In accordance with the Data Protection Act 2018 and the General Data Protection Regulation individuals have the right to be informed about how the school uses any personal data that we hold about them. This privacy notice explains how we collect, store and use personal data about individuals at the school.
Under Data Protection legislation, the school is its own data controller.
Contact details below:
Llantarnam Community Primary School
James Prosser Way
Llantarnam Community Primary School Privacy Notice
Have we sourced your personal data, directly from you?
Data is collected from a variety of sources to make sure that we can help you in your education and look after you at school. For the same reasons, we get information about you from other places too, and these include but are not restricted to the following:
Torfaen County Borough Council Departments
What information does the School collect about you?
The School collects and processes a range of information about you.
This includes but is not restricted to:
● Personal identifiers and contacts (such as name, gender, date of birth, next of kin, unique pupil number, contact details, e-mail address and home address, school photograph, transport details)
Characteristics (such as ethnicity, religion, language, free school meal eligibility and immigration status)
● Safeguarding information (such as court orders, looked after children, young carers and professional involvement)
● Details of any support received, including care packages, plans and support providers (including needs and ranking)
● Medical and administration details (such as doctors information, child health, allergies, medication and dietary requirements)
● Attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
● Performance in internal and national assessments and examinations
● Behavioural information (such as exclusions and any relevant alternative provision put in place)
● Photographs and CCTV images captured in school
● School History
The School may collect this information in a variety of ways:
Verbally, electronically, via paper systems, 3rd parties
We will store your data:
Electronically and paper based in secure lockable locations or password protected if in electronic format.
Why does the School process your personal data?
We process personal information about pupils and their families:
For identification purposes
To support pupil learning
To monitor and report on pupil progress
To provide appropriate pastoral care
To assess the quality of our services
To keep children safe (food allergies, or emergency contact details)
To meet the statutory duties placed upon us for Welsh Government data collections
To comply with the law and legal obligations and the law regarding data sharing
To administer trips and activities, catering and free school meal management
To protect student welfare and wellbeing
To contact pupils and parents when we need to
To carry out research, planning, checking and improving services
Pupil data is essential for the schools’ operational use. Whilst the majority of pupil information you provide is mandatory, some of it is requested on a voluntary basis. When this is the case you will have the option to withdraw consent if you choose.
We can process this category of data because:
We only collect and use pupils personal data when the law allow us to. Our legal basis for processing personal data under Article 6 (1) of the GDPR is:
We need to comply with a legal obligation: and is contained within the Education Act 1996 and associated Welsh Government regulations
We need it to perform an official task in the public interest (in order to provide you with an education).
Less commonly, we may also process students’ personal data in situations where:
We have obtained consent from you or your parents to use it in a certain way: and
We need to protect the individual’s vital interests (or someone else’s interest).
Where we have obtained consent to use students personal data, this consent can be withdrawn at any time and we will make this clear how it can be withdrawn.
Data Protection legislation provides extra protection for certain classes of information under Article 9 called ‘special category’ personal data, which includes:
• Physical or mental health or condition• Politics• Racial or ethnic origin• Religion or other beliefs of a similar nature• Sex life• Sexual orientation• Biometrics (where used for identification purposes)
The lawful basis for collecting and processing information under Article 9 of the GDPR is:
The data subject has given explicit consent
It is necessary to fulfil the obligation of the controller or of the data subject
It is necessary to protect the vital interests of the data subject
It is in the public interest
Who has access to your data?
We do not share information about pupils with any third party without consent unless the law and our policies allow us to do so. Where it is legally required, or necessary (and it complies with data protection law) we share personal information about students with such bodies as
Department for Education on a statutory basis. As outlined within the Education Act 1996 and associated Welsh Government regulations.
Welsh Government - The Welsh Government receives information on pupils directly from schools normally as part of statutory data. In addition to the data collected as part of PLASC, the Welsh Government and Local Authorities also receives information regarding National Curriculum assessments, public examination results, and attendance data at individual pupil level which comes from Schools and /or Awarding Bodies (e.g. WJEC).
The Welsh Government uses this personal information for research (carried out in a way that ensures individual children and young people cannot be identified) and for statistical purposes, to inform, influence and improve education policy and to monitor the performance of the education service as a whole. Examples of the sort of statistics produced can be viewed at www.wales.gov.uk/statistics.
Welsh Government School Workforce Annual Census and PLASC returns
Pupils family and representatives
Internally with schools departments
Torfaen Council Departments including professional advisers and consultants including Social Care, Families First, Legal and Insurance, internal auditors
Other Educational establishments and examining bodies
Education Achievement Service (EAS)
Welsh / English Government Health Services
Health Authority for Health Care Programmes
Police Services, Ambulance Services, Courts
Careers Wales/ Youth Support Services once pupils reach the age of 13 under section 507B of the Education Act 1996.
Careers Wales/ Youth Support Services once pupils reach the age of 16 under section 507B of the Education Act 1996
John Muir Project
NRS Cashless Catering - biometerics (where used for identification purposes only) not all schools
How does the School protect data?
The school takes the security of your data seriously. The school have, and are developing further, internal policies to ensure the data it processes is not lost, accidentally destroyed, misused or disclosed and is not accessed except by its employees in the performance of their duties. Data that we keep about pupils while attending our school will be stored in student files, in the schools management system and in other IT systems. It is stored securely if in paper form or if electronically will be password protected.
Where the school engages third parties to process personal data on its behalf, they do so on the basis of written instructions. These third parties are also under a duty of confidentiality and are obliged to implement appropriate measures to ensure the security of data.
How long does the School keep your data?
The school will hold your personal data only for the period that is necessary and will follow organisational and Local Authority standards in this area.
We will keep your information in line with the school retention schedules.
Parents and pupils have rights regarding personal data. Individuals have a right to make a “subject access request” to gain access to personal information the school holds about them. The law allows that by the age of 13 children have sufficient maturity to understand their rights and to make an individual right request themselves if they wish. A parent would be expected to make a request on a child’s behalf if the child is younger. You can also request an “education record request” which will give you all information processed on behalf of the governing body of the school. If you would like to request either of these please contact the Head teacher.
The Data Protection Act 2018 and GDPR laws give individuals additional rights in respect of personal information held on yourself. These rights include:
The right to be informed
The right of access
The right to rectification
The right to erasure - in certain circumstances. Whilst the child is in school, there may be data that you would not erase if requested as this could hamper your ability to perform your public task
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling.
If you would like to exercise any of these rights, please contact the Head teacher in writing who will respond within one calendar month.
You may also contact the Information Commissioner (ICO), however, the ICO (Wales) cannot make a decision unless you have exhausted the complaints/internal review procedure offered by the Council. Please do not hesitate to contact, Head Teacher