Privacy Notice

How we process data about our students (Parent Version)

Under data protection law, individuals have a right to be informed about how we use any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about our students.

We, Thurston Community College, are the ‘data controller’ for the purposes of data protection law.

The Data Protection Officer for the school can be contacted at data.protection@schoolschoice.org.

Why do we collect and use pupil information?

In law, we collect and use pupil information under the General Data Protection Regulations (GDPR) and UK law, including:

Article 6 and Article 9 of the GDPR - processing is necessary for the performance of a task carried out in the public interest.
Education Act 1996.
Regulation 5 of the Education (Information About Individual students) (England) Regulations 2013.

We use pupil data:

to support pupil learning and progression.
to monitor and report on pupil progress.
to provide appropriate pastoral care and safeguard students.
to assess the quality of our services.
to comply with the law regarding data sharing.

The categories of pupil information that we collect include:

Personal information (such as name, unique pupil number and address)
Contact information (names and contact details for parents, carers)
Characteristics (such as ethnicity, languages spoken at home)
Attendance information (such as sessions attended, number of absences and reasons for absence)
Assessment information (such as termly subject marks, exam results)
Medical information and details of any support received, including care packages and support plans
Behaviour and achievement information (such as commendations, detentions, exclusions)
Post-16 learning information (including courses studied and learning hours)
Information about safeguarding concerns
Photographs and moving images
CCTV images captured in school
Biometric data for accessing the school canteen

We may also hold data about students that we have received from other organisations, including other schools, local authorities and the Department for Education.

Legal basis for using data

We only collect and use students’ personal data when the law allows us to. Most commonly, we process it where:

We need to comply with the law.
We need it to perform a task in the public interest (to provide our students with an education).

Sometimes, we may also process students’ personal data in situations where:

Students (or parents/carers) have given consent for us to use it in a certain way.
We need to protect the individual’s vital interests (or someone else’s interests).

Collecting pupil information

Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation (GDPR), we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.

Where we have obtained consent to use students’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

Storing pupil data

We hold pupil data until the pupil reaches the age of 25. Where there have been safeguarding concerns or special educational needs, the retention of pupil data will be reviewed at this point and decisions about ongoing retention will be made on an individual basis.

Who do we share pupil information with?

We routinely share pupil information with:

educational institutions that students attend after leaving us
the local authority (for admissions, exclusions etc.)
the Department for Education (DfE)
the NHS, including CAMHS (for referrals, vaccinations etc)
the Police and Social Services (where there are safeguarding concerns)
exam boards and other assessment bodies

We also share personal data with third party organisations which provide services to us. This data is only shared where it is essential for the service to be provided. We currently provide pupil level data for the following purposes:

Through our School Information Management System (SIMS) and our assessment module (GO4Schools)
to support learning through curriculum products, e.g. Kerboodle, Hegarty Maths, etc.

National Pupil Database

We are required to provide information about students to the Department for Education as part of statutory data collections such as the school census.

Some of this information is then stored in the National Pupil Database (NPD), which is owned and managed by the Department and provides evidence on school performance to inform research.

The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.

The Department for Education may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.

For more information, see the Department’s webpage on how it collects and shares research data research data.

You can also contact the Department for Education with any further questions about the NPD.

Youth Support Services

Once our students reach the age of 13, we are legally required to pass on certain information about them to the local authority, as it has legal responsibilities regarding the education or training of 13-19 year-olds.

This information enables it to provide youth support services, post-16 education and training services, and careers advisers.

Parents/carers, or students once aged 16 or over, can contact our data protection officer to request that we only pass the individual’s name, address and date of birth.

Learner Record Service

Once our students reach the age of 14, we will pass on certain information used by the Skills Funding Agency, an executive agency of the Department for Education (DfE), to issue a Unique Learner Number (ULN), and to create a Personal Learning Record. For more information about how your information is processed and shared refer to the Extended Privacy Notice available on LRS - Privacy Notice.

Transferring data internationally

Where we transfer personal data to a country or territory outside the European Economic Area (EEA), we will do so in accordance with data protection law.

Your rights: How to access personal information we hold about you

You can find out if we hold any personal information about you, and how we use it, by making a ‘subject access request’, as long as we judge that you can properly understand your rights and what they mean.

Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.

