Privacy Notice

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about pupils, their parents or carers and our workforce.

We, Educate U, are the ‘data controller’ for the purposes of data protection law.

Privacy Notice – Pupils

What is the purpose of this Notice?

Educate U’s Privacy Notice which is intended to provide you with information about how and why we process pupil information. Once a pupil is able to understand their rights over their own data (generally considered to be age 12, but this has to be considered on a case-by-case basis) It is also intended to provide you with other information which is required under the General Data Protection Regulation (GDPR). The GDPR is a piece of legislation which contains the key laws relating to data protection.

It is important to the school, and a legal requirement, that we are transparent about how we process pupil information. As a school that processes pupil information, we are known as a “data controller”. This means that we collect and use personal information for specified purposes which this Privacy Notice has been designed to tell you about.
Once a child is able to understand their rights over their own data (generally considered to be age 12, but this has to be considered on a case-by-case basis)

The Data Protection Officer

The school has an appointed Data Protection Officer (DPO), Susan Evans, who can be contacted via the office, or by emailing. office@educateu.co.uk
The DPO is responsible for dealing with data protection issues within the school and you can contact the DPO should you wish to discuss any issues or concerns that you have about data protection.

What pupil information do we collect?

The types of pupil information that we collect include:

Contact details, contact preferences (including parent(s)/carer(s) details), date of birth, identification documents
characteristics such as ethnicity, language, nationality, country of birth, young carers, pupil premium and free school meal eligibility
Results of internal assessments and externally set tests
Pupil and curricular records
Admissions and Discharge information
Attendance information (such as sessions attended, number of absences and absence reasons)
Safeguarding information
special educational needs information e.g. EHCPs and IEPs
Details of any support received, including care packages, plans and support providers
Information about your child’s use of our information and communications systems, equipment and facilities (e.g. school computers)
progress snapshots (daily via earwig) of learning
records of where pupils go after they leave us
Therapeutic assessments and reports
Medical conditions including including allergies, neurodevelopmental conditions and physical disabilities
behavioural information

We may also collect, use, store and share (when appropriate) information about your child that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Information about any medical conditions we need to be aware of physical and mental health
Photographs and CCTV images captured in school
Information about characteristics, such as ethnic background or special educational needs
As a trauma informed school we also collect information about adverse childhood experiences and protection factors.

We may also hold data about your child that we have received from other organisations, including other schools and social services.

What is the purpose of us collecting and using pupil information?

The purposes for which the school collects personal information are as follows:

To support our pupils’ learning
To support our pupils’ accessing therapy with our specialist therapeutic team.
To assess for gaps in learning and support gap filling for children with missed education
To monitor and report on pupil progress
To provide appropriate pastoral care
To assess the quality of our services
To comply with the law regarding data sharing
For safeguarding purposes
For health, safety and insurance purposes

Why is it lawful to collect this pupil information?

As a school, we are subject to a wide range of laws which we must comply with to further pupil education and to safeguard pupil well-being. To comply with these laws, we only process personal information as far as is necessary to meet those obligations. We also process some of the information described in this privacy notice to carry out the public tasks vested in us as a school to effectively run the school.

Whilst the majority of pupil information provided to us is mandatory, some of it is provided on a voluntary basis. In order to comply with the GDPR, when we request information we will make it clear whether this is required or if there is a choice. If it is a choice, then we will obtain consent first. Even if consent is given to us to collect and use this information, there is the right to withdraw consent at any time.

Some types of pupil information are regarded as more sensitive under the GDPR and referred to as being a ‘special category’ of personal information. In these circumstances, explicit consent will be obtained first.

Who will we share pupil information with?

Schools or colleges that pupils attend after leaving us
Placing local authority
Department for Education (DfE)
Parent(s) and Carer(s)
Social care services such as Social Workers.

Why we share pupil information

We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.

We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.

We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.

Data collection requirements:

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to: https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

Conducting research or analysis
Producing statistics
Providing information, advice or guidance

The department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

Who is requesting the data
The purpose for which it is required
The level and sensitivity of data requested
The arrangements in place to store and handle the data

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided pupil information to, and for which project, please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-receivedTo contact DfE: https://www.gov.uk/contact-dfe

How long will we hold pupil information for?

We will hold pupil information for a period of time specified by law and as detailed within our retention policy. The length of time will depend on the nature of the information held. For more information, please contact the DPO.

Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for personal information held about themselves or to be given access to their child’s educational record, parents should contact the Data Protection Officer.

There is also the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress
prevent processing for the purpose of direct marketing
object to decisions being taken by automated means
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
claim compensation for damages caused by a breach of the Data Protection Regulations

If you have a concern about the way we are collecting or using personal data, you should raise your concern with the Data Protection Officer in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/

Privacy notice for parents/carers

What is the purpose of this Notice?

This is our school’s Privacy Notice which is intended to provide you with information about how and why we process your personal information. It is also intended to provide you with other information which is required under the General Data Protection Regulation (GDPR). The GDPR contains the key laws relating to data protection.

It is important to the school, and a legal requirement, that we are transparent about how we process your personal information. As a school that processes personal information, we are known as a “data controller”. This means that we collect and use personal information for specified purposes which this Privacy Notice has been designed to tell you about.

