Under UK data protection law, everyone has a right to be informed about how our school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ to individuals explaining how we process their personal data.

This privacy notice explains how we collect, store and use personal data about pupils at our school.  This privacy notice applies as we believe your child is not capable of understanding and exercising their own data protection rights.

Cam Woodfield Infant School, Elstub Lane, Dursley, GL11 6JJ.  (Tel: 01453 543535) is the ‘data controller’ for the purposes of UK data protection law.

 

Why we collect and use pupil information?

 

We use the pupil data:

• to support pupil learning
• to monitor and report on pupil progress
• to provide appropriate pastoral care
• to protect pupil welfare
• to assess the quality of our services
• to comply with the law regarding data sharing

 

We will only use your child’s personal information for the purposes for which we have collected it. If we need to use it for any other reason and that reason is incompatible with the original purpose, we will notify you and explain the legal basis that allows us to do so. 

Please note that we may process your child’s personal information without your knowledge or consent in compliance with the above rules where this is required or permitted by law.

 

The categories of pupil information that we collect, hold and share include:

 

• Personal information (name; unique pupil number; contact details & preferences; date of birth; identification documents)
• Attendance information (such as sessions attended, number of absences and absence reasons)
• Results of internal assessment & externally set tests
• Safeguarding information
• Exclusions / behavioural information
• Pupil & curricular records

 

We may also collect, use, store and share (when appropriate) information about your child that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

 

• Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)
• Relevant medical information
• Special educational needs information
• Photographs taken during the school day

 

We may also hold data about your child that we have received from other organisations, including other schools and local authorities.

 

Automated decision making & profiling

We do not currently process any pupils’ personal data through automated decision-making or profiling. If this changes in the future, we will amend any relevant privacy notices to explain the processing to you, including your right to object to it.

 

Use of your child’s personal data for filtering and monitoring purposes

While your child is in our school, we may monitor their use of our information and communication systems, equipment and facilities(e.g. school computers). We do this so we can: 

• Comply with health and safety, and other legal obligations

• Comply with our policies (e.g. child protection policy, IT acceptable use policy) and our legal obligations

• Keep our network(s) and devices safe from unauthorised access, and prevent malicious software from harming our network(s)

• Protect your child’s welfare

 

 

 

The lawful basis on which we use this information

The school will only process personal data where we have one of 6 lawful bases to do so under data protection law:

• The data needs to be processed so that the school can comply with a legal obligation (personal information; attendance information; assessment information; safeguarding information; exclusions information; pupil & curricular records)
• The data needs to be processed so that the school can fulfil a contract with an individual, or the individual has asked the school to take specific steps before entering into a contract
• The data needs to be processed to ensure the vital interests of the individual eg to protect someone’s life (safeguarding information; personal information)
• The data needs to be processed so that the school , as a public authority, can perform a task in the public interest, and carry out its official functions (personal information; attendance information; assessment information; safeguarding information; exclusions information; pupil & curricular information)
• The data needs to be processed for the legitimate interests of the school or a third party (provided the individual rights & freedoms are not overridden.)
• The parent or carer has freely given consent. Where you have provided us with consent to use your child’s data, you may withdraw this consent at any time. We will make this clear when requesting your consent, and explain how you would go about withdrawing consent if you wish to do so.

For ‘special categories’ of personal data, we will also meet one of the special category conditions for processing, which are set out in the GDPR and Data Protection Act 2018.

 

Collecting pupil information

 

We will only collect and use your child’s information when the law allows us to as detailed above. While the majority of information we collect about your child is mandatory, there is some information that can be provided voluntarily.  In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.

 

Whenever we seek to collect information from you, we make it clear whether you must provide this information (and if so, what the possible consequences are of not complying), or whether you have a choice.

Most of the data we hold about your child will come from you, but we may also hold data about your child from:

• Local authorities

• Government departments or agencies

• Police forces, courts or tribunals

• Other schools or trusts

• Department for Education

 

Storing pupil data

 

We keep personal information about your child while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary to comply with our legal obligations or to meet our regulatory requirements. Our record retention schedule policy sets out how long we keep information about pupils.

 

We have put in place appropriate security measures to prevent your child’s personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. 

We will dispose of your child’s personal data securely when we no longer have a legal requirement to retain it.

 

Who do we share pupil information with?

