchinson        email: bhutchinson@limehurst.org.uk

 

Depending on the lawful basis above, you may also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress
• prevent processing for the purpose of direct marketing
• object to decisions being taken by automated means
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and a right to seek redress, either through the ICO, or through the courts.

 

 If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at raise a concern with ICO  

 

Withdrawal of consent and the right to lodge a complaint

Where we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know by contacting our Data Protection Lead.

 

 Last updated

We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This version was last updated May 2023.

 

 

Contact

If you would like to discuss anything in this privacy notice, please contact or Data Protection Officer:

Data Protection Education Limited

1 Saltmore Farm, New Inn Road,

Hinxworth,

Baldock SG7 5EZ

0800 0862018

dpo@dataprotection.education

 

Or, our data protection lead has day-to-day responsibility for data protection issues in our school. If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact them.

 

How Government uses your data

The student data that we lawfully share with the Department for Education (DfE) through data collections:

• underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school.
• informs ‘short term’ education policy monitoring (for example, school GCSE results or Student Progress measures).
• supports ‘longer term’ research and monitoring of educational policy. (for example, how certain subject choices go on to affect education or earnings beyond school)

 

Data collection requirements

To find out more about the data collection requirements placed on us by the Department for Education (DfE) (for example; via the school census) go to data collection and censuses for schools

 

The National Student Database (NPD)

Much of the data about students in England goes on to be held in the National Student Database (NPD). The NPD is owned and managed by the Department for Education (DfE) and contains information about students in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department for Education (DfE).

It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

To find out more about the NPD, go to Apply for Department for Education (DfE) personal data.

 

Sharing

The law allows the Department for Education (DfE) to share students’ personal data with certain third parties, including:

• schools
• local authorities
• researchers
• organisations connected with promoting the education or wellbeing of children in England
• other government departments and agencies
• organisations fighting or identifying crime 24

For more information about the Department for Education’s (DfE) NPD data sharing process, please visit: How DfE share personal data

 

Organisations fighting or identifying crime may use their legal powers to contact the Department for Education (DfE) to request access to individual level information relevant to detecting that crime.

For information about which organisations the Department for Education (DfE) has provided student information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the Police please visit the following website: DfE external data shares

 

How to find out what personal information the Department for Education (DfE) hold about you

Under the terms of the Data Protection Act 2018, you are entitled to ask the Department for Education (DfE):

• if they are processing your personal data
• for a description of the data they hold about you
• the reasons they’re holding it and any recipient it may be disclosed to
• for a copy of your personal data and any details of its source

 If you want to see the personal data held about you by the Department for Education (DfE), you should make a ‘subject access request’. Further information on how to do this can be found within the Department for Education’s (DfE) personal information charter that is published at the address below:

To contact the Department for Education (DfE): contact the Dfe