Privacy Notice

Whitchurch Primary School GDPR Privacy Notice

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them.

This privacy notice explains how we collect, store and use personal data about pupils.

We, Whitchurch Primary School, are the ‘data controller’ for the purposes of data protection law.

The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about pupils includes, but is not restricted to:   

• Contact details, contact preferences, date of birth, identification documents
• Results of internal assessments and externally set tests
• Pupil and curricular records
• Characteristics, such as ethnic background, eligibility for free school meals, or special educational needs
• Exclusion information
• Details of any medical conditions, including physical and mental health
• Attendance information
• Safeguarding information
• Details of any support received, including care packages, plans and support providers
• Photographs

We may also hold data about pupils that we have received from other organisations, including other schools, local authorities and the Department for Education.

Why we collect and use this information

We use your personal information to:

• Support pupil learning
• Monitor and report on pupil progress
• Moderate teacher assessment judgements
• Provide appropriate pastoral care and support services
• Assess the quality of our services
• Comply with the law regarding data sharing
• Support or improve educational provision
• Ensure no children are missing education
• Support children at risk of permanent exclusion
• Support the primary, secondary and in-year admissions process
• Safeguard children and young people

The lawful basis on which we use this information

We collect and use pupil information under section 537A of the Education Act 1996, and section 83 of the Children Act 1989. We also comply with Article 6(1)(c) and Article 9(2)(b) of the General Data Protection Regulation (GDPR).

If we need to collect special category (sensitive) personal information, we rely upon reasons of substantial public interest (equality of opportunity or treatment).

We only collect and use pupils’ personal data when the law allows us to. Most commonly, we process it where:

• We need to comply with a legal obligation
• We need it to perform an official task in the public interest

Less commonly, we may also process pupils’ personal data in situations where:

• We have obtained consent to use it in a certain way
• We need to protect the individual’s vital interests (or someone else’s interests)

If there is processing or sharing that relies on your consent, we will make this clear to you and ensure we seek your consent.  Where we have obtained consent to use pupils’ personal data, this consent can be withdrawn at any time.

Collecting this information

While the majority of information we collect about pupils is mandatory, there is some information that can be provided voluntarily.

Whenever we seek to collect information from you or your child, we make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.

How we store this data

We keep personal information about pupils while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary in order to comply with our legal obligations. We keep information on pupils in line with Oxfordshire Records Management guidance.

How long your personal data will be kept

We retain personal data only for a legitimate and lawful reason and only for so long as necessary or required by law.

In accordance with the GDPR, the school does not store personal data indefinitely; data is only stored for as long as is necessary to complete the task for which it was originally collected. We have a data retention schedule, based on guidance from the DFE and the IRMS tool kit for schools. For more information on record retention please visit http://irms.org.uk/page/SchoolsToolkit or see our records management policy.

Who we share your personal information with

• Department for Education (DfE) (statutory for school funding and educational attainment policy and monitoring) and other government agencies and local authorities as required (e.g. to resolve funding queries)
• Oxfordshire County Council teams working to improve outcomes for children and young people
• Commissioned providers of local authority services (such as education services)
• Schools that you attend after leaving us
• Local forums with schools and OCC representatives which support in-year fair access processes and support managed moves between schools
• Local multi-agency forums which provide SEND advice, support and guidance
• Partner organisations which may include Police, school nurses, doctors and mental health workers and Oxfordshire Community Health NHS Foundation Trust
• Schools in our local collaboration, to enable the moderation of pupil assessment outcomes, to support collaborative working through joint analysis, and ensure children continue to receive appropriate education provision
• Oxfordshire County Council has to share information with external moderators (teachers with recent relevant experience) of end of key stage assessments, to meet statutory requirements from the Standards & Testing Agency (STA)
• Third-party providers of information services (such as assessment packages) where consent has been given
• Contracted providers of services (such as school photographers and catering providers) where consent has been given.

Whitchurch Primary School will not share your personal information with any third parties without your consent, unless the law and our policies allow us to do so.

Where the school outsources data to a third party processor, the same data protection standards that Whitchurch Primary School upholds are imposed on the processor.

We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.

We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.

National Pupil Database

We are required to provide information about pupils to the Department for Education as part of statutory data collections such as the school census.

Some of this information is then stored in the National Pupil Database (NPD), which is owned and managed by the Department and provides evidence on school performance to inform research.

The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.

The Department for Education may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.

Transferring data internationally

Where we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

What are your rights?

Parents and pupils have the following rights in relation to the processing of their personal data.

You have the right to:

• Be informed about how Whitchurch Primary School uses your personal data.
• Request access to the personal data that Whitchurch Primary School holds.
• Request that your personal data is amended if it is inaccurate or incomplete.
• Request that your personal data is erased where there is no compelling reason for its continued processing.
• Request that the processing of your data is restricted.
• Object to your personal data being processed.

Where the processing of your data is based on your consent, you have the right to withdraw this consent at any time.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

If you have a concern about the way Whitchurch Primary School and/or the DfE is collecting or using your personal data, you can raise a concern with the Information Commissioner’s Office (ICO). The ICO can be contacted on 0303 123 1113, Monday-Friday 9am-5pm. Where can you find out more information?

Data Collection requirements

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

For more information about the department’s data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

If you would like to discuss anything in this privacy notice, please contact:

The School Office

Whitchurch Primary School Office

Eastfield Lane

Whitchurch On Thames

South Oxfordshire

RG8 7EJ

Office telephone Number : 0118 9842347

Data Protection Officer: (to be confirmed)

This notice is based on the Department for Education’s model privacy notice for pupils, amended for parents and to reflect the way we use data in this school