Privacy Policy - St peter St Paul School

Who Are We ?

St Peter & St Paul School is a non-selective, co-educational independent day school for children aged 4 to 11. This Privacy Policy explains your privacy rights and how we gather, use, store and share any personal information we collect about you. St Peter & St Paul School is a data controller and is registered with the Information Commissions Office (ICO).

Overview

Our aim is to ensure that all personal data collected about children, parents, staff, trustees, visitors and other individuals is collected, stored and processed in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018). Personal information means any information relating to you, or information that when combined with other information identifies you. Personal information includes your name, address and photographs and also includes online identifiers such as internet protocol (IP) addresses, or cookie identifiers. This policy applies to all personal data, regardless of whether it is in paper or electronic format.

What We Collect and How We Collect It

Parents and Children

Admissions
The information we collect is used for the safety and welfare of our children and the effective managing of our school. We collect most of the information directly from parents although we may also collect information from third parties such as a previous school or a professional.

We collect information such as contact details, children’s names and ages and current school, where applicable, when you first make an enquiry. We may contact you in the future to let you know about open mornings or if a space becomes available in a specific year group.

Information is collected when you complete the admissions paperwork where we collect all relevant information about you and your child / children. This includes name, date of birth, contact details, address, current and previous schools. We ask for this information so that we can process and assess the application against our admission criteria and to enable us to communicate with parents effectively.

Some of the information we collect is of a sensitive nature such as nationality, ethnicity, languages spoken and any individual needs a child might have to ensure we make effective provision for them, and also to provide statistical information. We also collect information about the family circumstance where it may affect your child’s welfare or happiness.

When we offer a place and this is accepted, we will ask for further information, including details of medical history and dietary needs. This is so that we can provide appropriate health care to all children.

Personal information is also collected directly from parents by direct means such as meetings, discussions and in general correspondence.

Financial information
We will ask for, and hold the details of, those who will pay any fees due. In some cases, we get information about you from third parties or from your child's previous school(s). If you make a bursary application, we will hold more detailed financial information which will be shared by the Finance team with us.

Photographs and videos
We also hold photographs or videos of your child (if you have given your consent) and may publish these on our website or on social media. We may continue to use their photographs after they have left school.

For the Employment and Management of our Staff

We record information about potential staff when they apply for vacancies, current staff and former staff.

Contractual responsibilities
We record and process staff personal information in order to fulfil our contract of employment with our staff and to monitor our employment policies.

This information includes (but is not limited to) their name, address, date of birth, next of kin and emergency contact details, applications for employment, academic qualifications, registrations with professional bodies, ethnicity, salary information, bank account and pension details, relevant medical history and any individual needs including those relating to disability.

Statutory responsibilities
We collect, record and process some personal information to comply with our statutory responsibilities. This includes (but is not limited to) information relating to Tax, National Insurance, statutory sick pay, statutory maternity and paternity pay, family leave, entitlement to work in the UK, proof of identity, Disclosure and Barring Service checks and criminal convictions.

Management responsibilities
We record information that enables us to support the personal development of our staff and to assess their performance. This includes personal development appraisals, performance monitoring, capability, grievance and disciplinary matters, absence and sickness monitoring.

Collection of data
Some data is collected directly from prospective or newly appointed staff. Other personal data is collected from third parties, such as references from former employers, medical information, or identity checks via an external identity checking service. We will only seek information from third parties with the applicant’s consent.

Trustees

We record and process information in relation to our Trustees in order to comply with statuary regulations such as DBS checks, for their safety such as next of kin information, and in order to be able to contact them.

Volunteer and other Visitors to School

We will collect and record information on volunteers and other visitors to school in order to safeguard the children or to make contact with them.

How We Use Your Data

Educating your Child and Supporting their Learning

We record and process information that monitors and assesses children’s academic progress. This includes baseline assessments that support educational tracking – giving measures of an individual's potential and progress through school.

A child may have special educational needs if they have a learning difficulty or disability which calls for special educational provision to be made for them.

