St Christopher's C of E (Primary) Multi-Academy Trust PRIVACY NOTICE

Transcription

1 St Christpher's C f E (Primary) Multi-Academy Trust PRIVACY NOTICE This plicy is t let yu knw hw St Christpher's C f E (Primary) Multi-Academy Trust ('the academy', 'the trust', 'we', 'us' r 'ur') will cllect, use and prcess Persnal Data. It is als designed t let yu knw yur rights and what yu can d if yu have questins abut Persnal Data. The Trust is the cntrller fr the purpses f data prtectin laws. This dcument sets ut the types f Persnal Data (meaning infrmatin abut an individual frm which that individual can be persnally identified) we handle, the purpses f handling thse Persnal Data and any recipients f it. 1 OUR DETAILS We are: St Christpher's C f E (Primary) Multi-Academy Trust Address: Unit 5, Basepint Business Centre, Yefrd Way, Marsh Bartn, Exeter, Devn, EX2 8LB Infrmatin Cmmissiner's Office Registratin Number: ZA The Trust Data Prtectin Officer is: J Wilkey and their cntact details are: ffice@stchristphersmat.rg The Ark Federatin Academies: Beer C f E Primary Schl / All Saints CE Primary Schl Address: Mare Lane, Beer, Seatn, Devn EX12 3NB / All Saints, Nr Axminster, Devn EX13 7LX The Academy Data Prtectin Cntact is: Amanda Blackmre and their cntact details are: ablackmre@arkstcmat.rg 2 WHY WE COLLECT DATA We cllect and hld persnal infrmatin relating t ur pupils, parents, emplyees, gvernrs and thers. We may als receive infrmatin abut pupils frm their previus schls, the Lcal Authrity, Department fr Educatin (DfE) and ther bdies linked t pupils' educatin, develpment and welfare. We may share Persnal Data with ther agencies as necessary under ur legal duties r therwise in accrdance with ur duties/bligatins as a Trust/academy Whilst the majrity f Persnal Data we are prvided with r cllect is mandatry, sme f it is prvided t us n a vluntary basis. We will infrm yu whether yu are required t prvide certain pupil infrmatin t us r if yu have a chice in this. 1

2 Belw are set ut sme f the reasns why we cllect and prcess Persnal Data, as well as the legal basis n which we carry ut this prcessing: t supprt ur pupils learning: we will prcess Persnal Data t help every child achieve his r her ptential in all areas f learning and t facilitate a high quality teaching prvisin at ur academy. mnitr and reprt n their prgress: we will prcess Persnal Data t recrd pupils' prgress t help set and mnitr targets and bst achievements and aspiratins f all pupils. prvide apprpriate pastral care: we will prcess persnal data t ensure that all pupils are prperly supprted in their time with us. We will prcess data t help staff understand and respnd t the unique circumstances f all pupils. assess the quality f ur services: we will prcess Persnal Data s that we may reflect n ur wn practices t help us imprve and prvide the highest quality educatin that we can t all pupils. t ensure prper management f schl trips and afterschl clubs and activities: when pupils and parents participate in schl trips and afterschl clubs and activities Persnal Data will need t be prcessed. t prmte and prtect health and safety: in rder t prtect pupils, parents and staff in their invlvement at the Trust/academy, we must prcess Persnal Data relating t matters such as incidents and respnses t incidents. t enable individuals t be paid: t assist in the running f the Trust/academy and t enable individuals t be paid, we will prcess Persnal Data f thse emplyed t teach r therwise engaged t wrk at the Trust/academy. t assist with the cntinuing develpment f ur recruitment and retentin plicies and practices: t enable us t better ur recruitment and retentin plicies and practices, we will prcess Persnal Data f thse currently emplyed by the Trust/academy. t develp ur understanding f ur wrkfrce and hw emplyees are deplyed: t help us create a fully infrmed, cmprehensive picture f the make-up f ur wrkfrce and hw each emplyee is utilised as a member f ur wrkfrce, we will prcess Persnal Data f thse emplyed t teach r therwise engaged t wrk at the Trust/academy. 3 LEGAL BASIS FOR PROCESSING The lawful basis fr us t cllect/prcess this Persnal Data is in rder t prvide educatin in accrdance with statute law (such as the Educatin Act 1996 and ther legislatin), ur funding agreements with the Secretary f State, ur memrandum and articles f assciatin and ther guidance prvided fr in law. We als prcess Persnal Data where prcessing is necessary fr the perfrmance f tasks carried ut in the public interest. It is in the public interest t prvide educatinal services t ur pupils and t ffer extra-curricular activities such as reading sessins and afterschl clubs t benefit the persnal and academic grwth f ur pupils. An additinal lawful basis fr us t cllect/prcess emplyees' Persnal Data is by reasn f necessity fr the perfrmance f a cntract f emplyment t which the Data Subject is party, r in rder t take steps at the request f the Data Subject prir t entering int a cntract. 2

