Privacy Notice

Privacy Notice

In accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation (Articles 13 & 14) individuals have the right to be informed about how the school uses any personal data that we hold about them. This privacy notice explains how we collect, store and use personal data about individuals attending and visiting the school.

Under Data Protection legislation, the school is its own data controller and is registered with the Information Commissioner’s Office.

Contact details below:

School Name/Address	Our Lady of the Angels R.C. Primary School
Head teacher/Data Controller	Mrs C. Prosser
Privacy Notice Name:	School Privacy Notice

1. Where have we sourced your information?

Data is collected from a variety of sources to make sure that we can help you in your education and look after you at school. The school collects information about you and your parents/guardians when you enrol at the school. We also collect information at other key times during the school year and may receive information from Local Authorities and other schools or services.

2. What information does the School collect about you?

The School collects and processes a range of information about you. This includes but is not restricted to:

● Personal identifiers and contacts (such as name, gender, date of birth, next of kin, unique pupil number, contact details, e-mail address and home address, school photograph, transport details)

● Characteristics (such as ethnicity, religion, language, free school meal eligibility and immigration status)

● Safeguarding information (such as court orders, looked after children, young carers and professional involvement)

● Details of any support received, including care packages, plans and support providers, additional learning needs (including needs and ranking)

● Medical and administration details (such as doctors information, child health, allergies, medication and dietary requirements)

● School History and attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)

● Assessment and attainment, post 16 courses enrolled and any relevant test results

● Behavioural information (such as exclusions and any relevant alternative provisions put in place)

● Photographs and CCTV images captured on school property

3. How does the School collect this information?

Verbally
Electronically

Paper systems via enrolment and consent forms
3rd parties

Pupil data is essential for the school’s operational use. Whilst the majority of pupil information you provide to us is mandatory, some of it is requested on a voluntary basis. In order to comply with the data protection legislation, we will inform you at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this and we will tell you what you need to do if you do not want to share this information with us.

4. Why does the School process your personal information?

The personal data collected is essential, for the school to fulfil its official functions and meet legal requirements.

We collect and use personal information about pupils and their families:

For identification purposes and to protect student welfare and wellbeing
To support pupil learning and ensure appropriate support is offered at every stage of your child’s education e.g. at transition points
To monitor and report on pupil progress
To provide appropriate pastoral care
To assess the quality of our services
To keep children safe (food allergies, or emergency contact details)
To publicise activities, administer trips and announce achievements
To comply with the law and legal obligations and the law regarding data sharing and to meet the statutory duties placed upon us (Department for Education and Welsh Government data collection)
To carry out research, planning, checking and improving services

5. We can process this category of information because:

Under UK GDPR (Article 6) we must have a legal basis to process personal information. The school relies on the following:

a. Consent: the individual has given clear consent to process their personal data for a specific purpose. When you give your consent for your child’s information to be held and/or shared for any purpose, you can withdraw that consent at any time, by contacting the Head teacher named above. Any processing undertaken before consent was withdrawn will not be affected.

c. Legal obligation: the processing is necessary to comply with the law (not including contractual obligations). We will share information where we have legal basis to do so, otherwise we will ask for consent.

d. Vital interests: the processing is necessary to protect someone’s life.

e. Public task: the processing is necessary to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

f. Legitimate interests: but only in certain circumstances.

Some of the personal information we process can be more sensitive in nature and therefore requires a higher level of protection. The UK GDPR (Article 9) refers to the processing of this data as ‘special categories of personal data’ and include personal information revealing : race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, genetic data, biometric data, health data, data concerning a person sex life, sexual orientation.

If we process this personal data our legal basis can only be lawful if one of the below applies together with any associated DPA2018 Schedule 1 conditions where required.

The school relies on the following:

(a) Explicit consent
(b) Employment, social security and social protection (if authorised by law)
(c) Vital interests

(e) Made public by the data subject

(f) Legal claims or judicial acts

(g) Reasons of substantial public interest (with a basis in law)

(h) Health of social care (with a basis in law)

(i) Public health (with a basis in law)
(j) Archiving, research and statistics (with a basis in law)

6. Who has access to your information?

We do not share information about pupils with any third party without consent unless the law and our policies allow us to do so. Where it is legally required, or necessary (and it complies with data protection law) we share personal information about students with such bodies as:

Department for Education on a statutory basis. As outlined within the Education Act 1996 and associated Welsh Government regulations.