Keeping them safe

The safety and welfare of our children will always be our overriding concern. Fears about sharing information will not be allowed to stand in the way of the need to promote the welfare, and protect the safety of children and so we will share information in a timely manner for effective safeguarding.

We would aim to gain consent before sharing information; if it is not possible to gain consent, it cannot be reasonably expected that a practitioner gains consent, or if to gain consent would place a child at risk, information will be shared without consent in the interests of the child.

Staff will never promise a child that they will not tell anyone about a report of abuse, as this may not be in the child’s best interests. We record and monitor information on children’s attendance and absence and may record and process information about our children's personal and social development in order to provide them with appropriate pastoral care.

Confidential information and records will be held securely and only available to those who have a right or professional need to see them. Safeguarding records relating to individual children will be retained for a reasonable period of time after they have left the school.

If a child for whom the School has, or has had, safeguarding concerns moves to another school, the DSL will ensure that their child protection file is forwarded promptly and securely, and separately from the main pupil file. In addition, if the concerns are significant or complex, and/or social services are involved, the DSL will speak to the DSL of the receiving school and provide information to enable them to have time to make any necessary preparations to ensure the safety of the child.

Communicating with Parents of Former Pupils

We may contact parents of former pupils to invite them and their children to events at St Peter & St Paul School which we think may be of interest to them.

Our Legal Basis for Processing Personal Information

We process personal information where one of the following applies:

Legitimate Interests

This means that the processing is necessary for legitimate interests pursued by St Peter & St Paul School, unless this would override your fundamental rights, taking into account your reasonable expectations. We rely on legitimate interests for many of the ways in which we process personal information, including providing educational services to our children and managing our school effectively.

Necessary for a Contract

We may need to process personal information in order to perform our obligations under contract, or to gather information prior to entering into a contract. For example, we need your name and contact details so that we can update you on a child’s progress, so that we can contact you if there is a concern, or so that we can process information about school fees. We also process the personal information of our staff as part of our contract of employment with them.

Legal Obligation

We are under a duty to comply with a number of legal obligations and we will process personal information in connection with these. Legal obligations can relate to safeguarding, health and safety and statistical returns to the Government. Where necessary we may share personal information with other service providers, such as insurers and professional advisers.

Vital Interests

We may process personal information if we believe this is necessary to protect an individual’s vital interests. This might include sharing allergy information with third party caterers, or other health information with medical professionals providing treatment.

Consent

Where none of these conditions apply and we still wish to process your personal information we will ask for parent’s consent. If we ask for consent, we will be clear about what we are asking to do with your personal information. Where we are relying on consent to process personal information you may withdraw your consent at any time. Please note that we may need to continue to process personal information under one of the other grounds set out above.

Our Legal Basis for Processing Special Categories of Personal Data

Data protection legislation also refers to “special categories of personal data” which is more sensitive personal information needing a higher level of protection. This includes data revealing racial or ethnic origin, trade union membership, data concerning health or data concerning a person’s sexual orientation. We take extra care when processing this type of information and will only process this type of information when one of the following applies:

Data Revealing Racial or Ethnic Origin

We collect information on the ethnicity, first language, country of birth and nationality where we are under a statutory obligation to complete an annual school census and return to the Secretary of State for Education.

Data concerning health

We record information on the health of our staff where this is necessary to fulfil our obligations under employment law, make adjustments to support them, calculate their entitlement to sick pay or to ensure the safety of children in their care.

We may record and process information on the health of our children in the following areas:

Safeguarding – it may be necessary for us to record information on the physical or mental health of our children and share this with health or social care professionals in order to ensure our children receive appropriate health or social care treatment.
Pastoral care – we may record information concerning the social, psychological or physical development of our children and this may include information concerning their health, in order to make provision for appropriate health or social care treatment.
Special Educational Needs and
Disability (SEND) – when we record information on a child’s individual needs this may include information concerning their health. Where we do this, it is in order to make provision for appropriate health or social care treatment.
Medical care – we record information on any pre-existing medical issues of our children and any medical episodes they experience at school. This is in order to make provision for appropriate health treatment.

