Federation of West Leigh Infant School and Backwell C of E Junior School
Privacy Notice for Pupils and Parents
About this Privacy Notice
West Leigh Infant School and Backwell C of E Junior School is part of Lighthouse Schools Partnership and is covered by the Trust’s Data Protection Policy.
Individuals have a legal right to be informed about how we use their personal information. This Privacy Notice explains how we collect, store and use personal information. It is intended for pupils and parents (including carers or guardians who we refer to in this privacy notice as ‘parents’) and we encourage all to read it. We have produced a separate privacy notice for the school’s workforce and a shorter, simpler notice for pupils themselves.
Our aim is to always provide clear information about the personal information we are using and why we are using it. We have tried to keep the language in this privacy notice as simple as possible, however if anything is unclear or if you have any concerns then please contact the School Office.
This is the school’s main ‘overarching’ privacy notice and it applies generally to the personal information that we collect and use. It is based on the model privacy notice produced for schools by the Department for Education (DfE). Unless there is a lawful reason not to do so, we will also provide more specific privacy information at the point at which we collect or use personal information, for example if we collect personal data via an online or paper form.
While much of the personal information that we collect is statutory or mandatory (i.e. it must be provided so that we can manage the school and provide an education), some of it is requested on a voluntary basis. Where this is the case, we will request consent at the point we collect the information. We will explain to you whether there is a requirement to provide certain information to us, or whether you have a choice in doing so.
For the purposes of data protection law,this is, the General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA18), West Leigh Infant School and Backwell C of E Junior School is the ‘data controller’. Our Data Protection Officer is: One West (iWest), Lewis House, Manvers Street, Bath, BA1 1JG.
Contact details are provided at the end of this privacy notice.
The personal data we hold (categories of personal data)
We process personal information to be able to run the school, to provide pupils with an education and to make sure that we can look after our pupils appropriately. We may collect information directly from pupils or parents or from other places including other schools, the local council and the Department for Education (DfE). Examples of the types of personal data that we may collect, use, store and share (when appropriate) are listed at Appendix 1.
Special category (sensitive) personal information
For the most part the following applies to pupils, however, where we have a lawful basis to do so, we could hold some special category information on parents.
We may also collect, store, and use information about you that falls into "special categories" of more sensitive personal data which has extra protection in law and requires us to identify a condition for processing under Article 9 of the GDPR.
These conditions will vary but common reasons may include where processing sensitive data is necessary for reasons of ‘substantial public interest’ such as safeguarding; statutory and government purposes (e.g. Department for Education (DfE) requirements) or for ensuring equality of opportunity or treatment. We may also require your explicit consent for things such as the use of unique identifiers (e.g. fingerprints); or we may need to share health data to maintain a person’s vital interests where they are unable to give consent (life and death situations) or for the purpose of medical diagnosis and prevention (e.g. school nurse team, ensuring staff are aware of allergies).
Special category data is personal data revealing:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data for the purpose of uniquely identifying a natural person
- data concerning health; or
- data concerning a natural person’s sex life or sexual orientation
Where we process criminal convictions, for example as part of a statutory requirement we also have to identify any additional ground for processing. Usually this will be either on the basis of our legal obligations in relation to safeguarding, preventing fraud or with your consent.
Our lawful reasons for processing pupil/parent information (lawful bases)
Data Protection law requires us to have a lawful reason (‘lawful basis’) for processing the personal data we use. These reasons are listed under Article 6 of the ‘General Data Protection Regulation’ (GDPR). Our lawful basis for processing will be explained at the point at which we collect personal information unless there is a lawful reason not to do so (for example where it is for the prevention or detection of crime).
West Leigh Infant School and Backwell C of E Junior School processes a wide range of personal data for a variety of purposes, as described above. The lawful bases we rely on will therefore vary. However, generally, the lawful bases we mainly use in relation to pupils and parents are:
- We need to comply with the law (we have a legal obligation): For example we collect and use pupil information under legal and statutory obligations within the Education Act 1996, The Children Act 2004; Education and Inspections Act 2006; Education Act 2011; the Family and Children Act 2014 and Keeping Children Safe in Education (KCSIE) statutory guidelines.
