Privacy Notice GDPR Compliant Schools

Privacy Notice GDPR Compliant Schools

Identity and contact details

Our postal address is:

Olchfa School

Gower Road

Sketty

Swansea

SA2 7AB

Our website address is:

www.olchfa.org.uk

Issues of how data is handled are dealt with by the Headteacher or the School’s Interim

Data Protection Officer (Mr Kim Collis, Local Authority Data Protection Officer, with

support from Mr Rhodri Jones, Interim Information Governance Officer).

As a public authority, we must comply with all relevant legislation relating to data

handling. The Information Commissioner’s Office (ICO) is the supervisory authority in

the United Kingdom established to ensure that your data rights are upheld.

Categories of personal data we hold

Obtaining, recording, holding and dealing with personal information is known as

‘processing’.

As a school the vast majority of information we collect is about our pupils but we do

also hold key information needed about parents / guardians and staff members.

Generally a school file may include:-

- Attendance data

- Academic achievements and progress

- Ethnicity

- Wellbeing and pertinent health information (medication, allergies and illnesses)

- Free School Meal eligibility

- Contact details of parents and guardians

- Minutes of meetings relating to the child

- Any statement of Special Educational Need and reviews of the same

- Reports and referrals to and from from other agencies if applicable – Youth

Offending Service and Social Services for example

The school as an employer will also hold a personnel file for all staff and this file will

generally consist of:-

- Contact details

- Bank details, National Insurance Number for payroll purposes

- Details of any references or DBS checks where applicable

- Details of driving licence and vehicle MOT / Insurance

- Details of any disciplinary action

- Information regarding sickness and annual leave

How the School collects and uses personal data

The School has a responsibility to provide its pupils with a good education in a safe

environment. It is necessary to collect personal data to enable the school to provide

pupils with an education, to track and monitor academic progress and to ensure those

with parental responsibility are kept informed of key milestones and achievements.

Some of the information will be provided to us by parents / guardians and some will be

generated by us whilst the pupil is in our School.

Here are some examples of how we collect and use your data:

Providing an education:

We generate and then hold the reports of a pupil’s progress and any examination

results. We generate and keep attendance data which can be analysed to ensure that

children are attending school regularly and attending on time. The school will on

occasion utilise educational apps and websites with the children, all of which will be

undertaken under the supervision of a staff member.

Maintaining school discipline and awarding positive behaviour:

As part of the school file we will create a behaviour record that would include all

significant incidents of breaches of the school discipline policy. This would include any

fixed term or permanent exclusions. The school file will also include examples of

excellence and achievements.

Keeping learners safe and improving wellbeing:

There may be occasion when the school will collect documentation regarding the

wellbeing of pupils. It is a legal requirement for all schools to develop and have in place

systems of safeguarding and promoting the wellbeing of children in their care. This

may involve documenting concerns and receiving information from other agencies

such as social services when they have a worry about a pupil. Monitoring wellbeing

allows the school to ensure the best possible services and support are available to the

pupil and their families.

This school also operates CCTV cameras within its grounds. The purpose of these

cameras are to maintain school discipline and to keep learners safe.

Keeping parents updated and involved in the school:

We do collect details of parents and guardians to ensure that we are able to keep you

informed of school events and activities.

To enable efficient administration and reduce the need for children to be carrying

money:

We have adopted a biometric fingerprint system for school meal purchases which

parents and pupils can take advantage of.

Recruitment:

When individuals apply to work for the School, we will only use the information they

supply to process their application and to monitor equal opportunities statistics.

Personal information about unsuccessful candidates will be held for six months after

the recruitment process has been completed, it will then be destroyed securely.

Once a person has taken up employment with the School we compile a personnel file

relating to their employment. The information contained in this is kept secure and will

only be used for purposes directly relevant to that employment.

The Source of Personal Data

The vast majority of personal data we hold will have been generated in the course of a

pupil attending the school or will have been provided to us directly from you. There

are occasions where personal data is collected about you in other ways.

This includes:

- When partner agencies share information with us to provide a joined-up service

to you.

- When you move into our local authority area, data may be shared from the

previous school or local authority area.

People We Share Data With

Service Provision:

We may share data with others to enable a requested or statutory service to be

provided. This could be where we use another agency to deliver the service for us or

where we collaborate with other agencies. An example would be that information

would be shared with the Local Authority to enable an assessment of a child’s special

educational needs. Another example would be the supply of information at your

request to contribute to a Child and Adolescent Mental Health assessment.

Transfer of information to another school/local authority:

Personal information about you may also be provided to other local authorities or

schools. An example would be where you have moved from one area to another or

start at a new school. The school file will be securely transferred to the new Local

Authority / School.