Data Concerning a Person’s Sexual Orientation

We may record information on a child’s sexual orientation where this is necessary to provide appropriate safeguarding or pastoral care. We will do this where we believe it is necessary to make provision for appropriate health or social care treatment, protect a child from physical, mental or emotional harm, or protect their physical, mental or emotional wellbeing.

Consent

Where none of the above conditions apply and we still wish to process special categories of personal data we will ask for consent. If we ask for consent, we will be clear about what we are asking to do with any sensitive personal information, and the person providing consent may withdraw this at any time.

How Long do we Keep Personal Information?

In line with the law, we keep information for as long as is necessary in order to carry out the services and activities listed above.

We retain some information after our children have left St Peter & St Paul School, for example, pupil roll, exam results, and safeguarding information. We may keep some limited information for a longer time if we believe this is appropriate for historical, research or statistical purposes.

How and Why We Share Your Information

For legal reasons we may share your details with local authorities and the Department of Education. We will share details with other schools or the local education authority to pass on children’s information when they leave St Peter & St Paul School.

We may share information with relevant professionals where we believe there is a special educational need and to put in place the necessary support.

We may on occasion need to share information with the emergency services, the Police, our legal advisors and our insurers. We will also share information with HMRC and pension suppliers in relation to tax and pension information for staff.

We may share data with our suppliers or contractors to enable us to provide services to our staff and children. When doing this, we will:

Only appoint suppliers or contractors who can provide sufficient guarantees that they comply with data protection law;
Establish a data sharing agreement with the supplier or contractor, either in the contract or as a standalone agreement, to ensure the fair and lawful processing of any personal data we share;
Only share data that the supplier or contractor needs to carry out their service, and information necessary to keep them safe while working with us.

Where we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

Your Rights

You have a right to access the information held, correct any incorrect information and delete information in certain circumstances. Individuals have a right to make a ‘subject access request’ to gain access to personal information that St Peter & St Paul School holds about them. This includes:

Confirmation that their personal data is being processed;
Access to a copy of the data;
The purposes of the data processing;
The categories of personal data concerned;
Who the data has been, or will be, shared with;
How long the data will be stored for, or if this isn’t possible, the criteria used to determine this period;
The source of the data, if not the individual;
Whether any automated decision-making is being applied to their data, and what the significance and consequences of this might be for the individual.

Subject access requests must be submitted in writing, either by letter or email to the Headteacher. They should include:

Name of individual;
Correspondence address;
Contact number and email address;
Details of the information requested.

Our Website

Personal Data

We may collect, store and use the following kinds of personal data:

information about your computer and about your visits to and use of this website, such as your IP address, geographical location, browser type, referral source, length of visit and number of page views;
information that you provide to us for the purpose of registering with us;
email notifications and / or newsletters; and
any other information that you choose to send to us.

Cookies

We use cookies on this website. A cookie is a text file sent by a web server to a web browser and stored by the browser. The text file is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.

We may send a cookie which may be stored by your browser on your computer's hard drive. We may use the information we obtain from the cookie in the administration of this website to improve the website's usability and for marketing purposes. We may also use that information to recognise your computer when you visit our website, and to personalise our website for you.

Google Analytics

We use Google Analytics to analyse the use of this website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users' computers. The information generated relating to our website is used to create reports about the use of the website. Google will store this information. Google's privacy policy is available at: http://www.google.com/privacypolicy.html

Third Party Websites

The website may contain links to other websites. We are not responsible for the privacy policies or practices of third-party websites.

CCTV

By using CCTV systems the School collects, stores and uses static or moving imagery of individuals located in the surveillance area.

The School may be able to identify those individuals by using other existing information.

The School operates CCTV for the following purposes:

For safeguarding children, staff and stakeholders
Maintaining the security of the School and the prevention and detection of crime
To support the effective management of the School operation and any incidents
For investigative purposes or as evidence to support any formal follow-up to School
incidents

In accordance with GDPR Article 6, the lawful justification for collecting and using CCTV/surveillance imagery is that there are legitimate interests to do so.