Privacy notices must be concise, transparent, intelligible, easily accessible and free of charge. They must be written in clear and plain language. The privacy notice fulfils the school’s obligation to inform. The notices must be honest – people must be informed of how their personal data is being used.
What is the right to be informed and why is it important?
The right to be informed covers some of the key transparency requirements of Data Protection Legislation. It is about providing individuals with clear and concise information about what you do with their personal data.
An effective approach can help you to comply with other aspects of the Act, foster trust with individuals and obtain more useful information from them.
Getting this wrong can leave you open to fines and lead to reputational damage.
What privacy information should we provide to individuals?
What you need to tell people differs slightly depending on whether you collect personal data from the individual it relates to or obtain it from another source. Annexe A to C are the template Privacy Notices for the school. These must be completed and published in a prominent position on the school’s website.
Consent to collect data
The school will need to collect consent to use data where there is no legal basis, for example to use biometric data. An example consent form can be found in Annexe D. Consent must be freely given, specific, informed and an unambiguous indication of the individual’s wishes.
Privacy Notices and paper forms
Sometimes it is not possible to recreate privacy notices on printed material, such as on a consent form for school trips form. In instances such as this use the following statement:
Electronic forms:
We adhere with data protection legislation. For more information please visit our published privacy notice at https://thethinkingschoolsfederation.co.uk or call 0208 478 2993
We adhere with data protection legislation. For more information please visit our published privacy notice on our website or call 0208 478 2993
The Annexes below contain templates for the school to complete. Completed privacy notices MUST be published on the school website.
Annexes
A Privacy Notice
Privacy Notice for pupils (also provided to parents and carers)
Although we have tried to make this Privacy Notice as straight forward as possible, some may find it difficult to understand. Please contact the school Data Protection Administrator, details at the end of this notice, for further help if needed.
This notice explains how we use information about you and what we do with it. We call this information about you ‘personal data’ or personal information’.
Who we are
The Thinking Schools Federation have our principal site at Uphall Primary School, Uphall Road, Ilford, Essex, IG1 2JD
Collecting and storing pupil information
We process personal data relating to pupils, parents, staff, Governors of our organisation.
We will not give information about our pupils to anyone without consent unless the law allows us to do so.
Storing pupil data
We will only keep your information for as long as we need it or for as long as the law requires us to. Most of the information we have about you will be in our pupil file. We usually keep these until your 25th birthday unless you move to a new school, in which case we send your file to your new school. We have a policy which explains how long we keep information, it is called the Records Retention Policy and if you would like to discuss this in greater detail please contact the school’s Data Protection Administrator, details at the end of this form.
Any personal data that we are required to keep about l pupils is securely stored, with limited access for staff. It will not be accessed except in response to a query about our actions in the education of a particular pupil. No decisions will be made about you based on this data and you will not suffer any detriment or harm by having it stored in/on our secure systems.
We keep an overall summary of attainment and performance of pupils in our schools, in order to monitor trends in teaching and learning. This data is anonymised and does not allow us to identify individual learners, once they have left our learning community.
We use the pupil data to:
- support pupils and teachers in learning
- monitor and report on progress
- provide appropriate care and security
- assess the quality of our services
- comply with the law around statutory data sharing
- promote the school (via newsletters and social media, with appropriate consent)
The categories of pupil information that we collect, hold and share include:
- Personal information (such as – name, address, age, unique pupil number and photographs)
- Special Category data (such as – ethnicity, nationality, country of birth, biometric and medical information)
- Attendance and assessment information (such as – sessions attended, number of absences & absence reasons, national curriculum assessment results, special education need and any exclusion information).
The lawful basis on which we use this information
All data we process is in accordance with the rules as laid down in statute, including the General Data Protection Regulations, the Education Act 1996, the Education and Skills Act 2008 and the Apprenticeship, Skills, Children and Learning Act 2009 and Children Act 2014.
We use personal data about pupils and parents to ensure that we fulfil our legal obligation to offer educational opportunities to our pupils, and are able to look after the needs and requirements of everyone in our learning community. We use personal data about our staff to ensure that we can support them in offering teaching and learning and in their personal development.
Where we rely on consent to process personal data about individuals in our schools, we ensure that we obtain that consent freely and in a positive manner. Anyone whose personal data is processed on the basis of consent can withdraw that consent easily and quickly. See “Requesting access to personal data & individual rights” listed later in this notice”.
