School Data Protection Privacy Notice
Who we are
We are South Stanley Infant and Nursery School, Tyne Road, South Stanley, Co Durham. We are an Infant and Nursery School for children aged 3-7 years old. Our Local Authority is Durham County Council.
Our Data Protection Officer is Michael Tallentire
What this notice is for
This policy is intended to provide information about how the School will use (or “process”) personal data about individuals including: its personnel, it’s current, past and prospective pupils and their parents, carers or guardians (referred to in this policy as “parents”).
This information is provided in accordance with the rights of individuals under Data Protection Law to understand how their data is used. School personnel, parents and students are all encouraged to read this Privacy Notice and understand the School’s obligations to its entire community.
This Privacy Notice applies alongside any other information the School may provide about a particular use of personal data, for example when collecting data via an online or paper form.
Anyone who works for, or acts on behalf of, the School (including staff, volunteers, governors and service providers) should also be aware of and comply with this Privacy Notice and the School’s Data Protection policy, which also provides further information about how personal data about those individuals will be used.
The School has appointed a Data Protection Officer who will deal with all your requests and enquiries concerning the School’s uses of your personal data (see section on Your Rights below) and endeavor to ensure that all personal data is processed in compliance with this policy and Data Protection Law.
Requests and enquiries should be sent to the Schools Data Protection Officer at Mr M Tallentire
Why the school needs to process personal data
In order to carry out its ordinary duties to staff, students and parents, the School may process a wide range of personal data about individuals (including current, past and prospective staff, pupils or parents) as part of its daily operation.
Some of this activity the School we will need to carry out in order to fulfil our legal rights, duties or obligations – including those under a contract with staff, or parents of its students.
Other uses of personal data will be made in accordance with the School’s legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals, and provided it does not involve special or sensitive types of data.
The School expects that the following uses may fall within that category of it’s (or its community’s) “legitimate interests”:
- Contact details, contact preferences, date of birth, identification documents
- Results of internal assessments and externally set tests
- Pupil and curricular records
- Characteristics, such as ethnic background, eligibility for free school meals, or special educational needs
- Exclusion information
- Details of any medical conditions, including physical and mental health
- Attendance information
- Details of any support received, including care packages, plans and support providers
- Photographs
- Safeguarding information
In addition, the School may need to process special category personal data (concerning health, ethnicity, religion, or sexual life) or criminal records information (such as when carrying out DBS checks) in accordance with rights or duties imposed on it by law, including as regards safeguarding and employment, or from time to time by explicit consent where required. These reasons may include:
- To safeguard students’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual’s medical condition where it is in the individual’s interests to do so: for example for medical advice, social services, insurance purposes or to organisers of School trips;
- To provide educational services in the context of any special educational needs of a pupil;
- In connection with employment of its staff, for example DBS checks, welfare or pension plans;
- Administer admissions waiting lists
- Monitor and report on pupil progress
- Support pupil learning
For legal and regulatory purposes (for example child protection, diversity monitoring and health and safety) and to comply with its legal obligations and duties of care
Types of personal data collected by the school
This will include by way of example:
- names, addresses, telephone numbers, e-mail addresses and other contact details;
- car details (about those who use our car parking facilities);
- bank details and other financial information, e.g. about parents who pay fees to the School;
- past, present and prospective students’ academic, disciplinary, admissions and attendance records (including information about any special needs), employment information and assessment results;
- where appropriate, information about individuals’ health, and contact details for their next of kin;
- images of students (and occasionally other individuals) engaging in School activities, and images captured by the School’s CCTV system
- information relating to past, present and prospective School personnel;
How the school collects data
Generally, the School receives personal data from the individual directly (including, in the case of students, from their parents). This may be via a form, or simply in the ordinary course of interaction or communication (such as email or written assessments). Other information is collected from professionals and other agencies where relevant (eg G.P, hospital, social workers etc.)