- We need to carry out a task in the public interest: For example, the collection and use of pupil information is necessary for us to perform our role as a school and to deliver our public task of providing education to our pupils.
Less commonly, we may also need to use personal information about you where:
- You have given us your consent (for example a photo of you for promotional purposes or our website.
- We need to protect your vital interests (or someone else’s interests). This relates to life and death situations.
- It is in ours or a third party’s legitimate interests to process the data. Where this is the case we will ensure that we have considered whether or not our legitimate interests are overridden by your rights and freedoms as the pupil or parent.
Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent, and explain how you go about withdrawing consent if you wish to do so. We will then cease this aspect of processing, unless another lawful basis applies.
Some of the reasons that we use for collecting and using information may overlap and there may be several grounds allowing us to use personal data. There are also other lawful bases that may apply and this will be made clear wherever possible.
Our lawful basis for processing will be explained at the point at which we collect personal information unless there is a lawful reason not to do so (for example where it is for the prevention or detection of crime).
Collecting pupil/parent information: Why do we collect and use your information?
The reasons that we collect and use personal information enable us to provide our pupils with an education and to help us run the school. Please refer to Appendix 2 for examples.
We collect and use information about you in a variety of way including through the school application and admissions process, from correspondence with you and through assessing pupils’ educational progress. The ways in which we collect information about you may also include methods as outlined at Appendix 3.
We may also collect information about you from third parties such as information from other schools or other third parties engaging with you outside the school.
Whilst you will be required to provide us with some information, there is some information that you can choose whether or not to provide to us. Whenever we seek to collect information from you, we make it clear whether you must provide this information (and if so, what the possible consequences are of not complying), or whether you have a choice.
Who we share pupil information with
Information about pupils and parents will not be shared with any third party without consent unless the law allows us to do so. Where it is legally required or necessary (and it complies with data protection law) personal information may be shared with the relevant local authority to meet our legal obligations to share information such as safeguarding concerns or with the Department for Education (DfE). To find out more about the data collection requirements that are placed upon us by the DfE including the data that we share with them go to: https://www.gov.uk/education/data-collection-and-censuses-for-schools
Further examples of with whom we share data are listed at Appendix 4.
Examples of how we share data with the Department for Education can be seen in Appendix 5.
Storing pupil and parent data
Personal data is stored in line with our data protection policy in a range of different places including within pupils’ files and our IT systems including the school’s email system.
The information that we create and maintain is kept secure. Once a pupil’s education with us has ended, we may retain certain information beyond their attendance at the school as deemed necessary and in line with our retention policies. A copy of the Retention Schedule can be found on the LSP website,
Transferring data internationally
Where we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law and ensure that we have sufficient safeguards in place.
Rquesting access to your personal data
Individuals have the right to request access to information about them that we hold. This is known as making a ‘Subject Access Request’ (SAR). If you make a subject access request, and if we hold information about you, we will:
- Give you a description of it
- Tell you why we are holding and processing it, and how long we will keep it for
- Explain where we got it from, if not from you
- Tell you who it has been, or will be, shared with
- Let you know whether any automated decision-making is being applied to the data, and any consequences of this
- Give you a copy of the information in an intelligible form within a month, unless an extension is necessary on the ground of the complexity of the request
You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances. If you would like to make a request, please contact the school office.
Children have the same rights as adults over their personal data and the school will assess each request on its own merits. Pupils can find out what personal information we hold about them and how we use it by making a subject access request as long we judge that they can properly understand their rights and what this means.
Parents can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (a benchmark may be under the age of 12 however this will be judged by the school on a case by case basis), or where the child has provided consent and it is considered to be in the best interests of the child. Parents also have the right to make a subject access request with respect to the personal data the school holds about themselves. If you would like to make a request, please contact the school office.
Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe. You have the right to:
- To have personal data rectified, if it is inaccurate or incomplete.
- To request the deletion or removal of personal data where there is no compelling reason for its continued processing.
- To restrict our processing of personal data (i.e. permitting its storage but no further processing).
- To object to processing if we are processing your information as part of our public tasks, or is in our legitimate interests in which case we will consider your objection, and balance this against our need to process the information.
- To object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
- To withdraw your consent to processing, although we may still continue to process your data if a basis other than consent applies.