3 In additin, Persnal Data will be cllected and/r prcessed fr the purpses f relevant cntracts fr the prvisin f services which are paid fr. This may include but is nt limited t: the prvisin f music tuitin; schl trips; entering students fr examinatins. We d nt prcess any special categries f Persnal Data except where necessary fr reasns f substantial public interest in cmplying with legal bligatins including under the Equality Act 2010 r where necessary t prtect the vital interests f the Data Subject r f anther natural persn and where safeguards are in place t ensure that this Persnal Data is kept secure. Fr the avidance f dubt where special categries f Persnal Data are cllected it shall nt be used fr the purpses f autmated decisin making and/r prfiling. Special categries f data means Persnal Data revealing: racial r ethnic rigin; plitical pinins; religius r philsphical beliefs r trade unin membership; genetic r bimetric data that uniquely identifies yu; data cncerning yur health, sex life r sexual rientatin; r data relating t criminal cnvictins r ffences r related security measures. Further Persnal Data including special categries f Persnal Data may be cllected and/r prcessed where cnsent has been given (fr example, schl phtgraphs fr nn-educatinal purpses). If cnsent is the nly legal basis fr prcessing and has been given then this may be revked in which case the Persnal Data will n lnger be cllected/prcessed. 4 CATEGORIES OF INFORMATION WE COLLECT We may cllect the fllwing types f Persnal Data (please nte this list des nt include every type f Persnal Data and may be updated frm time t time): name and cntact details; (address, telephne numbers, address etc.) date f birth;health and/r ther medical infrmatin; infrmatin in cnnectin with educatin (included but nt limited t unique pupil numbers, test results, pst 16 learning infrmatin and ther recrds); attendance infrmatin; behaviural and disciplinary infrmatin; free schl meal eligibility; infrmatin received in cnnectin with any cmplaint; persnal characteristics, such as: their natinality and ethnic grup; 3

4 their religin; their first-language; any special educatinal needs they may have; any relevant prtected characteristics. emplyees' qualificatins and cntractual infrmatin, such as: right t wrk infrmatin; emplyee psitin and/r rle; salary; emplyment start date; remuneratin details (including natinal insurance and ther financial details). Tax cdes Bank accunt details DBS and ther barring checks under the Single Central Recrd 5 WHO WILL HAVE ACCESS TO YOUR DATA Persnal Data will be accessible by members f staff. Where necessary, vlunteers, trustees and gvernrs will als have access t Persnal Data. We will nt share infrmatin abut ur pupils with third parties withut cnsent unless we are required t d s by law r ur plicies. We will disclse Persnal Data t third parties: if we are under a duty t disclse r share yur Persnal Data in rder t cmply with any legal bligatin; fr example: We are required t share infrmatin abut ur emplyees with the DfE in rder t cmply with ur legal bligatins as set ut by acts f Parliament and assciated legislatin and guidance. We share pupils' Persnal Data with the Department fr Educatin (DfE) in relatin t schl funding / expenditure and the assessment f educatinal attainment in rder t cmply with ur legal bligatins as set ut by acts f Parliament and assciated legislatin and guidance. in rder t enfrce any agreements with yu; in rder t perfrm cntracts with third party suppliers fr purpses listed in Sectin 0. Our third party suppliers include: See Appendix 1 t prtect the rights, prperty, r safety f the Trust, the academy, ther pupils r thers. This includes exchanging infrmatin with ther rganisatins fr the purpses f child welfare. This may include ur Lcal Authrity, the DfE (please see Sectin 6), the Plice and ther rganisatins where necessary; fr example, fr the purpses f rganising a schl trip r therwise enabling students t access services r fr the purpses f examinatin entry. Infrmatin may 4

