Privacy Policy

Privacy Policy

Privacy Policy

This privacy notice explains how we collect, store, use, and share personal data about pupils, parents, and website visitors.

For the purposes of UK data protection legislation, we are the data controller responsible for deciding how we hold and securely handle personal information about you.

1. Why We Collect and Use Pupil Information

We process personal data to fulfill our statutory obligations as an educational provider under the Education Act 1996, the Education (Information About Individual Pupils) (England) Regulations 2013, and the Data (Use and Access) Act 2025.

Our lawful bases for processing this data under the UK GDPR are:

  • Legal Obligation (Article 6(1)(c)): To comply with mandatory statutory data collections, child protection protocols, and local authority reporting.

  • Public Task (Article 6(1)(e)): To deliver educational provisions, monitor academic progression, manage daily registers, and maintain onsite safety.

When we process "Special Category Data" (such as medical conditions, ethnicity, or biometric tracking), we do so under strict conditions—primarily Article 9(2)(g) "Substantial Public Interest" (such as safeguarding) or via explicit, freely given consent.

2. The Categories of Personal Data We Process

We process information relating to pupils, their families, emergency contacts, and website visitors. This includes:

  • Identifiers and Contacts: Names, addresses, email addresses, phone numbers, and Unique Pupil Numbers (UPN).

  • Characteristics: Age, nationality, primary language, ethnicity, and free school meal or pupil premium eligibility.

  • Attendance and Behaviour: Daily register records, session counts, documented reasons for absence, and exclusions history.

  • Academic Records: Internal progress metrics, special educational needs (SEN) requirements, and national exam or key stage assessments.

  • Safety and Security Data: CCTV footage captured on school premises and digital submissions to our online network.

  • Biometric Data: Digital mathematical templates derived from physiological characteristics (e.g., fingerprint templates).

3. Advanced Data Collection Systems (CCTV & Biometrics)

To provide a secure, modern environment, the school may utilise specialized automated systems:

  • Closed-Circuit Television (CCTV): Where operated, CCTV cameras across our campus grounds maintain the safety of pupils, staff, and visitors, and prevent damage or theft. We process this data under our Public Task and Legitimate Interests to ensure physical security. Footage is recorded securely, restricted to authorized staff, and automatically overwritten after a set retention period.

  • Biometric Recognition Systems: Where utilized (such as for cashless canteen payments or library checkouts), the school processes biometric data. Note that we never store actual images of fingerprints; instead, systems convert scans into an encrypted numeric template. In strict accordance with the Protection of Freedoms Act 2012, biometric systems are completely voluntary. We will only process a pupil's biometrics if we have the explicit, written consent of a parent or guardian, and any individual can opt out or object at any time in favor of an alternative verification method (such as a PIN or payment card).

4. EdTech Providers and Third-Party Data Sharing

We do not share personal information with any third party without consent unless required by law or managed under strict data processor contracts. We routinely share relevant data elements with:

  • Schools or Colleges that pupils transfer to upon leaving our registers.

  • Local Authorities and the NHS to fulfill funding, child protection, tracking, and public health obligations.

  • The Department for Education (DfE): Shared on a mandatory, statutory basis to underpin national school funding and educational policy. Daily attendance and pupil trait tracking are securely automated between our Management Information System (MIS) and the DfE using authorized cloud-integration infrastructure (such as Wonde).

  • Approved EdTech & Cloud Platforms: To enhance remote learning, administrative efficiency, and parent communication, we may securely share minimal necessary student datasets with authorized Educational Technology platforms (such as Google Workspace for Education, Microsoft 365, internal virtual learning environments, and parent payment software). All such vendors are bound by strict Data Processing Agreements ensuring they cannot misuse or sell pupil data.

5. Post-16 Provisions and Youth Support Services

For institutions operating post-16 provisions (such as Sixth Forms, Colleges, or Apprenticeship tracks), we are subject to additional statutory data sharing obligations once a pupil reaches the age of 16:

  • Local Authority Pathways: We are required by law to pass on certain student information to our local authority. This helps them fulfill their legal duties under the Education and Skills Act 2008 to encourage, enable, or assist young people to participate in education or training.

  • Information Shared: This includes the student's name, address, date of birth, and their intended destination or pathway (e.g., higher education, apprenticeship, or employment).

  • Careers Advice Services: We may also share relevant contact information with approved, independent careers guidance services to help students access personalized transitional support.

  • Right to Opt-Out: A parent or guardian (or the student themselves if they are over 16) can request that we only pass on their name, address, and date of birth to the local authority. This right to opt-out or restrict further data sharing can be exercised by contacting our Data Protection Officer.

6. Website Security, Contact Forms, and IP Privacy

We are committed to preserving the privacy of individuals who interact with us online via our school website:

  • IP Address Anonymity: Our school website does not collect, track, or share a visitor's Internet Protocol (IP) address with external servers, tracking networks, or third-party analytics services unless the user gives explicit, positive consent through our GDPR cookie consent interface.

  • Secure Form Submissions: Any personal information submitted to the school website through online contact forms, absence reporting tools, or application portals is encrypted using Secure Sockets Layer/Transport Layer Security (SSL/TLS) protocols. This information is held securely within our firewall-protected local networks and is only accessed by designated personnel to resolve your inquiry.

7. Data Retention and Security

We implement robust electronic and physical safeguards to prevent data from being accidentally lost, altered, or accessed by unauthorized persons.

In accordance with our internal data retention policies, we hold core pupil data for 6 years following a student's last entry. Once this period lapses, files are securely and permanently destroyed or archived in compliance with the Data Protection Act 2018. Educational files for students moving to a new provider are securely transmitted within 15 school days of their departure.

8. Your Legal Data Rights

Under UK data protection law, parents, guardians, and pupils have clear rights regarding their data, including:

  • The right to submit a Subject Access Request (SAR) to get a copy of the personal information we hold.

  • The right to rectify inaccurate or incomplete data.

  • The right to object to processing, restrict data usage, or request erasure under certain conditions.

  • The right to withdraw consent at any time where processing relies on your permission.

(Note: Under UK data guidelines, once a student reaches the age of 13, they are generally deemed legally mature enough to exercise their own data protection rights directly, including requesting access to their records).

9. Contact and Complaints

To ask questions about this notice, update your data preferences, or make a Subject Access Request, please contact us.

If you believe our school or trust has handled your data unlawfully, you have a legal right to lodge a formal complaint with the Information Commissioner’s Office (ICO) by visiting the ICO Concerns Portal.