Please note that the main reasons for our processing of personal information is due to
- We need to, to comply with the law
- We need to, to carry out a task in the public interest
- We need to, protect someone’s interests
- To communicate with you/parents/carers
A comprehensive list of data processing is kept in the school’s Record of Processing Activities. Within this register we will record the lawful reason for each instance of personal data being processing, along with special categories for sensitive information. Where there is limited statutory instrumentation the legal basis for processing special category of data will be 9(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of
the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
If you would like to discuss this in greater detail please contact the school’s Data Protection Administrator, details at the end of this form.
Who will see your personal data
We will only share your information with people who have a legal or operational reason to see it. For pupils, this could include anyone directly involved in planning, providing or supporting educational opportunities. For parents, this could include anyone who needs to be involved in conversations about your child’s progress at our schools.
All staff personnel files are held securely by the HR department, and are only available to the HR team and senior management.
Personal data about Governors is held by the Clerk to the Governors . It is only available to the Clerk, and is kept in order to ensure that The Thinking Schools Federation complies with our legal obligations regarding Governance.
It is necessary in some circumstances, sometimes by the law, that personal information is processed, or used, by a third party to the school. These third parties are:
| Third Party | Level of Information |
| RM Integris | Official-Sensitive |
| Department for Education | Official-Sensitive |
| The Thinking Schools Federation | Personal information |
| Atomwide (LGfL) | Official – sensitive |
| e-Receptionbook | Personal Information |
| Tucasi | Official – Sensitive |
| Parent Hub | Personal Information |
| ISS (School Meals) | Official-Sensitive |
| Orchestra | Official – Sensitive |
| Google Classroom | Official – Sensitive |
Photographs and biometric data
Photographs
Our schools operate a policy relating to the use of photographs and a copy of this can be requested via the school’s Data Protection Administrator, details at the end of this form.
Biometric data
Where cashless canteens are in place, biometric information is collected and used only with consent. This is sought when a pupil joins the school but can be withdrawn at any point, for further details please contact the school’s Data Protection Administrator, details at the end of this form.
Data collection requirements
To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) please see the following web link: – https://www.gov.uk/education/data-collection-and-censuses-for-schools.
The National Pupil Database (NPD)
The NPD is owned and managed by the Department for Education (DfE) and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
We are required to pass information about our pupils to the DfE under Regulation 5 and Schedule 1 of The Education (Information About Individual Pupils) (England) Regulations 2013 as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD.
This information will, in turn, then be made available for use by the Local Authority who, under strict information sharing protocols and policies, may also be required to share this information with other public sector partners such as other Local Authorities or local Children Centre.
To find out more about the National Pupil Database please see the following web link: – http://www.gov.uk/government/publications/national-pupil-database-user-guide-and- supporting-information
The DfE may share information about our pupils from the National Pupil Database with third parties who promote the education or well-being of children in England by: –
- conducting research or analysis
- producing statistics
- providing information, advice or guidance
The Department has robust processes in place to ensure the confidentiality of data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
- who is requesting the data
- the purpose for which it is required
- the level and sensitivity of data requested: and
- the arrangements in place to store and handle the data
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data
For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received
If you have questions, contact the DfE through their website: https://www.gov.uk/contact- dfe
Changing schools
As per The Education (Pupil Information) (England) Regulations 2005, we are required to pass pupil information on to schools that the pupil goes on to attend after leaving us. We do this via the Department for Education’s ‘School to School’ (S2S) secure data transfer website. This also acts as a temporary information depositary where a pupil has left us and the destination is not known to us.
The NHS
Information will only be passed to the NHS where we have a legal / statutory obligation to do so or where it is fully anonymous and cannot identify individuals, to the extent of no longer being personal data. Where the NHS otherwise require personal data for the provision of a service or research, parental and / or pupil consent will always be sought on a case by case basis.
CCTV
Our schools use Closed Circuit Television cameras for the purposes of monitoring our premises and to support any pupil behavioural policies. There are visible signs showing that CCTV is in operation and images from this system are securely stored where only a limited number of authorised persons may have access to them. We may be required to disclose CCTV images to authorised third parties such as the police to assist with crime prevention or at the behest of a court order.