5 als be sent t ther schls where necessary; fr example, schls that pupils attend after leaving us. Certain data cllectin bligatins are placed n us by the DfE. T find ut mre abut the data cllectin requirements placed n us by the DfE (fr example; via the schl census) visit: The abve listed third party suppliers n Appendix 1 will prcess data n ur behalf. Therefre, we investigate these third party suppliers t ensure their cmpliance with Relevant Data Prtectin Laws and specify their bligatins in written cntracts. 6 PUPIL DATA THE NATIONAL PUPIL DATABASE The NPD is wned and managed by the DfE and cntains infrmatin abut pupils in schls in England. It prvides invaluable evidence n educatinal perfrmance t infrm independent research, as well as studies cmmissined by the DfE. It is held in electrnic frmat fr statistical purpses. This infrmatin is securely cllected frm a range f surces including schls, academies, lcal authrities and awarding bdies. We are required by law, t prvide infrmatin abut ur pupils t the DfE as part f statutry data cllectins such as the schl census and early years census. Sme f this infrmatin is then stred in the NPD. The law that allws this is the Educatin (Infrmatin Abut Individual Pupils) (England) Regulatins T find ut mre abut the NPD, g t The DfE may share infrmatin abut ur pupils frm the NPD with third parties wh prmte the educatin r well-being f children in England by: cnducting research r analysis; prducing statistics; prviding infrmatin, advice r guidance. The DfE has rbust prcesses in place t ensure the cnfidentiality f ur data is maintained and there are stringent cntrls in place regarding access and use f the data. Decisins n whether DfE releases data t third parties are subject t a strict apprval prcess and based n a detailed assessment f: wh is requesting the data; the purpse fr which it is required; the level and sensitivity f data requested: and the arrangements in place t stre and handle the data. T be granted access t pupil infrmatin, rganisatins must cmply with strict terms and cnditins cvering the cnfidentiality and handling f the data, security arrangements and retentin and use f the data. Fr mre infrmatin abut the department s data sharing prcess, please visit: 5

6 Fr infrmatin abut which rganisatins the DfE has prvided pupil infrmatin, (and fr which prject), please visit the fllwing website: T cntact the DfE please visit: 7 EMPLOYEE DATA DFE DATA COLLECTION REQUIREMENTS] The DfE cllects and prcesses Persnal Data relating t thse emplyed by schls (including Multi Academy Trusts) that wrk in state funded schls (including all academies). All state funded schls are required t make a census submissin because it is a statutry return under sectins 113 and 114 f the Educatin Act T find ut mre abut the data cllectin requirements placed n us by the DfE including the data that we share with them, g t The DfE may share infrmatin abut schl emplyees with third parties wh prmte the educatin r well-being f children r the effective deplyment f schl staff in England by: cnducting research r analysis; prducing statistics; prviding infrmatin, advice r guidance. The DfE has rbust prcesses in place t ensure that the cnfidentiality f Persnal Data is maintained and there are stringent cntrls in place regarding access t it and its use. Decisins n whether the DfE releases Persnal Data t third parties are subject t a strict apprval prcess and based n a detailed assessment f: wh is requesting the data; the purpse fr which it is required; the level and sensitivity f data requested; and the arrangements in place t securely stre and handle the data. T be granted access t schl emplyee data, rganisatins must cmply with the DfE's strict terms and cnditins cvering the cnfidentiality and handling f the data, security arrangements and retentin and use f the data. Fr mre infrmatin abut the DfE's data sharing prcess, please visit: T cntact the DfE: 8 HOW DATA WILL BE PROCESSED Persnal Data may be prcessed in a variety f ways; this will include but is nt limited t: maintaining written recrds fr educatinal r emplyment purpses; medical r allergy infrmatin displays; 6