If we do hold information about you, we will:

Give you a description of it.
Tell you why we are holding and using it, and how long we will keep it for.
Explain where we got it from, if not from you or your parents.
Tell you who it has been, or will be, shared with.
Let you know if we are using your data to make any automated decisions (decisions being taken by a computer or machine, rather than by a person).
Give you a copy of the information.

You may also ask us to send your personal information to another organisation electronically in certain circumstances.

If you want to make a request, please contact our data protection officer.

Your other rights over your data

You have other rights over how your personal data is used and kept safe, including the right to:

Say that you don’t want it to be used if this would cause, or is causing, harm or distress.
Stop it being used to send you marketing materials.
Say that you don’t want it used to make automated decisions (decisions made by a computer or machine, rather than by a person).
Have it corrected, deleted or destroyed if it is wrong, or restrict our use of it.
Claim compensation if the data protection rules are broken and this harms you in some way.

How we process data about our students (Student Version)

This notice might be difficult for you to understand. You can ask your parents or another adult such as your teacher to help you understand it. It is about how we use information about you and what we do with it. We call this information about you ‘personal data’ or ‘personal information.’

The Data Protection Officer for the school can be contacted at data.protection@schoolschoice.org. This privacy notice was updated on 19 October 2022.

In this notice, ‘we’ and ‘us’ means the Thurston Community College. ‘You’, ‘data subject’ and ‘students’ includes children who have applied to but not yet joined the school and former students.

The categories of student information that we process include:

personal identifiers and contacts (such as name, unique student number, contact details and address)
characteristics (such as ethnicity and language)
safeguarding information (such as court orders and professional involvement)
special educational needs (including the needs and ranking)
medical and administration (such as doctors’ information, child health, dental health, allergies, medication and dietary requirements)
attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
assessment and attainment (such as test results)
behavioural information (such as exclusions and any relevant alternative provision put in place)
Information about free school meal and student premium eligibility
Information for catering management purposes (e.g. whether you have school dinners and how often)
Information about biometric recognition systems (such as cashless catering)

We may also use photographs of you, including images captured by CCTV. More details about this are in our photograph policy and our combined data protection and freedom of information policy.

Why we collect and use student information

The personal data collected is essential, for us to fulfil our official functions and meet legal requirements.

We collect and use student information, for the following purposes:

to support your learning
to keep you safe (e.g. food allergies or emergency contact details)
to monitor and report on your progress
to provide appropriate care for you
to support research related to the school’s aims
to assess the quality of our services
to meet the statutory duties placed on us by the Department for Education (DfE)

Use of your personal data in automated decision making and profiling

We don’t currently put your personal information through any automated decision making or profiling process. This means we don’t make decisions about you using only computers without any human involvement.

If this changes in the future, we will update this notice in order to explain the processing to you, including your right to object to it.

Our lawful basis for using your personal data

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing student information are:

for purposes (a), (c), (d) & (f) the legal basis of ‘public task’: collecting the data is necessary to perform tasks that we are required to perform as part of our statutory function
for purpose (b) the legal basis of ‘vital interests’: to keep children safe
for purpose (e) the legal basis of ‘consent’: the data subject has given consent to the processing of their personal data for one or more specific purposes
for purpose (g) the legal basis of ‘legal obligation’: data collected for DfE census information

the Education Act 1996 s29(3)
Section 537A of the Education Act 1996
the Education (School Performance Information) (England) Regulations 2007
regulations 5 and 8 School Information (England) Regulations 2008
the Education (Pupil Registration) (England) (Amendment) Regulations 2013

In addition, concerning any special category data:

In the case of ethnicity and biometric information: condition (a) of GDPR Article 9 (2): the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in GDPR Article 9 (1) may not be lifted by the data subject.

How we collect student information

When we collect personal information on our forms, we will make it clear whether there is a legal requirement for you / your parents to provide it, whether there is a legal requirement on the school to collect it. If there is no legal requirement then we will explain why we need it and what the consequences are if it is not provided.

If you had a previous school, we will also obtain information from them, usually via secure file transfer.

When we give your information to others

We will not give information about our students to anyone without your consent unless the law and our policies allow us to do so. If you want to receive a copy of the information we hold about you, please contact the Data Protection Lead at your school.