- To have personal information, which you have provided, transmitted electronically to another organisation in certain circumstances.
- Not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect - unless you have agreed or in other limited circumstances
If you have a concern or complaint about the way we are collecting or using your personal data, please raise your concern with us in the first instance contact the headteacher – Nick Webster.
The Information Commissioner’s Office, which is the supervisory authority, may be contacted on 0303 123 1113, or via their website, www.ico.org.uk regarding any complaints about how the way that the school handles your data. However, under usual circumstances it may expect you to contact us first to see if we can help to resolve the issues first.
Updates to our Privacy Notice
We may need to update this privacy notice periodically. This version was last updated on December 2020.
If you would like to discuss anything in this privacy notice, please contact: The School Office or our Data Protection Officer at email@example.com.
Appendix 1: Non exhaustive list of examples of the types of personal data which we collect about pupils and parents
- Personal identifiers and contacts (such as name, unique pupil number, contact details and address).
- Characteristics (such as ethnicity, language, and free school meal eligibility).
- Safeguarding information (such as court orders and professional involvement).
- Special educational needs (including the needs and ranking).
- Medical conditions (such as doctor information, child health, dental health, allergies, medication and dietary requirements).
- Attendance record (such as sessions attended, number of absences, absence reasons and any previous schools attended).
- Test results, assessment and attainment (such as key stage 1, key stage 2 and phonics results.
- Behavioural information (such as exclusions and any relevant alternative provision put in place).
This list is not exhaustive. To access further details of the categories of personal information we process, please contact the School Office.
Appendix 2: Examples of the purposes for which we process your data
- To support pupil learning.
- To monitor and report on pupil progress and check whether any extra help is needed.
- To look after pupil wellbeing.
- To keep track of how well we’re performing and assess the quality of our services.
- To keep children safe (e.g. food allergies, or emergency contact details).
- To meet the statutory duties placed upon us e.g. for official data collections.
- To promote the school e.g. through our website, prospectuses and press releases.
This list is not exhaustive. To access further details please contact the school office.
Appendix 3: Ways in which we collect pupil and parent information
We collect and use information about you in a variety of ways including through the school application and admissions process, from correspondence with you and through assessing pupils’ educational progress. The ways in which we collect information about you may also include:
- Registration forms at the start of the school year
- Common transfer file – CTF or secure file transfer from previous school
Appendix 4: Examples of whom we may share your data with where the law permits (non – exhaustive list)
- The local authority – North Somerset Council.
- Schools that students attend after leaving.
- The Department for Education (DfE).
- The National Health Service to support student safety and vaccination programs.
- The pupil’s family and representatives.
- Educators and examining bodies.
- The regulator [Ofsted].
- Suppliers and service providers so that they can provide a contracted service such as careers and Physical Education provision.
- Central and local government.
- Survey and research organisations.
- Security organisations.
- Health and social welfare organisations.
- Professional advisers and consultants.
- Counsellors/Educational Psychologists as and when appropriate.
- Charities and voluntary organisations.
- Police forces, courts, tribunals.
- Professional bodies.
Appendix 5: How we share information with the Department for Education (DfE) and the National Pupil Database (NPD)
West Leigh Infant School and Backwell C of E Junior School is required to provide information about pupils to the DfE as part of statutory data collections such as the school census.
Some of this information is then stored in the National Pupil Database (NPD), which is owned and managed by the DfE and provides evidence on school performance to inform research.
The database is held electronically so it can be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.
The DfE may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.
Sharing by the DfE:
The law allows the DfE to share pupils’ personal data with certain third parties, including:
- Schools and local authorities.
- Organisations connected with promoting the education or wellbeing of children in England other government departments and agencies.
- Organisations fighting or identifying crime.
- For more information about the DfE’s NPD data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data
- To find out more about the data collection requirements placed on us by the DfE via the school census please visit: https://www.gov.uk/education/data-collection-and-censuses-for-schools
- To find out more about the NPD, please visit: https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information
- If you want to see the personal data held about you by the DfE, you can make a ‘subject access request’ to the DfE. Further information on how to do this can be found within the DfE’S personal information charter that is published here: https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter
- To contact DfE: https://www.gov.uk/contact-dfe