7 identificatin; sending by ; adding t spreadsheets, wrd dcuments r similar fr the purpses f assessing Persnal Data; fr educatinal sftware use (this culd be fr the purpses f helping children learn, discipline, reprts and ther educatinal purpses). Fr financial management and statutry reprting purpses 9 WHERE WE STORE DATA AND HOW WE KEEP DATA SECURE Paper cpies f Persnal Data are kept securely at the schl; fr example, in secure filing cabinets. Electrnic cpies f Persnal Data are kept securely and infrmatin will nly be prcessed where we are satisfied that it is reasnably secure. All infrmatin yu prvide t us is stred n secure servers. Where we have given yu (r where yu have chsen) a passwrd which enables yu t access certain parts f ur website, yu are respnsible fr keeping this passwrd cnfidential. Yu must nt share yur passwrd with anyne. When giving Persnal Data t third parties (fr example, sftware prviders) it is pssible that this Persnal Data culd be stred in a lcatin utside f the Eurpean Ecnmic Area. We will take all steps reasnably necessary t ensure that yur Persnal Data is treated securely and in accrdance with this privacy plicy. In particular, any transfer f yur Persnal Data made by us t a lcatin utside f the EEA will be gverned by clauses in a written cntract in rder t keep these secure. 10 RETENTION PERIODS We will nly retain Persnal Data fr as lng as is necessary t achieve the purpses fr which they were riginally cllected. As a general rule, Persnal Data will be kept fr the entire perid that a child is a pupil at the Trust. Persnnel files fr emplyees shuld be retained fr 6 years after emplyment, r lnger if there has been an issue with either safeguarding r a Health and Safety prsecutin. Other recrds (fr example, safeguarding r in relatin t special educatinal needs) will be kept fr lnger in accrdance with guidance frm the Infrmatin and Recrds Management Sciety. Further infrmatin n retentin perids can be btained by cntacting us via the details in Sectin 1 f this Ntice. Once the retentin perid cncludes the data is securely and safely destryed/ deleted. 11 YOUR DATA RIGHTS The General Data Prtectin Regulatin and assciated law gives yu rights in relatin t Persnal Data held abut yu and yur child. These are: Right t be infrmed: yu have the right t be infrmed abut the cllectin and use f yur data. This plicy cntains infrmatin in relatin t the cllectin f yur Persnal Data, hwever, if we cllect additinal data fr ther purpses, we will infrm yu abut this. Right f Access: if yur Persnal Data is held by the Trust/academy, yu are entitled t access yur Persnal Data (unless an exceptin applies) by submitting a written request. We will aim respnd t that request within ne mnth. If respnding t yur request will 7

