PRIVACY NOTICE FOR PARENTS / CARERS – Use of your child’s data

We collect and use pupil information under section 537A of the Education Act 1996, and section 83 of the Children’s Act 1989. We also comply with Article 6(1) (c) and Article 9(2) (g) of the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA2018), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation.

Where data is processed by a controller or processor established in the European Union or comprises the data of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). This includes any replacement legislation coming into effect from time to time.

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about pupils.

We, Wixams Tree Primary or Wixams Academy, Green Lane, Wixams, Bedford, MK42 6BA are the ‘data controller’ for the purposes of data protection law.

Our data protection officer is Natalie Robertson, HR and Governance Manager.

The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about pupils includes, but is not restricted to:

We may also hold data about pupils that we have received from other organisations, including other schools, local authorities and the Department for Education.

Why we use this data

We use this data to:

Our legal basis for using this data

We only collect and use pupils’ personal data when the law allows us to. Most commonly, we process it where:

Less commonly, we may also process pupils’ personal data in situations where:

Where we have obtained consent to use pupils’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent and explain how consent can be withdrawn.

Some of the reasons listed above for collecting and using pupils’ personal data overlap, and there may be several grounds which justify our use of this data.

Collecting this information

While the majority of information we collect about pupils is mandatory, there is some information that can be provided voluntarily.

Whenever we seek to collect information from you or your child, we make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.

How we store this data

We keep personal information about pupils while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary in order to comply with our legal obligations. Our record retention schedule sets out how long we keep information about pupils.

Data sharing

We do not share information about pupils with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about pupils with:

National Pupil Database

We are required to provide information about pupils to the Department for Education as part of statutory data collections such as the school census. Some of this information is then stored in the National Pupil Database (NPD), which is owned and managed by the Department and provides evidence on school performance to inform research.

The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.

The Department for Education may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.

For more information, see the Department’s web page on how it collects and shares research data. You can also contact the Department for Education with any further questions about the NPD.

Youth support services

Once our pupils reach the age of 13, we are legally required to pass on certain information about them to the relevant Local Authority as it has legal responsibilities regarding the education or training of 13-19 year-olds.

This information enables it to provide youth support services, post-16 education and training services, and careers advisers.

Parents/carers, or pupils once aged 16 or over, can contact our data protection officer to request that we only pass the individual’s name, address and date of birth to the relevant Local Authority.

Transferring data internationally

Where we transfer personal data to a country or territory outside of the United Kingdom (or European Economic Area if applicable), we will do so in accordance with data protection law.

Parents and pupils’ rights regarding personal data

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them.

Parents/carers can make a request with respect to their child’s data where the child is not

considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent. For more information on how to make a subject access request, please view our Data Protection Policy, which is available on our website.

Other rights

Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe, including the right to:

Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our data protection officer via email to nrobertson@bcat.co.uk.

Alternatively, you can make a complaint to the Information Commissioner’s Office:

PRIVACY NOTICE FOR PUPILS – Use of your data

Wixams Academy, as part of Bedford College Academies Trust, processes personal data. This section outlines the purpose for which we process data, on what legal basis, and other areas relating to data processing such as the type of data we hold. It also covers the rights of individuals.

For what purpose do we collect personal data?

On what basis do we collect and handle personal data?

We collect and use pupil information under the Data Protection Act 2018. Our lawful basis for processing data is that it is a Public task and the processing is necessary for us to perform a task in the public interest. Our lawful basis for processing sensitive data is that processing is necessary for reasons of substantial public interest. We also collect and use data under section 537A of the Education Act 1996 and section 83 of the Children’s Act 1989.

The categories of pupil information that we collect, hold and share include:

Collecting pupil information

Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this. This includes the use of photographs for publicity.

Storing pupil data

We hold pupil data for 25 years from pupil’s date of birth.

Who do we share pupil information with?

