Privacy Notice

PRIVACY NOTICE FOR PUPILS & PARENTS / CARERS

John Hampden and Tetsworth Schools’ Federation collects data and information about our pupils and parents / carers so that we can run effectively as a school. We are a primary, local authority, community maintained school and the data controller for the data we process on pupils attending our school.

This privacy notice explains how and why we collect pupil and parent / carer data, what we do with it and what rights parents and pupils have.

If you would like to discuss anything in this privacy notice, please contact our Administration Team (details below) or our Data Protection Officer (Nicola Cook) at nicola@schoolsdpo.com.

Our contact details:

office.2591@john-hanpden.oxon.sch.uk

office.2456@tetsworth.oxon.sch.uk

The types of information held by us

We currently collect and process the following information:

1. personal identifiers and contacts (such as name, unique pupil number, contact details and address);
2. characteristics (such as ethnicity, language, pupil premium and free school meal eligibility);
3. safeguarding information (such as court orders and professional involvement);
4. special educational needs (including the needs and ranking);
5. medical and administration (such as doctors information, child health, dental health, allergies, medication and dietary requirements);
6. attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended);
7. assessment and attainment (such as key stage 1 and phonics results);
8. behavioural information (such as exclusions and any relevant alternative provision put in place).

How we collect the information and why we have it

We collect information about pupils and parents / carers before they join the school and update it during their time on the roll as and when new information is acquired. It is used to:

1. to support pupil learning and progress;
2. to run the school safely and effectively and protect the welfare of everyone in school;
3. to meet our legal obligations, such as data sharing.

Most of the personal information we process is provided to us directly by you but we also receive personal information when pupils join the school from:

1. other schools and nursery settings;
2. from the local authority.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for this processing are:

1. your consent. You are able to remove your consent at any time. You can do this by contacting
2. we have a contractual obligation;
3. we have a legal obligation;
4. we need it to perform a public task;
5. we have a vital interest;
6. we have a legitimate interest.

Some personal information requires extra protection as it is considered more sensitive. This includes race, ethnicity, religious beliefs, medical conditions, genetic information and biometric data, criminal convictions.

If we are processing special category data, our lawful bases will also include one of the following:

1. we have explicit consent;
2. to meet our obligations as a controller or those of data subjects;
3. to meet our public interest task of keeping pupils safe. 

What we do with the information

We use the information you have given us to:

• support pupil learning
• monitor and report on pupil progress
• provide appropriate pastoral care
• assess the quality of our services
• comply with the law regarding data sharing
• protect the welfare of pupils and others in the school
• run the school safely and effectively
• promote the school, including taking photographic images
• communicate with parents / carers.

We may share this information with:

• schools that pupils attend after leaving us
• our local authority, Oxfordshire County Council
• the Department for Education (DfE) (statutory data collections)
• school governors / trustees
• companies providing services to the school, e.g. catering, photography, communication services.

From time to time, we may also share pupil information with other third parties including the following:

• the Police and law enforcement agencies
• NHS health professionals including the school nurse
• Educational psychologists
• Education Welfare Officers
• Courts, if ordered to do so
• Prevent teams in accordance with the Prevent Duty on schools.

In the event that we share personal data about pupils with third parties, we will provide the minimum amount of personal data necessary to fulfil the purpose for which we are required to share the data.

How we store your information

A significant amount of personal data is stored electronically, for example, on our MIS (management information system) database and curriculum network. Some information may also be stored in hard copy format in lockable filing cabinets.

We hold pupil and parent / carers’ data in line with our retention schedule which is available from the school office.

Your data protection rights

Under data protection law parents / carers and pupils have the right to request access to information about them that we hold (a subject access request).

To make a request for your personal information or to be given access to your child’s educational record, please contact the school office or our data protection officer (see contact details at the start of this privacy notice). Where a child does not have the maturity to make their own requests for personal data, parents may do so on their behalf in a primary school setting.

You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress
• prevent processing for the purpose of direct marketing
• object to decisions being taken by automated means
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
• a right to seek redress either through the ICO or through the courts.

Under GDPR you are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Parents of pupils who attend a maintained school have a separate statutory right to access their child’s educational record. Upon receipt of a written request for a pupil’s educational record, the school will respond to it within 15 school days. This is an independent legal right of parents which falls outside of the GDPR.

How you can help us

As the school has limited staff resources outside of term time, we encourage parents to submit requests for information during term time and to avoid sending a request during periods when the school is closed, or is about to close for the holidays, where possible. This will assist us in responding to your request as promptly as possible.

For further information about how we handle subject access requests, please see our Data Protection Policy.

Any concerns

If you have a concern about the way we are collecting or using your or your child’s personal data, you should raise your concern with us in the first instance. You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

Telephone: 0303 123 1113.

Reviewed: June 2020

Next Review: June 2021