The Data Protection Officer

The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about parents/carers includes, but is not restricted to:

Contact details and contact preferences
Family Links
Parental/Carer details
CCTV images captured in school
Information around external and professional service involvement e.g. Early help.
Confidential therapy notes (if applicable)
Parent/carer views on Annual Reviews and in school-related surveys.
Information pertaining to Complaints raised by parents/carers

Why we use this data

We use this data to:

Contact Parents/Carers to support their child
Support pupil learning
Monitor and report on pupil progress
Provide appropriate pastoral care
Protect pupil welfare
Assess the quality of our services
Administer admissions waiting lists
Carry out research
Comply with the law regarding data sharing

Our legal basis for using this data

We only collect and use pupils’ and parent/carer personal data when the law allows us to. Most commonly, we process it where:

We need to comply with a legal obligation
We need it to perform an official task in the public interest

Less commonly, we may also process pupils’ personal data in situations where:

We have obtained consent to use it in a certain way
We need to protect the individual’s vital interests (or someone else’s interests)

Where we have obtained consent to use pupils’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

Some of the reasons listed above for collecting and using pupils’ personal data overlap, and there may be several grounds which justify our use of this data.

Collecting this information

While the majority of information we collect about pupils is mandatory, there is some information that can be provided voluntarily.

Whenever we seek to collect information from you or your child, we make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.

Parents and pupils’ rights regarding personal data

Parents/carers have a legal right to access their child’s ‘educational record’. Individuals also have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them.

Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.

Parents also have the right to make a subject access request with respect to any personal data the school holds about them.

If you make a subject access request, and if we do hold information about you or your child, we will:

Give you a description of it
Tell you why we are holding and processing it, and how long we will keep it for
Explain where we got it from, if not from you or your child
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

Individuals also have the right for their personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like any information please ask a member of the office team, or email our Data Protection Officer .

Requesting access to your personal data

Under data protection legislation, you have the right to request access to information that we hold about you. To make a request for your personal information please contact the DPO.

You also have the right to:

Object to processing of personal data that is likely to cause, or is causing, damage or distress
Prevent processing for the purpose of direct marketing
Object to decisions being taken by automated means
In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed and
Claim compensation for damages caused by a breach of the Data Protection Regulations

Complaints and further information

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/If you would like to discuss anything in this privacy notice, please contact the DPO whose contact details are provided above.

Privacy Notice - Workforce

What is the purpose of this Notice?

The Data Protection Officer

What personal information do we collect?

The types of personal information that we collect will include:

Personal information (such as name, employee or teacher number, national insurance number, next of kin and contact details)
Special categories of data including characteristics information such as gender, age, ethnic group
Contract information (such as start dates, hours worked, post, roles and salary information)
Work absence information (such as number of absences and reasons)
Qualifications (and, where relevant, subjects taught)
Relevant medical information
Performance related information
Safeguarding related information if applicable e.g Low level concerns.
CCTV images captured in school
Photographs

What is the purpose of us collecting your personal information?

We process personal data relating to those we employ to work at, or otherwise engage to work at, our school. This is for employment purposes to assist in the running of the school and to enable individuals to be paid. We use workforce data to:

Enable the development of a comprehensive picture of the workforce and how it is deployed
Managing staff
Informing the development of recruitment and retention policies
Enabling individuals to be paid
Monitoring staff attendance
Safeguarding purposes
Dealing with reference requests

Legal basis for processing

We may process your personal information, but no more so than is necessary, to comply with a legal obligation which the school is subject to, to undertake public tasks vested in the school or because processing is necessary to comply with the terms and conditions of your contract of employment. In other circumstances, we will usually obtain your consent first. If we require your consent and it is given, you may withdraw this consent at any time.

If we are required to process sensitive information (referred to as special category information under the GDPR), then we will either process this information to comply with employment laws, to undertake a task carried out in the public interest or obtain your explicit consent.

Who will we share this information with?

We are required, by law, to pass on some of this personal data to:

Our local authority
The department for education (dfe)
We may also share some information with:-
- IT providers
- Health and safety
- Education support services
- Payroll and hr providers
- Other employers for providing a reference
- Safeguarding agencies e.g. Lado

Why we share school workforce information

We do not share information about workforce members with anyone without consent unless the law and our policies allow us to do so.

Local authority - We are required by law to share information about our workforce members with our local authority.

Department for Education (DfE) - We share personal data with the Department for Education (DfE) on a statutory basis. This data sharing underpins workforce policy monitoring, evaluation, and links to school funding / expenditure and the assessment of educational attainment.

How long will we hold your information for?

We will hold personal information for a period specified by law and as detailed within our retention policy. We generally hold employee personal information for the period of your employment until termination and a period of 6 years thereafter. For more information, please ask the DPO for a copy of our retention schedule.

Data collection requirements

The DfE collects and processes personal data relating to those employed by special schools and Alternative Provisions.

To find out more about the data collection requirements placed on us by the Department for Education including the data that we share with them, go to:
https://www.gov.uk/education/data-collection-and-censuses-for-schoolsThe department may share information about school employees with third parties who promote the education or well-being of children or the effective deployment of school staff in England by:

Conducting research or analysis
Producing statistics
Providing information, advice or guidance

The department has robust processes in place to ensure that the confidentiality of personal data is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether DfE releases personal data to third parties are subject to a strict approval process and based on a detailed assessment of:

Who is requesting the data
The purpose for which it is required
The level and sensitivity of data requested; and
The arrangements in place to securely store and handle the data

To be granted access to school workforce information, organisations must comply with its strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit:
https://www.gov.uk/data-protection-how-we-collect-and-share-research-dataTo contact the department: https://www.gov.uk/contact-dfe

Requesting access to your personal data

Under data protection legislation, you have the right to request access to information that we hold about you. To make a request for your personal information please contact the DPO.

You also have the right to:

Object to processing of personal data that is likely to cause, or is causing, damage or distress
Prevent processing for the purpose of direct marketing
Object to decisions being taken by automated means
In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed and
Claim compensation for damages caused by a breach of the Data Protection Regulations

Complaints and further information

If you would like to discuss anything in this privacy notice, please contact the DPO whose contact details are provided above.