Once our students reach the age of 13, the law requires us to pass on certain information to the provider of youth support services in their area. This will be your local authority. They have responsibilities in relation to the education or training of 13-19 year olds. We may also share certain personal data relating to children aged 16 and over with post-16 education and training providers in order to secure appropriate services for them. A parent / guardian can request that only their child’s name, address and date of birth be passed to the provider of youth support services in their area by informing the office at their child’s school. This right is transferred to the child once they reach the age of 16. For more information about services for young people, please go to your local authority’s website.

We are required to share information about our students with the Department for Education (DfE) either directly or via the local authority for the purpose of data collections, under:

Section 537A of the Education Act 1996
the Education Act 1996 s29(3)
the Education (School Performance Information) (England) Regulations 2007
regulations 5 and 8 School Information (England) Regulations 2008
the Education (Pupil Registration) (England) (Amendment) Regulations 2013

All data is transferred securely and held by DfE under a combination of software and hardware controls, which meet the current government security policy framework.

To find out more about the student information we share with the Department, for the purpose of data collections, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

Much of the data about students in England goes on to be held in the National Pupil Database (NPD). The NPD is owned and managed by the Department for Education and contains information about students in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

To find out more about the NPD, go to National student database: user guide and supporting information.

The law allows the Department to share students’ personal data with certain third parties, including:

schools
local authorities
researchers
organisations connected with promoting the education or wellbeing of children in England
other government departments and agencies
organisations fighting or identifying crime

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

To contact DfE: https://www.gov.uk/contact-dfe

We will also normally give information about you to your parents or your main carer. Where appropriate, we will listen to your views first. We will also take family circumstances into account, in particular where a court has decided what information a parent is allowed to have.

We may also disclose your personal data to:

Your new school if you move schools
The local authority (to ensure that they can conduct their statutory duties under the Schools Admissions Code, including conducting Fair Access Panels)
Professionals providing services connected with SEND (special educational needs or disabilities) support
School nurse
School counsellor
CAMHS (Child and Adolescent Mental Health Service)

The information disclosed to these people / services may include sensitive personal information (special category data) about you. Usually this means information about your health and any special educational needs or disabilities which you have. We do this because these people need the information so that they can support you.

Our disclosure of your personal data is lawful for the following reasons:

The school is under a legal obligation to disclose the information or disclosing the information is necessary for us to meet legal requirements imposed upon us such as our duty to look after our students and protect them from harm.
It is necessary for us to disclose your information for the purposes of our functions in providing schooling. This is a function which is in the public interest.
There is a substantial public interest in disclosing your information because it is necessary to keep our students safe from harm.
We may not need consent to disclose your information. However, if at any time it appears to us that we would need consent then we will ask before a disclosure is made.

It is in your interests for your personal information to be passed to these people or services. If we need consent to pass on your information, we will ask you for consent once we think that you can understand what we are asking. This is because the law requires us to ask you if you can understand. Normally, we involve your parents too. By law we won’t need their consent if you can give it, but parents like to be involved because it is part of looking after you. Before you are old enough to understand we will ask your parents to consent for you.

If we transfer personal information to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

How long we keep your information

We only keep your information for as long as we need to or for as long as the law requires us to. Most of the information we have about you will be in your student file. We usually keep these until your 25th birthday unless you move to another school in which case we send your file to your new school. We have a policy which explains how long we keep information. It is called a records retention policy and you can find it on the school’s website.

Your rights

You have these rights:

You can ask us for a copy of the information we have about you
You can ask us to correct any information we have about you if you think it is wrong
You can ask us to erase information about you (although we may have good reasons why we cannot do this)
You can ask us to limit what we are doing with your information
You can stop your information being used to send you marketing materials
You can object to decisions being taken by automated means
You can object to what we are doing with your information if it is likely to cause, or is causing, damage or distress
You can ask us to transfer your information to another organisation in a format that makes it easy for them to use.

If you want to use your rights, for example, by requesting a copy of the information which we hold about you, please contact your school’s Data Protection Lead in the first instance.

Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our data protection officer.

Alternatively, you can make a complaint to the Information Commissioner’s Office (ICO):

Report a concern online at https://ico.org.uk/concerns/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data protection officer at data.protection@schoolschoice.org.

How we process data about parents

Under data protection law, individuals have a right to be informed about how Thurston Community College uses any personal data we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about parents and carers.