Requesting access to personal data & individual rights
The General Data Protection Regulations and associated Data Protection Act 2018 allow parents and pupils the right to access the information that we hold about them. Additionally, the Education Act 1996 allows parent’s the right to access most of their child’s educational records. To make a request for information; please use the contact details that can be found at the end of this notice.
You also have the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress
- prevent processing for the purpose of direct marketing
- object to decisions being taken by automated means
- in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
- claim compensation for damages caused by a breach of the Data Protection regulations
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance.
International transfers and processing
We do not process any personal information outside of the European Economic Area
Contact
If you would like to discuss anything in this privacy notice or make a request for information, please contact: Mrs Sharon Leavy – Strategic Learning Leader , Uphall Primary School, Uphall Road, Ilford, Essex, IG1 2JD – 0208 478 2993
Please note our Statutory Data Protection Officer details are below:
London Borough of Redbridge Data Protection Officer
London Borough of Redbridge
Lynton House, 255-259 High Road, Ilford, IG1 1NY dataprotection.schools@redbridge.gov.uk
Alternatively, should we not be able to provide a satisfactory answer to your request in the first instance, you may wish to contact the Information Commissioner’s Office (ICO) directly using the following details:
Information Commissioner’s Office Wycliffe House
Water Lane Wilmslow Cheshire SK9 5AF
0303 123 1113
B Workforce Privacy Notice
Privacy Notice (How we use workforce information)
The categories of school information that we process
These include:
- personal information (such as name, employee or teacher number, national insurance number)
- characteristics information (such as gender, age, ethnic group)
- contract information (such as start date, hours worked, post, roles and salary information)
- work absence information (such as number of absences and reasons)
- qualifications (and, where relevant, subjects taught)
- medical information
- reference requests
- payroll information e.g. third party financial information
- Previous address information
- Previous
This list is not exhaustive, to access the current list of categories of information we process please see current privacy notice
Why we collect and use workforce information
We use workforce data to:
- enable the development of a comprehensive picture of the workforce and how it is deployed
- inform the development of recruitment and retention policies
- enable individuals to be paid
- Dfe requirement for data analysis for school sector
Under the General Data Protection Regulation (GDPR), the legal basis / bases we rely on for processing personal information for general purposes are:
- for the purposes of employment in accordance with the legal basis of Article 6 (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
In addition, concerning any special category data:
- 9 (b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
Collecting workforce information
We collect personal information via written Local Authority Recruitment application forms , staff personal details by written staff contact details form.
Workforce data is essential for the school’s / local authority’s operational use. Whilst the majority of personal information you provide to us is mandatory, some of it is requested on a voluntary basis. In order to comply with GDPR, we will inform you at the point of collection, whether you are required to provide certain information to us or if you have a choice in this.
Storing workforce information
We hold data securely for the set amount of time shown in our data retention schedule. For more information on our data retention schedule and how we keep your data safe, please visit uphallprimary.co.uk.
The storing of data is held in secure cabinets in a locked room. This information is only accessible through the relevant member of staff responsible for these files, and the Headteacher.
Who we share workforce information with
We routinely share this information with:
- our local authority (where applicable)
- the Department for Education (DfE)
Why we share school workforce information
We do not share information about our workforce members with anyone without consent unless the law and our policies allow us to do so.
Local authority
We are required to share information about our workforce members with our local authority (LA) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.
Department for Education
The Department for Education (DfE) collects personal data from educational settings and local authorities via various statutory data collections. We are required to share information about our children and young people with the Department for Education (DfE) for the purpose of statutory data collection under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.
We are required to share information about our schools employees with the Department for Education (DfE) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.
Requesting access to your personal data
Under data protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information, contact Mrs Sharon Leavy on admin@uphallprimary.co.uk
You also have the right to:
- to ask us for access to information about you that we hold
- to have your personal data rectified, if it is inaccurate or incomplete
- to request the deletion or removal of personal data where there is no compelling reason for its continued processing
- to restrict our processing of your personal data (i.e. permitting its storage but no further processing)
- to object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
- not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you
If you have a concern about the way we are collecting or using your personal data, we ask that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/
Withdrawal of consent and the right to lodge a complaint
Where we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know by contacting Sharon Leavy at admin@uphallprimary.co.uk
International transfers and processing
We do not process any personal information outside of the European Economic Area
Last updated
We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated on September 2020.