We routinely share pupil information with:

Other categories of recipients of pupil information include:

As well as as processing personal data that we collect from you we also obtain information from other sources including.

Aged 14+ qualifications

For pupils enrolling for post 14 qualifications, the Learning Records Service will give us a pupil’s unique learner number (ULN) and may also give us details about the pupil’s learning or qualifications.

The Department for Educations Data and Local Authority

We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring. We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the data collection requirements placed on us by the Department for

Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

For more information about the department’s data sharing process including the National Pupil Database, please visit https://www.gov.uk/data-protection-how-we-collect-and-share-research-data.

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received

To contact DfE: https://www.gov.uk/contact-dfe.

Our Pupils Aged 13+

Once our pupils reach the age of 13, we also pass pupil information to our local authority provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

A parent/carer can request that only their child’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the child/pupil once he/she reaches the age 16.

Our pupils aged 16+

We will also share certain information about pupils aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13–19-year-olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

For more information about services for young people, please visit our local authority website.

Sharing pupil information

We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.

Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact your academy or school.

You also have the right to:

The information commissioner’s office provide detailed guidelines on the individual rights. This can be found on the link below. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/.

PRIVACY NOTICE FOR LAB MEMBERS AND TRUSTEES

To enable our LAB Members / Trustees to carry out their official functions to support our school we use personal information, for example:

The relevant school at which the LAB Members is based is the data controller for this information for LAB Members. The Trust is the data controller for this information for Trustees.  Data processors may support this activity through the provision of systems.

We are required by law to collect and use this information and our legal basis for using the personal information is a Public Task in the Public Interest and our Legal

Obligations under section 538 of the Education Act 1996. Our legal basis for using special category personal information is Substantial Public Interest.

We sometimes need to share some information, for example with:

Data is also entered manually on the Get Information About Schools (GIAS) system and held by DfE. Some of this information (e.g. name and role on the board) is publicly available.

We will not share your personal data with anyone else without your consent unless it is permitted by law.

The information we use will be retained until the LAB Member / Trustee ceases to work with the school or Trust, plus one year.

No personal information is routinely available outside of the UK. Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

PRIVACY NOTICE FOR EMPLOYEES

Employee Records

We are required to maintain employee records for our staff. The type of information used in these records includes:

The records may also contain special category personal information, for example:

This information is generally provided by you, and sometimes it is provided by others, such as:

The school at which you are based school is the data controller for this information. Data processors support this activity through the provision of systems. The legal basis we rely on when using this personal information is our employment contract with you and legitimate interests. The legal basis we rely on for the special category personal data is Employment, Social Security and Social Protection, and Substantial Public Interest.

Sometimes we may share this personal information, for example with one or more of the following:

This information will be retained for a minimum of 7 years from the end of the employment contract.

Recruitment Records

We collect information when recruiting to vacant posts. The information is likely to include:

The records may also contain special category personal information, for example:

Additional Needs (for interview purposes)

This information is generally provided by you, and sometimes it is provided by others, such as:

The school at which you are based is the data controller for this information. Data processors support this activity through the provision of systems. The legal basis’s we rely on when using this personal information is our Legitimate Interests and Legal Obligation. The legal basis we rely on for the special category personal data is Substantial Public Interest. Sometimes we may share this personal information, for example with one or more of the following:

For unsuccessful candidates this information will be retained for a minimum of one year. Successful candidates’ information will become part of their employee record (see first section of this notice – Employee Records).

General Information

No personal information is routinely available outside of the UK. Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

PRIVACY NOTICE FOR VOLUNTEERS

We sometimes have volunteers who come in to support our school activities. We are required to collect some information about them, for example:

Our legal basis for collecting and using this information is consent, but where we collect vetting information this is on the basis of our Legal Obligation. Where we are using your information with your consent you can withdraw your consent at any time by contacting the school.

We will keep your information whilst you are volunteering at the school, and retain for one year after your last support activity.

We also use personal information to:

No personal information is routinely available outside of the UK. Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.