Students & Parents Privacy Policy
Contents
Version – v1.0
Author – i-West
Approval Date – July 2020
Publication Date – July 2020
Major Review Date – June 2021
About this Privacy Notice
Baytree School is supported by our Data Protection Officer, One West and is covered by Baytree School Data Protection Policy.
Individuals have a legal right to be informed about how we use their personal information. This Privacy Notice explains how we collect, store and use personal information. It is intended for pupils and parents (including carers or guardians who we refer to in this privacy notice as ‘parents’) and we encourage all to read it. We have produced a separate privacy notice for the school’s workforce and a shorter, simpler notice for pupils themselves.
Our aim is to always provide clear information about the personal information we are using and why we are using it. We have tried to keep the language in this privacy notice as simple as possible, however, if anything is unclear or if you have any concerns then please contact the school office on 01934 427555 or email schooloffice@baytreeschool.co.uk. This is the school’s main ‘overarching’ privacy notice and it applies generally to the personal information that we collect and use. It is based on the model privacy notice produced for schools by the Department for Education (DfE). Unless there is a lawful reason not to do so, we will also provide more specific privacy information at the point at which we collect or use personal information, for example if we collect personal data via an online or paper form. Whilst much of the personal information that we collect is mandatory (i.e. it must be provided so that we can manage the school, fulfil our legal obligations and provide an education), some of it is requested on a voluntary basis. Where this is the case, we will request consent at the point we collect the information. We will explain to you whether there is a requirement to provide certain information to us, or whether you have a choice in doing so. For the purposes of data protection law, Baytree School is the ‘data controller’. Our Data Protection Officer is One West, contact details are provided at the end of this privacy notice.
The personal data we hold (categories of personal data)
We process personal information to be able to run the school, to provide pupils with an education and to make sure that we can look after our pupils appropriately. We may collect information directly from pupils or parents or from other places including other schools, the local council and the Department for Education (DfE). Examples of the types of personal data that we may collect, use, store and share (when appropriate) are listed at Appendix 1.
Our lawful reasons for processing pupil/parent information (lawful bases)
Data Protection law requires us to have a lawful reason (‘lawful basis’) for processing the personal data we use. These reasons are listed under Article 6 of the ‘General Data Protection Regulation’ (GDPR). Our lawful basis for processing will be explained at the point at which we collect personal information unless there is a lawful reason not to do so (for example where it is for the prevention or detection of crime).
Baytree School processes a wide range of personal data for a variety of purposes, as described above. The lawful bases we rely on will therefore vary. However, generally, the lawful bases we mainly use in relation to pupils and parents are:
- We need to comply with the law (we have a legal obligation): For example we collect and use pupil information under legal and statutory obligations within the Education Act 1996, The Children Act 2004; Education and Inspections Act 2006; Education Act 2011; the Family and Children Act 2014 and Keeping Children Safe in Education (KCSIE).
- We need to carry out a task in the public interest: For example, the collection and use of pupil information is necessary for us to perform our role as a school and to deliver our public task of providing education to our pupils.
- You have given us your consent for example a photo of you for promotional purposes or our website.
- We need to protect your vital interests (or someone else’s interests). This relates to life and death situations.
- It is in our or a third party’s legitimate business interests to process the data. Where this is the case, we will ensure that we have considered whether our legitimate interests are overridden by your rights and freedoms as the pupil or parent.
Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent and explain how you go about withdrawing consent if you wish to do so. We will then cease this aspect of processing.
Some of the reasons that we use for collecting and using information may overlap and there may be several grounds allowing us to use personal data. There are also other lawful bases that may apply, and this will be made clear wherever possible. Our lawful basis for processing will be explained at the point at which we collect personal information unless there is a lawful reason not to do so (for example where it is for the prevention or detection of crime).
Special category (sensitive) personal information
We may also collect, store, and use information about you that falls into “special categories” of more sensitive personal data which has extra protection in law and requires us to identify a condition for processing under Article 9 of the GDPR.
Special category data is personal data revealing:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data for the purpose of uniquely identifying a natural person (for example fingerprints)
- data concerning health; or data concerning a natural person’s sex life or sexual orientation
The Article 9 grounds which we may rely on to process special category data include:
- Legal obligation
- Substantial public interest including:
- Statutory and government purposes
- Equality of opportunity or treatment
- Preventing and detecting unlawful acts
- Preventing fraud
- Public Health
- Safeguarding
- Support for individuals with a particular disability or medical condition
- Explicit consent, for example to the use of biometric data, eg fingerprints.
- To maintain your vital interests
Please refer to our special category of data policy which forms part of our data protection policy for further information.
Criminal convictions
We may process data about criminal convictions or offences. This will usually be where such processing is necessary to carry out our obligations, to exercise our rights, to look after our students and staff or to support the police and other relevant agencies.