 

We do not share information about your child with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required or necessary (and it complies with UK data protection law), we may share personal information about your child with:

 

• schools that the pupil’s attend after leaving us
• our local authority
• the Department for Education (DfE)
• Government departments or agencies
• Youth support services provider
• Ofsted
• Suppliers and service providers:
• Financial organisations
• Our auditors
• Survey and research organisations
• Health authorities
• Security organisations
• Health and social welfare organisations
• Professional advisers and consultants
• Charities and voluntary organisations
• Police forces, courts, tribunals

 

The Department for Education (a government department) collects personal data from schools and local authorities via various statutory data collections. We are required to share information about our pupils with the DfE either directly or via our local authority, via various statutory data collections.

The data shared will be in line with Section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013 

The data is transferred securely and held by the Department for Education under a combination of software and hardware controls that meet the current government security policy framework.

The data we share with the DfE is used for a number of purposes, including to:

• Inform funding

• Monitor education policy and school accountability

• Support research

The information shared with the DfE could include:

• Your child’s name and address

• Unique pupil numbers

• Pupil matching reference numbers

• Gender or ethnicity

• Details of any special educational needs (SEN)

• Details of schools attended

• Absence and exclusion information

• Information relating to assessment results

• Information relating to any contact with children’s services

 

 

National Pupil Database (NPD)

 

We are required to provide information about pupils to the DfE as part of statutory data collections such as the school census and early years census.

Some of this information is then stored in the National Pupil Database (NPD), which is owned and managed by the DfE and provides evidence on school performance to inform research.

The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards. 

The DfE may share information from the NPD with third parties, such as other organisations that promote children’s education or wellbeing in England. These third parties must agree to strict terms and conditions about how they will use the data.

For more information, see the DfE’s webpage on how it collects and shares personal data.

You can also contact the Department for Education with any further questions about the NPD.

 

Transferring Data Internationally.

 

We may share personal information about your child with the following international third parties, where different data protection legislation applies:

Other schools or educational establishments

• Government departments or agencies

• Security organisations

• App or cloud server providers

• Filtering and monitoring providers

 

Where we transfer your child’s personal data to a third-party country or territory, we will do so in accordance with UK data protection law.

In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

 

Your Rights.

How to Access Personal Information that we hold about your child

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about your child.

If you make a subject access request, and if we do hold information about your child, we will (subject to any exemptions that apply):

• Give you a description of it

• Tell you why we are holding it, how we are processing it, and how long we will keep it for

• Explain where we got it from, if not from you

• Tell you who it has been, or will be, shared with

• Let you know whether any automated decision-making is being applied to the data, and any consequences of this

• Give you a copy of the information in an intelligible form

You may also have the right for your child’s personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact us (details below).

 

Your Rights to your Child’s Educational Record

Parents, or those with parental responsibility, also have the right to access their child’s educational record.

There are certain circumstances in which this right can be denied, such as if releasing the information might cause serious harm to the physical or mental health of the pupil or another individual, or if it would mean releasing exam marks before they are officially announced.

To make a request, please contact us (details below)

 

Your Other Rights concerning your Child’s Data

Under UK data protection law, you have certain rights regarding how your child’s personal data is used and kept safe. For example, you have the right to:

• Object to our use of your child’s personal data

• Object to the processing of your child’s personal data that is likely to cause, or is causing, damage or distress

• Prevent your child’s data being used to send direct marketing

• Object to and challenge the use of your child’s personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)

• In certain circumstances, have inaccurate personal data corrected or blocked

• In certain circumstances, have the personal data we hold about your child deleted or destroyed, or restrict its processing

• Withdraw your consent, where you previously provided it for the collection, processing and transfer of your child’s personal data for a specific purpose

• In certain circumstances, be notified of a data breach

• Make a complaint to the Information Commissioner’s Office

• Claim compensation for damages caused by a breach of the data protection regulations 

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

• Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task

• Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests

• Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent

See information on types of lawful basis above.

To exercise any of these rights, please contact us (see ‘Contact us’ below).

 

Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concerns about our data processing, please raise this with us in the first instance. You can make a complaint to us at any time by contacting Jane Law, the Headteacher, (head@woodfield.gloucs.sch.uk )

Alternatively, you can make a complaint at any time to the Information Commissioner’s Office:

• Report a concern online at https://ico.org.uk/make-a-complaint/

• Call 0303 123 1113

• Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

 

Contact us

If you have any questions or concerns, or would like more information about anything mentioned in this privacy notice, please contact our data protection officer:

 

• Jane Law (Head Teacher) head@woodfield.gloucs,sch.uk