8 take lnger than a mnth, r we cnsider that an exceptin applies, then we will let yu knw. Yu are entitled t access the Persnal Data described in Sectin 12. Right f Rectificatin: yu have the right t require us t rectify any inaccurate Persnal Data we hld abut yu. Yu als have the right t have incmplete Persnal Data we hld abut yu cmpleted. If yu have any cncerns abut the accuracy f Persnal Data that we hld then please cntact us. Right t Restrictin: yu have the right t restrict the manner in which we can prcess Persnal Data where: the accuracy f the Persnal Data is being cntested by yu; the prcessing f yur Persnal Data is unlawful, but yu d nt want the relevant Persnal Data t be erased; r we n lnger need t prcess yur Persnal Data fr the agreed purpses, but yu want t preserve yur Persnal Data fr the establishment, exercise r defence f legal claims. Where any exercise by yu f yur right t restrictin determines that ur prcessing f particular Persnal Data are t be restricted, we will then nly prcess the relevant Persnal Data in accrdance with yur cnsent and, in additin, fr strage purpses and fr the purpse f legal claims. Right t Erasure: yu have the right t require we erase yur Persnal Data which we are prcessing where ne f the fllwing grunds applies: the prcessing is n lnger necessary in relatin t the purpses fr which yur Persnal Data were cllected r therwise prcessed; ur prcessing f yur Persnal Data is based n yur cnsent, yu have subsequently withdrawn that cnsent and there is n ther legal grund we can use t prcess yur Persnal Data; the Persnal Data have been unlawfully prcessed; and the erasure is required fr cmpliance with a law t which we are subject. Right t Data Prtability: yu have the right t receive yur Persnal Data in a frmat that can be transferred. We will nrmally supply Persnal Data in the frm f s r ther mainstream sftware files. If yu want t receive yur Persnal Data which yu have prvided t us in a structured, cmmnly used and machine-readable frmat, please cntact us via the details in Sectin 1 f this Ntice. Right t bject: yu have the right t bject t the prcessing f yur Persnal Data where ne f the fllwing grunds apply: the prcessing is based n legitimate interests r the perfrmance f a task in the public interest; the prcessing is fr direct marketing; r the prcessing is fr the purpses f scientific/ histrical research and statistics. Yu can find ut mre abut the way these rights wrk frm the website f the Infrmatin Cmmissiner's Office (ICO). 8

9 12 REQUESTING YOUR DATA Where the Trust/academy hlds Persnal Data cncerning yu, yu are entitled t access that Persnal Data and the fllwing infrmatin (unless an exceptin applies): a cpy f the Persnal Data we hld cncerning yu, prvided by the Trust/academy; details f why we hld that Persnal Data; details f the categries f that Persnal Data; details f the envisaged perid fr which that Persnal Data will be stred, if pssible; infrmatin as t the surce f Persnal Data where that Persnal Data was nt cllected frm yu persnally. If yu want t receive a cpy f the infrmatin abut yur sn/daughter that we hld, please cntact us via the details in Sectin 1 f this Ntice. 13 MAKING A COMPLAINT If yu are unhappy with the way we have dealt with any f yur cncerns, yu can make a cmplaint t the ICO, the supervisry authrity fr data prtectin issues in England and Wales. We wuld recmmend that yu cmplain t the Trust/academy in the first instance, but if yu wish t cntact the ICO n the details yu can d s n the details belw. The ICO is a whlly independent regulatr established in rder t enfrce data prtectin law. ICO Cncerns website: ICO Helpline: ICO casewrk@ic.rg.uk ICO Pstal Address: Infrmatin Cmmissiner's Office Wycliffe Huse Water Lane Wilmslw Cheshire SK9 5AF 14 CHANGES TO THIS NOTICE Any changes we make t this ntice in the future will be psted n ur website. Please check back frequently t see any updates r changes. This privacy plicy was last updated May

10 Appendix 1 List f Third Party Suppliers (fr bth schls unless indicated therwise) 2Simple Ltd (All Saints) Babcck Internatinal Capita Educatin Sftware Services Cmputershare Vucher Services Ltd Cl Milk at Schl Ltd Department f Educatin Devn Cunty Cuncil Devn Nrse Disclsure and Barring Service Discvery Educatin Eurpe Ltd Egress Sftware Technlgies Ltd FFT Educatin GDPRiS H Tempest Ltd Harringtn Bates Lcal Fd Links Ltd (All Saints) Natinal Fundatin fr Educatin Research (NFER) Ofsted Okehamptn YHA Orvia Grup Ltd Parentpay Ltd (Beer) Parent Teacher Assciatins Peninsula Pensins PS Financials Ltd Renaissance Learning UK Ltd (Accelerated Reader) (All Saints) Rckley Watersprts Ltd Smart Payments Ltd (Eduspt) Scmis Ltd Suth West Grid fr Learning TME (Suth West) Ltd Teachers2Parents Ltd (Eduspt) Teachers Pensins The Fundatin Stage Frum Ltd (Tapestry) (Beer) Virgincare/NHS 10