The Data Protection Officer for the school can be contacted at data.protection@schoolschoice.org. This privacy notice was updated on 19 October 2022.

The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Contact details and contact preferences (such as your name, address, email address and telephone numbers)
Bank details
Details of your family circumstances
Details of any safeguarding information including court orders or professional involvement
Records of your correspondence and contact with us
Details of any complaints you have made

We may also collect, use, store and share (when appropriate) information about you that falls into "special categories" of more sensitive personal data. This includes, but is not restricted to, information about:

Any health conditions you have that we need to be aware of
Photographs and CCTV images (more details about this are in our data protection and freedom of information policies, which is available on the school’s website)

We may also hold data about you that we have received from other organisations, including other schools and social services.

Why we use this data

We use this data to:

Report to you on your child’s attainment and progress
Keep you informed about the running of our schools (such as emergency closures) and events
Process payments for services and clubs
Provide appropriate pastoral care
Protect pupil welfare
Administer admissions waiting lists
Assess the quality of our services
Carry out research
Comply with our legal and statutory obligations

Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information promoting events, campaigns, charitable causes or services that may be of interest to you. You can withdraw consent or ‘opt out’ of receiving these by contacting the data protection lead at your child’s school - the school office should be able to provide you with their contact details – or the school’s data protection officer.

Use of your personal data in automated decision making and profiling

We do not currently process any personal data through automated decision making or profiling. If this changes in the future, we will amend any relevant privacy notices in order to explain the processing to you, including your right to object to it.

Our lawful basis for using this data

Our lawful bases for processing your personal data for the purposes listed above are as follows:

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing your information are:

for purposes (a), (e) & (f) the legal basis of ‘legal obligation’ – we need to process data to meet our responsibilities under law as set out here:

for purpose (a): The Education (Pupil Information) (England) Regulations 2005
for purpose (e): Keeping children safe in education – Statutory guidance for schools and colleges
for purpose (f): The Schools Admissions Code

for purposes (b), (d) & (g) the legal basis of ‘public task’: collecting the data is necessary to perform tasks that we are required to perform as part of our statutory function
for purpose (c) the legal basis of ‘contract’: we need to process personal data to fulfil a contract with you or to help you enter into a contract with us
for purpose (h) the legal basis of ‘consent’: the data subject has given consent to the processing of their personal data for one or more specific purposes

For ‘special category’ data, we only collect and use it when we have both a lawful basis, as set out above, and one of the following conditions for processing as set out in data protection law:

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

Collecting this information

While the majority of information we collect about you is mandatory, there is some information that can be provided voluntarily.

Whenever we seek to collect information from you, we will make it clear whether you must provide this information (and if so, what the possible consequences are of not complying), or whether you have a choice.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Your children
Police forces, courts, tribunals

How we store this data

We keep personal information about you while your child is attending one of our schools. We may also keep it beyond their attendance at one of our schools if this is necessary. Our records retention policy sets out how long we keep information about parents and carers, it is available on the school’s website.

Data sharing

We do not share information about you with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with data protection law), we may share personal information about you with:

Local authorities – to meet our legal obligations to share certain information, such as safeguarding concerns and information about exclusions
Government departments or agencies
Our regulator, Ofsted
Suppliers and service providers (such as ParentPay, Go4Schools, SchoolComms and SIMS) to enable them to provide the service we have contracted them for
Financial organisations
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts and tribunals

Transferring data internationally

If we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

Your rights

How to access personal information that we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will (subject to any exemptions that apply):

Give you a description of it
Tell you why we are holding and processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact our data protection officer.

Your other rights regarding your data

Under data protection law, you have certain rights regarding how your personal data is used and kept safe. for example, you have the right to:

Object to our use of your personal data
Prevent your data being used to send direct marketing
Object to the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)
In certain circumstances, have inaccurate personal data corrected, deleted or destroyed, or restrict processing
In certain circumstances be notified of a data breach
Make a complaint to the Information Commissioner’s Office (ICO)
Claim compensation for damages caused by a breach of the data protection regulations To exercise any of these rights, please contact our data protection officer.

Complaints

We take any complaints about our collection and use of personal information very seriously.

To make a complaint, please contact our data protection officer.

Alternatively, you can make a complaint to the Information Commissioner’s Office (ICO):

Report a concern online at https://ico.org.uk/concerns/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data protection officer at data.protection@schoolschoice.org.