We will only use information about criminal convictions or offences where the law allows us to. Usually, this will either be either on the basis of our legal obligations in relation to safeguarding, preventing fraud, health and safety or with your consent. We also need to identify the relevant condition for the processing, this will usually be substantial public interest.
Collecting pupil/parent information: Why do we collect and use your information?
The reasons that we collect and use personal information enable us to provide our pupils with an education and to help us run the school. Please refer to Appendix 2 for examples.
We collect and use information about you in a variety of ways including through the school application and admissions process, from correspondence with you and through assessing pupils’ educational progress. The ways in which we collect information about you may also include methods as outlined at Appendix 3.
We may also collect information about you from third parties such as information from other schools or other third parties engaging with you outside the school
Whom we share pupil information with
Information about pupils and parents will not be shared with any third party without consent unless the law allows us to do so. Where it is legally required or necessary (and it complies with data protection law) personal information may be shared with the relevant local authority to meet our legal obligations to share information such as safeguarding concerns or with the Department for Education (DfE). To find out more about the data collection requirements that are placed upon us by the DfE including the data that we share with them go to: https://www.gov.uk/education/data-collection-and-censuses-forschools. We do not use data for profiling, and only for marketing if you have opted in e.g. to our newsletter.
Further examples of with whom we share data are listed at Appendix 4. Examples of how we share data with the Department for Education can be seen in Appendix 5.
Youth support services [For use by educational settings with students aged 13+:]
Pupils aged 13+
Once our pupils reach the age of 13, we also pass pupil information to our local authority and/or provider of youth support services as they have responsibilities in relation to the education or training of 13-19-year-olds under section 507B of the Education Act 1996.
This enables them to provide services as follows:
- youth support services
- careers advisers
The information shared is limited to the child’s name, address and date of birth. However, where a parent or guardian provides their consent, other information relevant to the provision of youth support services will be shared. This right is transferred to the child/pupil once they reach the age 16.
Pupils aged 16+ [For use by educational settings with students aged 16+:]
We will also share certain information about pupils aged 16+ with our local authority and/or provider of youth support services as they have responsibilities in relation to the education or training of 13-19-year-olds under section 507B of the Education Act 1996.
This enables them to provide services as follows:
- post-16 education and training providers
- youth support services
- careers advisers
For more information about services for young people, please visit our local authority website.
Storing pupil and parent data
Personal data is stored in line with our data protection policy in a range of different places including within pupils’ files and our IT systems including the school’s email system.
The information that we create and maintain is kept secure. Once a pupil’s education with us has ended, we may retain such information beyond their attendance at the school as deemed necessary and in line with our retention policies. A copy of the Retention Schedule can be obtained by contacting the school office on 01934 427555 or email schooloffice@baytreeschool.co.uk.
Transferring data internationally
Where we transfer personal data to a country or territory outside the UK and European Economic Area, we will do so in accordance with data protection law and ensure that we have sufficient safeguards in place.
Requesting access to your personal data
Individuals have the right to request access to information about them that we hold. This is known as making a ‘Subject Access Request’ (SAR). If you make a subject access request, and if we hold information about you, we will:
- Give you a description of it
- Tell you why we are holding and processing it, and how long we will keep it for
- Explain where we got it from, if not from you
- Tell you who it has been, or will be, shared with
- Let you know whether any automated decision-making is being applied to the data, and any consequences of this
- Give you a copy of the information in an intelligible form within a month, unless an extension is necessary on the ground of the complexity of the request
You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances. If you would like to make a request, please contact the school office on 01934 427555 or email schooloffice@baytreeschool.co.uk.
Children have the same rights as adults over their personal data and the school will assess each request on its own merits. Pupils can find out what personal information we hold about them and how we use it by making a subject access request as long we judge that they can properly understand their rights and what this means.
Those with parental responsibility can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (a benchmark may be under the age of 12 however this will be judged by the school on a case by case basis), or where the child has provided consent and it is considered to be in the best interests of the child. Parents also have the right to make a subject access request with respect to the personal data the school holds about themselves. If you would like to make a request please contact the school office on 01934 427555 or email schooloffice@baytreeschool.co.uk.
Parents also have an independent legal right to access to their child’s educational record. To exercise this right, please contact the school office on 01934 427555 or email schooloffice@baytreeschool.co.uk.
Other rights
Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe. You have the right to:
- To request to have personal data rectified, if you believe that it is inaccurate or incomplete.
- To request the deletion or removal of personal data where there is no compelling reason for its continued processing.
- To restrict our processing of personal data (i.e. permitting its storage but no further processing) under certain circumstances.
- To object to processing if we are processing your information as part of our public tasks, or on the basis of our legitimate business interests, in which case we will consider your objection, and balance this against our need to process the information.
- To object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics.
- To withdraw your consent to the processing
- To have personal information, which you have provided, transmitted electronically to another organisation in certain circumstances.
- Not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect – unless you have agreed or in other limited circumstances.