Welsh Government - The Welsh Government receives information on pupils directly from schools and local authorities normally as part of statutory data collections. These are as follows:

Post 16 data collection (pupil in National Curriculum Year 12 and above
Pupil Level Annual School Census(PLASC)
Educated Otherwise than at School (EOTAS) pupil level data collection
National Data collection (NDC)
Attendance data collection (Primary and Secondary
In addition, the Welsh Government also receives data on results of approved external qualifications (e.g. GCCE and A Level awards) from Awarding bodies (e.g. WJEC)
Welsh Government’s Hwb system for pupils

The WG Privacy Notice can be found by clicking the following. 220706-privacy-notice-for-statutory-pupil-data-collections-v4.pdf (gov.wales)

The Welsh Government, Office of National Statistics (ONS) and TCBC uses this personal information for research (carried out in a way that ensures individual children and young people cannot be identified) and for statistical purposes, to inform, influence and improve education policy and to monitor the performance of the education service as a whole. Examples of the sort of statistics produced can be viewed at www.wales.gov.uk/statistics.

Pupils family and representatives

Internally with schools departments

School social media sites and press if we have consent to do so

Torfaen Council Departments including professional advisers and consultants including Social Care, Families First, Legal and Insurance, Electoral, Internal Auditors, statistical information and research, SPACE Wellbeing Project

Other Educational establishments and examining bodies such as WJEC, Qualifications Wales, UCAS( either directly or via WG )

Coleg Gwent and Coleg Cymoedd where pupils attend after leaving us

HWB (and additional services include Google G Suite, Microsoft, Adobe Spark, Just2Easy via CDSM Software)

Education Achievement Service (EAS)

Ofsted Estyn

Welsh / English Government Health Services

Health Authority for Health Care Programmes

Police Services, Ambulance Services, Courts

Careers Wales/ Youth Support Services once pupils reach the age of 13 under section 507B of the Education Act 1996.

Careers Wales/ Youth Support Services once pupils reach the age of 16 under section 507B of the Education Act 1996

Websites to support learning – contact school for details

Apps to enhance pupil learning – contact school for details

Evolve (managing education visits)

Shared Resource Service (SRS) schools IT provider

7. Is the information transferred out of the UK?

We may share personal information about you with international third parties outside of the UK. Where we transfer your personal information to a country or territory outside the UK, we will do so in accordance with UK data protection law and ensure UK GDPR Standard Contractual Clauses and International Data Transfer Agreements are in place.

8. How does the School protect and store your information?

School takes the security of your data seriously. We have and are developing further internal policies to ensure data it processes is not lost, accidentally destroyed, misused or disclosed and is not accessed except by its employees in the performance of their duties. To ensure information is kept safe we have the following controls/limitations in place:

the information will not be used for any purpose other than those stated in this notice
the information will be held within secure systems/locations in the school's management information system and in other IT systems, with appropriate levels of security, that comply with relevant data protection legislation
the information will only be shared for lawful purposes and if transferred will be with an appropriate level of security that complies with relevant data protection legislation in accordance with DPA2018 and the UK GDPR.
When stored it will be in secure lockable locations if paper based and password protected if in electronic format
the information will only be held for the periods agreed in Schools Retention Schedule and follow organisational and Local Authority standards in this area, after which it will be destroyed. The Retention Schedule is available on request
Where the school engages third parties to process personal data on its behalf, they do so based on written instructions. These third parties are also under a duty of confidentiality and are obliged to implement appropriate measures to ensure the security of data

9. Are we making automated decisions/profiling with your information?

No, we are not.

Your rights

Parents and pupils have rights regarding personal data. Individuals have a right to make a “subject access request” to gain access to personal information the school holds about them. The law states that by the age of 13 children have enough maturity to understand their rights and to make an individual right request themselves if they wish. A parent would be expected to make a request on a child’s behalf if the child is younger. The Data Protection Act 2018 and UK GDPR laws give individuals additional rights in respect of personal information held by the school.

These rights include:

The right to be informed

The right of access

The right to rectification

The right to erasure - in certain circumstances. Whilst the child is in school, there may be data that you would not erase if requested as this could hamper your ability to perform your public task

The right to restrict processing

The right to data portability

The right to object

Rights in relation to automated decision making and profiling.

You can also request an “education record request” which will give you access to curricular and education records held and processed on behalf of the governing body of the school. (Education Pupil Information (Wales) Regulations 2011.

If you would like to exercise any of these rights, please contact the Head teacher in writing who will respond within one calendar month. You may also contact the Information Commissioner (ICO), however, the ICO (Wales) cannot make a decision unless you have exhausted the complaints/internal review procedure offered by the school and Local Authority.

Please do not hesitate to contact, Ceri Prosser at Our Lady of the Angels RC Primary School or Data Protection Officer, Torfaen County Borough Council, Civic Centre, Pontypool, NP4 6YB. dpa@torfaen.gov.uk . The Information Commissioner’s Office (Wales) can be contacted at: The Information Commissioner’s Office (Wales), 2^nd Floor, Churchill House, Churchill Way, Cardiff, CF10 2HH. Telephone 0330 414 6421 e-mail Wales@ico.org.uk

Interactive Bar

Google Services

Search

Translate

Log In