How we process data about volunteers (including governors)

This privacy notice explains how we collect, store and use personal data about parents and carers.

The Data Protection Officer for the school can be contacted at data.protection@schoolschoice.org. This privacy notice was updated on 19 October 2022.

The personal data we hold

We process data relating to those volunteering within our school. Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Contact details
References
Evidence of qualifications
Employment details
Information about business and pecuniary interests

We may also collect, store, use and share (where appropriate) information about you that falls into “special categories” of more sensitive personal data. This may include but is not restricted to:

Information about any health conditions you have that we need to be aware of
Information about disability and access requirements
Information about Protected Characteristics as defined by the Equality Act 2010 (such as racial or ethnic origin, religious beliefs and gender identification)
Photographs and CCTV images captured (more details about this are in our data protection and freedom of information policies)

We may also collect, use, store and share (when appropriate) information about criminal convictions and offences.

We may also hold data about you that we have received from other organisations, including other schools and social services, and the Disclosure and Barring Service (DBS) in respect of criminal offence data.

Why we use this data

The purpose of processing this data is to support the school to:

Establish and maintain effective governance
Meet statutory obligations for publishing and sharing governors’ and schoolees’ details
Facilitate safer recruitment, as part of our safeguarding obligations towards pupils
Undertake equalities monitoring
Ensure that appropriate access arrangements can be provided for volunteers who require them
Meet our health and safety obligations, so that we know who to contact if there is an emergency whilst you are volunteering with us

Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information promoting events, campaigns, charitable causes or services that may be of interest to you. You can withdraw consent or ‘opt out’ of receiving these by contacting the data protection lead at the school - the school office should be able to provide you with their contact details – or the school’s data protection officer.

Use of your personal data in automated decision making and profiling

Our lawful basis for using this data

Our lawful bases for processing your personal data for the purposes listed above are as follows:

for purpose (a) the legal basis of ‘public task’: collecting the data is necessary to perform tasks that we are required to perform as part of our statutory function
for purposes (b), (c), (d) and (e) the legal basis of ‘legal obligation’: we need to process data to meet our responsibilities under law as set out here:

for purpose (c): Keeping children safe in education - Statutory guidance for schools and colleges
for purposes (d) and (e): The Equality Act 2010

for purpose (f) the legal basis of ‘vital interests’: we will use this personal data in a life-or-death situation

Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent, and explain how you go about withdrawing consent if you wish to do so.

For ‘special category’ data, we only collect and use it when we have both a lawful basis and one of the following conditions for processing as set out in data protection law:

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

Collecting this information

While the majority of the information we collect from you is mandatory, there is some information that you can choose whether or not to provide to us.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Police forces, courts, tribunals

How we store this data

We keep personal information about you while you volunteer with us. We may also keep it beyond your volunteering with us if this is necessary. Our records retention policy sets out how long we keep information about governors and other volunteers. It is available on the school’s website.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your personal data securely when we no longer need it.

Data sharing

We do not share information about you with any third party without your consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about you with:

Government departments or agencies
Local authorities – to meet our legal obligations to share certain information, such as safeguarding concerns
Ofsted
Our auditors
Health authorities
Service providers (such as Schools’ Choice and GovernorHub, to enable them to provide the service we have contracted them for)
Professional advisers and consultants
Employment and recruitment agencies
The Disclosure and Barring Service (DBS)
Police forces, courts and tribunals

Transferring data internationally

If we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

Your rights

How to access the personal information we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we hold information about you, we will (subject to any exemptions that may apply):

Give you a description of it
Tell you why we are holding and processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have a right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact our data protection officer.

Your other rights regarding your data

Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe. You have the right to:

Object to our use of your personal data
Prevent your data being used to send direct marketing
Object to and challenge the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than a person)
In certain circumstances, have inaccurate personal data corrected, deleted or destroyed, or restrict processing
In certain circumstances, be notified of a data breach
Make a complaint to the Information Commissioner’s Office (ICO)
Claim compensation for damages caused by a breach of the data protection regulations

To exercise any of these rights, please contact our data protection officer.

Complaints

We take any complaints about our collection and use of personal information very seriously.

To make a complaint, please contact our data protection officer.