Contact
If you would like to discuss anything in this privacy notice, please contact: The Administrator Sharon Leavy at admin@uphallprimary.co.uk or Mr Steven Cordeweener, IT and Infrastructure Lead, on admin@uphallprimary.co.uk
C Governors Privacy Notice
Privacy Notice (How we use personal information of Governors)
The categories of governor information that we process include:
- personal identifiers, contacts and characteristics (such as name, date of birth, contact details and postcode)
- governance details (such as role, start and end dates and governor ID)
Why we collect and use governor information
The personal data collected is essential, in order for the school to fulfil their official functions and meet legal requirements.
We collect and use governor information, for the following purposes
a) to meet the statutory duties placed upon us
b) to allow parents/outside agencies to contact in relation to school business
c) to meet DFE requirements
Under the General Data Protection Regulation (GDPR), the legal bases we rely on for processing personal information for general purposes are:
- for the purpose a) named above in accordance with the legal basis of Legal Obligation
All maintained school governing bodies, under section 538 of the Education Act 1996 and academy trusts, under the Academies Financial Handbook have a legal duty to provide the governance information as detailed above.
In addition, concerning any special category data:
In addition, concerning any special category data:
- 9 (g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
Collecting governor information
We collect personal information via Governor Contact Forms, email and written correspondence.
Governor data is essential for the school’s operational use. Whilst the majority of personal information you provide to us is mandatory, some of it may be requested on a voluntary basis. In order to comply with GDPR, we will inform you at the point of collection, whether you are required to provide certain information to us or if you have a choice in this.
Storing governor information
We hold data securely for the set amount of time shown in our data retention schedule. For more information on our data retention schedule and how we keep your data safe, please see https://thethinkingschoolsfederation.co.uk
Who we share governor information with
We routinely share this information with:
- our local authority (where applicable)
- the Department for Education (DfE)
- website Uphall Primary School: https://uphallprimary.co.uk
- website Highlands Primary School: https://highlandsprimaryschool.co.uk
Why we share governor information
We do not share information about our governors with anyone without consent unless the law and our policies allow us to do so.
Local authority
We are required to share information about our governors with our local authority (LA) as part of our obligation to the substantial public interest (Article 9 (g) GDPR).
Department for Education
The Department for Education (DfE) collects personal data from educational settings and local authorities. We are required to share information about our governors with the Department for Education (DfE), under:
We are required to share information about our governors with the Department for Education (DfE) under section 538 of the Education Act 1996
We are required to share information about our governors with the Department for Education (DfE) under section 538 of the Education Act 1996
All data is entered manually on the GIAS system and held by DfE under a combination of software and hardware controls which meet the current government security policy framework.
For more information, please see ‘How Government uses your data’ section.
Requesting access to your personal data
Under data protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information, contact Sharon Leavy You also have the right to:
- to ask us for access to information about you that we hold
- to have your personal data rectified, if it is inaccurate or incomplete
- to request the deletion or removal of personal data where there is no compelling reason for its continued processing
- to restrict our processing of your personal data (i.e. permitting its storage but no further processing)
- to object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
- not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you
If you have a concern or complaint about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/
Withdrawal of consent and the right to lodge a complaint
Where we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know by contacting The Thinking Schools Federation Data Protection Administrator : admin@uphallprimary.co.uk
International transfers and processing
We do not process any personal information outside of the European Economic Area
Last updated
We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated September 2020
Contact
If you would like to discuss anything in this privacy notice, please contact Sharon Leavy at
Links with other policies
This Data Protection Policy and Privacy Notice is linked to the Freedom of Information Publication Scheme.
D Consent Form
Please view the Consent Collection document in Section 3 Procedures in the IG Toolkit for Schools.
Consent Collection form
We adhere with data protection legislation and will not keep your information longer than necessary. For more information please visit our published privacy notice https://thethinkingschoolsfederation.co.uk or call 0208 478 2996
| Purpose | Accept |
| I agree that; | |
| images of my child can be used on the school website (and newsletter if electronic) | |
| images of my child can be used in newsletters and printed literature | |
| images of my child can be used in internal displays | |
| images of my child can be used by local media such as local newspapers | |
| images of my child social media such as Twitter | |
| video images of my child can be used for promotional purposes | |
| my child can use their fingerprints to add money to their account | |
| my child can use their fingerprints to access services such as the canteen, printing and library services. | |
| my child’s first name can be shared as a class list for Christmas cards {infants only} | |