- A right to seek redress, either through the ICO, or through the courts
Contact and Complaints
If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please either contact us on 01934 427555 or email schooloffice@baytreeschool.co.uk. We take any complaints about our collection and use of personal information very seriously.
If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please contact the school office on 01934 427555 or email schooloffice@baytreeschool.co.uk or our Data Protection Officer One West,
Email: i-west@bathnes.gov.uk 01225 395959 You can also complain to the ICO if you are unhappy with how we have used your data, but they would generally expect you to have raised the issue with us first.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Updates to our Privacy Notice
We may need to update this Privacy notice periodically. This version was last updated on 8 th December 2020.
Appendix 1: Non- exhaustive list of examples of the types of personal data which we collect about pupils and parents
- Personal identifiers and contacts (such as name, unique pupil number, contact details and address).
- Characteristics (such as ethnicity, language, and free school meal eligibility).
- Safeguarding information (such as court orders and professional involvement).
- Special educational needs (including the needs and ranking).
- Medical conditions (such as doctor information, child health, dental health, allergies, medication and dietary requirements).
- Attendance record (such as sessions attended, number of absences, absence reasons and any previous schools attended).
- Test results, assessment and attainment (such EYFS Outcomes, phonics screening and teacher assessments).
- Behavioural information (such as exclusions and any relevant alternative provision put in place).
- Photographs.
- We may use online platforms to deliver lessons remotely, if we intend to record the lesson we will let you know
This list is not exhaustive. To access further details of the categories of personal information we process, please contact the school office on 01934 427555 or email schooloffice@baytreeschool.co.uk.
Appendix 2: Examples of the purposes for which we process your data
- To support pupil learning and deliver remote learning
- To monitor and report on pupil progress and check whether any extra help is needed.
- To look after pupil wellbeing.
- To keep track of how well we’re performing and assess the quality of our services.
- To keep children safe (e.g. food allergies, or emergency contact details).
- To meet the statutory duties placed upon us e.g. for official data collections.
- To promote the school e.g. through our website, prospectuses and press releases.
- We may be required to share information about our pupils with the local authority to ensure that they can conduct their statutory duties under the Schools Admission Code, including conducting Fair Access Panels.
Appendix 3: Ways in which we collect pupil and parent information
We collect and use information about you in a variety of ways including through the school application and admissions process, from correspondence with you and through assessing pupils’ educational progress. The ways in which we collect information about you may also include:
Registration forms on joining the school Common Transfer File (CTF) or secure transfer from a previous school. Annual data collection sheets with contact information.
This list is not exhaustive. To access further details of the categories of personal information we process please contact 01934 427555 or email schooloffice@baytreeschool.co.uk.
Appendix 4: Examples of whom we may share your data with where the law permits (non – exhaustive list)
- The Local Authority (North Somerset).
- Schools that students attend after leaving.
- The Department for Education (DfE).
- The National Health Service to support student safety and vaccination programs.
- The pupil’s family and representatives.
- Educators and examining bodies.
- The schools’ inspector
- Suppliers and service providers so that they can provide a contracted service such as careers and Physical Education provision.
- Central and local government.
- Auditors.
- Survey and research organisations.
- Security organisations.
- Health and social welfare organisations.
- Professional advisers and consultants.
- Counsellors/Educational Psychologists as and when appropriate.
- Charities and voluntary organisations.
- Police forces, courts, tribunals.
- Professional bodies.
- Our data protection officer on occasion, eg to support a subject access request
- Occasionally with school governors
Appendix 5: How we share information with the Department for Education (DfE) and the National Pupil Database (NPD)
Baytree School is required to provide information about pupils to the DfE as part of statutory data collections such as the school census.
Some of this information is then stored in the National Pupil Database (NPD), which is owned and managed by the DfE and provides evidence on school performance to inform research.
The database is held electronically so it can be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.
The DfE may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.
Sharing by the DfE:
The law allows the DfE to share pupils’ personal data with certain third parties, including:
- Schools and local authorities.
- Researchers.
- Organisations connected with promoting the education or wellbeing of children in England other government departments and agencies.
- Organisations fighting or identifying crime.
We lawfully share pupil data with the DfE through data collections which is used to
- underpin school funding, which is calculated based upon the numbers of children and their characteristics in each school.
- inform ‘short term’ education policy monitoring and school accountability and intervention (for example, school GCSE results or Pupil Progress measures).
- support ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school)
For more information about the DfE’s NPD data sharing process, please visit: https://www.gov.uk/data-protection-howwe-collect-and-share-research-data
To find out more about the data collection requirements placed on us by the DfE via the school census please visit: https://www.gov.uk/education/data-collection-and-censuses-for-schools
To find out more about the NPD, please visit: https://www.gov.uk/government/publications/national-pupil-databaseuser-guide-and-supporting-information.
If you want to see the personal data held about you by the DfE, you can make a ‘subject access request’ to the DfE. Further information on how to do this can be found within the DfE’S personal information charter that is published here: https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter
To contact DfE: https://www.gov.uk/contact-dfe