Alternatively, you can make a complaint to the Information Commissioner’s Office (ICO):

Report a concern online at https://ico.org.uk/concerns/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data protection officer at data.protection@schoolschoice.org.

How we process data about job applicants

This privacy notice explains how we collect, store and use personal data about individuals applying for jobs within our school. The Data Protection Officer for the school can be contacted at data.protection@schoolschoice.org. This privacy notice was updated on 19 October 2022.

Successful candidates should refer to our staff privacy notice for information about how their personal data is collected, stored and used.

The personal data we hold

We process data relating to those applying to work within our school. Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Contact details
Copies of right to work documentation
References
Evidence of qualifications
Employment records, including work history, job titles, training records and professional memberships

We may also collect, use store and share (when appropriate) information about you that falls into “special categories” of more sensitive personal data. This includes, but is not restricted to:

Information about race, ethnicity, religious beliefs, sexual orientation and political opinions
Information about disability and access requirements
Photographs and CCTV images (more details about this are in our combined data protection and freedom of information policy, which is on the school’s website)

We may also collect, use, store and share (when appropriate) information about criminal convictions and offences.

We may also hold data about you that we have received from other organisations, including other schools and social services, and the Disclosure and Barring Service in respect of criminal offense data.

Why we use this data

We use the data listed above to:

Enable us to establish relevant experience and qualifications
Facilitate safer recruitment, as part of our safeguarding obligations towards pupils
Enable equalities monitoring
Ensure that appropriate access arrangements are provided for candidates that require them

Our lawful basis for using this data

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing staff information are:

for purposes (a), (b), (c) and (d) the legal basis of ‘legal obligation’: we need to process data to meet our responsibilities under law as set out here:

for purposes (a) and (b): Keeping children safe in education - Statutory guidance for schools and colleges
for purposes (c) and (d): The Equality Act 2010

Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent and explain how you go about withdrawing consent if you wish to do so.

For ‘special category’ data, we only collect and use it when we have both a lawful basis and one of the following conditions for processing as set out in data protection law:

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offense data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

Collecting this data

While the majority of the information we collect about you is mandatory, there is some information that can be provided voluntarily.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Police forces, courts, tribunals

How we store this data

We keep personal information about you during the application process. We may also keep it beyond this if this is necessary. Our records retention policy sets out how long we keep information. It is available on the school’s website.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We will dispose of your personal data securely when we no longer need it.

Data sharing

We do not share information about you with any third party without your consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with data protection law), we may share personal information about you with:

The Disclosure and Barring Service (DBS) - for the purposes of carrying out checks on your suitability for work with children
Local authorities – to meet our legal obligations to share certain information
The Department for Work and Pensions (DWP) – if you are applying under the Kickstart Scheme, which provides funding to employers to create job placements for 16 to 24 year olds on Universal Credit, we will provide them with your basic details so that they can confirm your eligibility for the scheme and as evidence of your job hunting. Our legal basis for sharing the information is that of ‘contract’: we need to process the personal data to fulfil a contract with you or to help you enter into a contract with us.
Suppliers and service providers – to enable them to provide the service we have contracted them for, such as recruitment support
Professional advisers and consultants
Employment and recruitment agencies

Transferring data internationally

If we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

Your rights

How to access the personal information we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will (subject to any exemptions that may apply):

Give you a description of it
Tell you why we are holding and processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have a right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact our data protection officer.

Your other rights regarding your data

Under data protection law, you have certain rights regarding how your personal data is used and kept safe. For example, you have the right to:

Object to our use of your personal data
Prevent your data being used to send direct marketing
Object to and challenge the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than a person)
In certain circumstances, have inaccurate personal data corrected, deleted or destroyed, or restrict processing
In certain circumstances be notified of a data breach
Make a complaint to the Information Commissioner’s Office (ICO)
Claim compensation for damages caused by a breach of the data protection regulations To exercise any of these rights, please contact our data protection officer.

Complaints

We take any complaints about our collection and use of personal information very seriously.

To make a complaint, please contact our data protection officer.

Alternatively, you can make a complaint to the Information Commissioner’s Office (ICO):

Report a concern online at https://ico.org.uk/concerns/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data protection officer at data.protection@schoolschoice.org.

Important

Click HERE for our website privacy policy which covers information collected whilst using our website. The College data protection policy can be found on the Policies page of our website, HERE.