Privacy Notice for Pupils

St Mary’s School (Colchester) Limited (the “School”) has a legal responsibility to collect information to help plan and support learning and progression opportunities for our pupils.  The School is the controller and responsible for your personal data (collectively referred to as the School, “we”, “us” or “our” in this Privacy Notice).  When referring to “your” personal information, this also includes information held by us on you and your child(ren).

We respect your privacy and are committed to protecting your personal data.  This Privacy Notice will inform you as to how we look after personal data held by us and tell you about your privacy rights and how the law protects you.  It is important that you read this Privacy Notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data so that you are fully aware of how and why we are using personal data.  This Privacy Notice supplements the other notices and is not intended to override them.

Purpose of this Privacy Notice and Categories of Data

This Privacy Notice aims to give you information on how the School collects and processes your personal data.

The categories of information that we collect, hold and share include:

• Identity and Contact Information: such as name, unique pupil number, address, phone number and email address
• Characteristics: such as ethnicity, language, nationality, country of birth and free school meal eligibility
• Financial information: such as bank account details
• Attendance information such as sessions attended, number of absences and absence reasons
• Assessment information
• Medical: Relevant medical information relating to a pupil
• Special educational needs information
• Other data pertaining to exclusions/behavioural
• Technical data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website.
• Usage Data such as information about how you use our website, login data and account profiles/details relating to use of remote learning facilities.

We will also collect financial data and transactional data from parents/guardians such as bank details and data relating to invoices and payments.

To provide you further details relating to the purpose we hold personal data, the type of data we hold relating to that purpose and the legal basis for processing data, please see the table below.

In order to provide your child(ren) with an education at the School, we collect Special Categories of Personal Data (this may include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, information about health and genetic data). We may collect information about criminal convictions and offences.

How and why we collect and use this information

We will collect information in the following ways:

• Directly or by you filling in forms such as our data collection form
• Individual assessments (whether on School premises or remotely via our remote learning platforms)
• Parent meetings
• Correspondence via Letter, E-mail, text or remote learning platforms
• Surveys or other similar feedback mechanisms
• Through our website (which may collect personal data about you through the cookies used on our website and other similar technologies).

We use the data to:

• Support pupil learning and development
• Perform the contracts we have entered into with you
• Carry out and provide educational services
• Monitor and report on pupil progress
• Provide appropriate pastoral care and to safeguard pupils welfare
• Assess the quality of our educational services
• Assess how well pupils are doing
• Comply with the law regarding data sharing
• Ensure that this setting receives the statutory funding which it is eligible for

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have with you and/or to provide a safe and suitable setting for the education of pupils.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact the Data Protection Manager (details provided below).

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Prep and Kindergarten pupils only

We are required by law to pass some information to Essex County Council as the Local Authority (LA) and the Department for Education (DfE) through the Free Early Education Entitlement headcount and annual Early Years Census.

This information includes your child’s name, date of birth, home address, the number of Free Entitlement hours you are accessing for your child, and personal characteristics such as ethnic group and whether your child has special educational needs.

If you require more information about how the LA and DfE store and use this data please go to the following website:

www.essex.gov.uk/FEEE (see paragraph headed ‘Early Years census and personal data’).

Lower School Pupils only

Information about you that we hold includes your contact details, national curriculum assessment results, attendance information and personal characteristics such as your ethnic group, any special educational needs you may have and relevant medical information. (Please note attendance information is NOT collected as part of the Censuses for the Department for Education for the following pupils: a) in Nursery school; b) aged under 4 years in Maintained schools.)

We will not give information about you to anyone without your consent unless the law and our policies allow us to.

We are required by law to pass some information about you to the Department for Education (DfE) and, in turn, this will be available for the use of the LA.

If you need more information about how the LA and DfE store and use your information, then please go to the following website:

http://www.essex.gov.uk/ and follow the links to Education and Schools / Schools / Delivering education in Essex / Privacy policies for pupil data. If you are unable to access this website paper copies of this information can be obtained from the school office.

The Census and the National Pupil Database

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

• conducting research or analysis
• producing statistics
• providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data
• the purpose for which it is required
• the level and sensitivity of data requested: and
• the arrangements in place to store and handle the data

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received

To contact DfE: https://www.gov.uk/contact-dfe

Collecting Pupil Information

Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis.  In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.

The lawful bases on which we use this information

We collect and use pupil information under the following lawful bases for the purposes of GDPR:

• Article 6 (1) (c) – Processing is necessary for compliance with a legal obligation to which the controller is subject. The School has many legal obligations and it is necessary to process data to comply with those obligations or carry out their task of providing education.
• Article 6 (1) (d) – Processing is necessary to protect the vital interests of a data subject or another person
• Article 6 (1) (e) – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Examples would be: registration and attendance, achievement records, payment of school meals, informing parents of behavioural issues or whether the school is closed because of severe weather conditions.
• Article 9 (2) (g) – Processing is necessary for reasons of substantial public interest, which is proportionate to the aim pursued and is undertaken with suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Storing pupil data

We hold data for the duration of a pupil’s time at the School.  We will only retain personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

Taking Photos in School

From time to time photographs of pupils will be taken for the following reasons:

• As identification on our pupil database
• As part of school celebrations – performances, festivals, school trips
• the School literature – Prospectus
• the School website

Changes to the Privacy Notice and your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current.  Please keep us informed of your personal data changes during your relationship with us.  We will send you personal information update reminders during the school year.

Who we share pupil information with

We routinely share pupil information with:

• Schools or other educational institutions that pupils attend after leaving us or when joining us
• Our local authority or the local authority a pupil resides
• The Department for Education (DfE)
• Other bodies for the purpose of a pupils education, for example Exam Boards

Third party software providers

We use third party software providers to facilitate remote learning. These include:

• Microsoft Teams;
• Microsoft Office 365; and
• Tapestry Learning Journal.

It is recommend that you read the privacy notices of our third party software providers so that you are familiar with their data protection policies and procedures.

Why we share pupil information

We do not share information about our pupils with anyone without consent unless the law allows us to do so.  We share pupils’ data with the DfE on a statutory basis.  This data sharing underpins school funding and educational attainment policy and monitoring.

Data collection requirements

To find out more about the data collection requirements placed on us by the DfE, for example, via the school census, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

Data security

We have in place appropriate security measures to prevent your personal data from being accidently lost, used or accessed in an unauthorised way, altered or disclosed.  In addition, we limit access to your personal data to those employees who have to know for us to be able to provide education to pupils.  They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

Third-party links

Our website may include links to third-party websites, plug-ins and applications.  Clicking on those links or enabling those connections may allow third parties to collect or share data about you.  We do not control these third-party websites and are not responsible for their privacy statements.  When you leave our website, we encourage you to read the privacy notice of every website you visit.

Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Concerns and Contacting our Data Protection Manager

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

If you have any queries regarding any aspect of this Privacy Notice, please contact our Data Protection Manager, Mrs Elizabeth Bevan: dpm@stmaryscolchester.org.uk