However in some cases personal data may be supplied by third parties (for example another School, or other professionals or authorities working with that individual)
Who has access to this information?
We do not share any of this data with any other organisation without your permission, except where the law requires it. We are required to provide pupil data to central government through the Department for Education and the Education Funding Agency. Where it is necessary to protect a child, the school will also share data with the Local Authority Children’s Services, medical professionals and/or the Police.
For the most part, personal data collected by the School will remain within the School, and will be processed by appropriate individuals only in accordance with access protocols. We do not transfer personal data to countries outside the European Economic Area.
A certain amount of any medical, pastoral and SEN pupil’s relevant information will need to be provided to staff more widely in the context of providing the necessary care and education that the pupil requires.
Finally, in accordance with Data Protection Law, some of the School’s processing activity is carried out on its behalf by third parties, such as IT systems, web developers, cloud storage and social media providers. Where possible this is subject to contractual assurances that personal data will be kept securely and only in accordance with the School’s specific directions.
Our Legal basis for using this data
We collect and use personal data on the basis of performing a public task (educating children).
On some occasions we may ask for consent to process data when its use is optional. On those occasions consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.
How long we keep personal data
The School will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason. Typically, the legal recommendation for how long to keep ordinary staff and pupil personnel files is up to 7 years following departure from the School. However, incident reports and safeguarding files will need to be kept much longer, in accordance with specific legal requirements.
If you have any specific queries about how this policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact the Data Protection Officer. However, please bear in mind that the School may have lawful and necessary reasons to hold on to some data.
Please refer to the School’s Record Keeping and Retention Policy for further details.
Your rights
Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them. This includes access to their child’s educational record. This should be in writing or by email to Mr M Tallentire. The school will respond within a 15 school days timescale.
Parents/Carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 13). Parents also have the right to make a SAR with respect to any personal data the school holds about them. If you make a SAR, we will;
- Give you a copy of the information in an intelligible form
- Give you a description of the data we hold
- Tell you why we are holding and processing it, and how long we keep it for
- Explain where we got it from, if not from you or your child
- Tell you who it has been, or will be shared with
- Let you know whether any automated decision making is being applied to the data, and any consequence of this
If we cannot provide information to you, we will give you a description of the information we hold and the reason why it cannot be disclosed to you at the time of your request.
Other rights
Individuals also have rights regarding how their personal data is used and kept safe, including the right to:
- Object to the use of personal data if it would cause, or is causing, damage or distress
- Prevent it being used to send direct marketing
- Object to decisions being taken by automated means (by a computer or machine, rather than a person)
- In certain circumstances, have inaccurate personal data corrected, deleted or destroyed, or restrict processing
- Claim compensation for damages caused by a breach of data protection regulations
To exercise any of these rights please contact the Data Protection Officer.
Data accuracy and security
The School will endeavor to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must notify the School at least on an annual basis of any changes to information held about them. Responsibility for changes in information relating to students rests with the parent.
An individual has the right to request that any inaccurate or out-of-date information about them is erased or corrected (subject to certain exemptions and limitations under the Act): please see above.
The School will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to School systems. All School personnel will be made aware of this policy and their duties under Data Protection Law and receive relevant training.
Important Documents
To view our policies and privacy notices regarding GDPR please click the links below.
Queries and complaints
Any comments or queries on this policy should be directed to the Data Protection Officer using the email address: Mr M Tallentire
If an individual believes that the School has not complied with this policy or acted otherwise than in accordance with Data Protection Law, they should raise this with us in the first instance.
Alternatively, you can make a complaint to the Information Commissioners Office:
- Report a concern online at https://ico.or.uk/concerns/
- Call 0303 123 1113
- Or write to: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Contact us
If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our Data Protection Officer;
Michael Tallentire – 01207 266702
Data Protection Officer
South Stanley Infant School
Tyne Road
South Stanley
Co Durham
DH9 6NE
May 2018