Health Information

In some circumstances we may share information with NHS professionals providing

services to our school children. This would be for services such as vaccinations, dental

provision and school nursing activities.

We may collect health information on staff members when such information is

supplied as part of the sickness policy and / or following referrals to occupational

health.

Transfer of information required by law:

We also share personal information where we are required to do so by law. Examples

include where we are required by law to report matters to Welsh Government who

then in turn publish a lot of the data they receive:

https://statswales.gov.wales/catalogue/education-and-skills

Another example would be our duties to share information with social services when

they are carrying out their protective functions or the police when carrying out

investigations.

How long we keep your data

Data is held for no longer than is necessary and the School follows legal guidelines on

how long information should be kept before it is securely destroyed.

The timeframe for holding data is different depending on the type of data involved.

To see our full retention schedule please visit our website where the retention

schedule is included in our Data Protection Policy.

Transfers outside the European Economic Area

We do not share personal information beyond the European Economic Area (EEA) save

for should a pupil move to a school outside of the EEA. This is quite rare but does occur

particularly with children of British Forces personnel. In this circumstance the school

file will be securely transmitted to the new school / authority as appropriate.

Your Data Rights

In so far as is compatible with legal requirements you have a number of rights in

respect of your data:

1. Rightto be informed. We must be completely transparent with you by

providing information ‘in a concise, transparent, intelligible and easily accessible

form, using clear and plain language’. Our privacy notice is one of the ways we

try and let you know how data is handled.

2. Right of access. You have the right to access your personal information. Parents

also have the right to access the educational record of the pupil.

3. Rightto rectification: You have the right without undue delay to request the

rectification or updating of inaccurate personal data.

4. Rightto restrict processing: You can ask for there to be a restriction of

processing such as where the accuracy of the personal data is contested. This

means that we may only store the personal data and not further process it

except in limited circumstances

5. Rightto object: You can object to certain types of processing such as direct

marketing. The right to object also applies to other types of processing such as

processing for scientific, historical research or statistical purposes (although

processing may still be carried out for reasons of public interest).

6. Rights on automated decision making and profiling: The law provides

safeguards for you against the risk that a potentially damaging decision is taken

without human intervention. The right does not apply in certain circumstances

such as where you give your explicit consent.

7. Rightto data portability: where personal data is processed on the basis of

consent and by automated means, you have the right to have your personal data

transmitted directly from one data controller to another where this is

technically possible.

8. Rightto erasure or ‘rightto be forgotten’: you can request the erasure of

personal data including when: (i) the personal data is no longer necessary in

relation to the purposes for which they were collected (ii) you no longer provide

your consent, or (iii) you object to the processing.

The Information Commissioner regulates data handling by organisations in the U.K.

and work to uphold the data rights of citizens, their website provides more information

on the rights available to you:

https://ico.org.uk/for-the-public/

Withdrawing Consent

If you consented to providing your personal information to us and you have changed

your mind and you no longer want the School to hold and process your information,

please let us know.

If you encounter any difficulties in withdrawing consent, please contact the

Headteacher olchfa.school@swansea-edunet.gov.uk or the School’s Interim Data

Protection Officer data.protection@swansea.gov.uk (Kim Collis, Local Authority Data

Protection Officer, with support from Rhodri Jones, Interim Information Governance

Officer).

Automated Decision Making and Profiling

The School does not carry out automated decision-making, and as such any decision

taken by us which affects you will always include human intervention. We do on

occasion carry out profiling and track the progress of pupils to enable us as a School to

target services to those who are in need of help and support.

The Rightto Complain About Data Handling

The School sets very high standards for the collection and appropriate use of personal

data. We therefore take any complaints about data handling very seriously. We

encourage you to bring to our attention where the use of data is unfair, misleading or

inappropriate and we also welcome suggestions for improvement.

Informal Resolution:

In the first instance we would ask that you try and resolve data handling issues directly

with the Headteacher or any member of the senior leadership team

olchfa.school@swansea-edunet.gov.uk. We are committed to handling data

appropriately and are confident that we can resolve most issues informally.

Formal Resolution:

You can ask for your issue to be investigated by writing to:

The School’s Interim Data Protection Officer data.protection@swansea.gov.uk (Mr

Kim Collis, Local Authority Data Protection Officer, with support from Mr Rhodri

Jones, Interim Information Governance Officer).

If you remain dissatisfied following the response to your contact with the school, if it

relates to issues of data handling you can raise the issue with the Information

Commissioner. It is free of charge to contact the Information Commissioner and

request their assistance.

Information Commissioner’s Office – Wales

2nd Floor, Churchill House

Churchill Way

Cardiff

CF10 2HH

Telephone: 029 2067 8400

Fax: 029 2067 8399

Email: wales@ico.org.uk