Privacy

KEGS – COVID-19 Testing Privacy Statement

Ownership of the Personal Data

To enable the Covid-19 testing to be completed at KEGS, we need to process personal data for staff and pupils taking part, including sharing of personal data where we have a legal obligation.  KEGS is the Data Controller for the data required for processing the tests and undertaking any actions which are needed by the school to ensure we meet our public health and safeguarding legal obligations.

[Personal data relating to tests for pupils [Section 175 of the Education Act 2002 for maintained schools OR paragraph 7 of the Schedule to the Education (Independent School Standards) Regulations 2014 applicable to academies OR paragraphs 3 and 14 of the Schedule to the Non-Maintained Special Schools (England) Regulations 2015 applicable to Non-Maintained Special Schools.]

[Personal Data relating to staff is processed under the legitimate interest of data controller to ensure we can minimise the spread of COVID in a timely manner and enable us to continue to deliver education services safely and securely].

[The following paragraph is relevant to both pupils and staff taking tests]

If you decline a test, we record your decision under the legitimate interest of school in order to have a record of your decisions and to reduce unnecessary contact with you regarding testing.

The processing of special category personal data is processed under the provisions Section 9.2(i) of GDPR, where it is in the public interest on Public Health Grounds. This data is processed under the obligations set out in Public Health legislation (Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI)) which allows the sharing of data for COVID related purposes and where it is carried out by [a health care professional OR someone who owes an equivalent duty of confidentiality to that data]

Data Controllership is then passed to the Department for Health and Social Care (DHSC) for all data that we transfer about you and your test results to them. For more information about what they do with your data please see the Test and Trace Privacy Notice. The establishment remains the Data Controller for the data we retain about you.

Personal Data involved in the process

We use the following information to help us manage and process the tests:

• Name
• Date of birth (and year group)
• Gender
• Ethnicity
• Home postcode
• Email address
• Mobile number
• Unique barcode assigned to each individual test and which will become the primary reference number for the tests
• Test result
• Parent/guardians contact details (if required)
   

We will only use information that is collected directly from you specifically for the purpose of the tests, even if you have previously provided us with this information.

How we store your personal information

The information will only be stored securely on local spreadsheets in school/college whilst it is needed.  It will also be entered directly onto DHSC digital services for the NHS Test and Trace purposes.   Schools/colleges will not have access to the information on the digital service once it has been entered.

Processing of Personal Data Relating to Positive test results

The member of staff, pupil, student or parent (depending on contact details provided) will be informed of the result by the school/college and advised how to book a confirmatory test.

We will use this information to enact their own COVID isolation processes without telling anyone who it is that has received the positive test.

The information will be transferred to DHSC, who will share this with the NHS, GPs. PHE and the Local Government will use this information for wider test and trace activities as well as statistical and research purposes.

This information is processed and shared under obligations set out in Public Health legislation under Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.

This information will be kept by the school for up to 14 days and by the NHS for 8 years.

Processing of Personal Data Relating to Negative test results

We will record a negative result and the information transferred to DHSC, NHS. PHE and the Local Government who will use the information for statistical and research purposes.

This information is processed and shared under obligations set out in Public Health legislation under Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.

This information will be kept by the school for up to 14 days and by the NHS for 8 years.

Processing of Personal Data relating to declining a test

We will record that you have declined to participate in a test and this information will not be shared with anyone.

Data Sharing Partners

The personal data associated with test results will be shared with

• DHSC, NHS, PHE – to ensure that they can undertake the necessary Test and Trace activities and to conduct research and compile statistic about Coronavirus.
• Your GP – to maintain your medical records and to offer support and guidance as necessary
• Local Government to undertake local public health duties and to record and analyse local spreads.

Your Rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at [insert email address, phone number and or postal address of school / college’s DPO] if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at office@mybama.world-over.com or 01245 353510.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:           

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

For FAQs, please see here.

Introduction

The General Data Protection Regulations provide you with legal rights over the personal data our school holds about you and your child. This guide will explain your rights and help you to use them.

You do not need to know details about which right applies in which case in order to make a request; it’s our responsibility to understand how to handle a request you make.

Your personal data rights are: be informed, access, rectify, be forgotten, restrict, portability, object, auto-decisions & profiling.

We are committed to helping you to exercise your rights through:

• Keeping our guidance simple
• Making it readily available
• Responding to a request from you:
  • In writing: by means of your choice wherever practical. If you email us, we’ll respond by email unless you ask us to do something different
  • Verbally: if you wish, providing we have proof of ID
  • Promptly: and no longer than a month after receiving it. If your request is particularly large and complicated, we are allowed to extend the deadline by up to 2 months. If we need to do this we’ll let you know within a month and explain why.
  • In plain English: avoiding legal terms where possible, but explaining them where we need to use them

How will you know that a request about me has come from me?

We won’t change, delete or share any of your information without being satisfied that it is you who has asked for this (unless the law allows us to). Where we have doubts about a requestor’s identity, we will ask for proof of ID and won’t go ahead unless we’ve received this and are satisfied that you are identified.

Are you allowed to charge me for a request, or refuse it?

You should not have to pay us when you’re exercising your rights; however, the law does allow us to charge you a reasonable fee if your request is unreasonable or is a repeat of something we’ve already done for you. In these cases we may be allowed to refuse your request rather than charge. If we plan to charge or to refuse your request, we will let you know and explain why we believe the law lets us do this.

There are other reasons in the law which may mean we cannot do what you ask us to do with your personal data. We have explained these under each of your ‘Rights’ in this guide.

What if I’m not happy with your response to my request?

We’ll always do our best to do what you ask with the personal data we hold about you or your child, however, the law places a responsibility on the school to balance your rights against the rights of other people who may be affected and against the legal powers of other organisations. It may not always be the case that your rights are strongest in every situation. We’ll always explain our reasons and will gladly take another look at our decision if you want challenge it.

If you still feel that we haven’t done what we should then you have the right to complain to the Information Commissioner (ICO). Please see the ICO’s contact details at the end of this guide.

Limiting your Rights

The law allows for the UK Government to make certain decisions which could result in Data Protection rights being reduced to some extent. However, the law requires that any restrictions of this kind must still be in line with your basic human rights and must be what is expected of rules applying to a democratic country.

The Government may decide to limit the rights for reasons such as national security, preventing crime, investigating certain professional conduct cases etc. We have to take these decisions into account when considering requests from you to exercise your rights.

1. Your Right to be Informed

It is important that you know what happens to your personal data whilst we hold it. The law requires us to be honest and open with you about these details and we do this through publishing a number of Privacy Notices on our website; one covering each of the main uses we make of your data.

These Notices are available for you to read and understand so that you know what to expect us to do with your data; either before you share it with us, or where it is given to the school from another organisation that holds it.

We have taken care to explain the details on the Notices in simple language but we would be grateful for any feedback on this to help us with our commitment to review and improve the guidance we give you.

Here are the main things we need to tell you about what we do with your personal data:

• Who we are: School name, the name of our Data Protection Officer and their contact details.
• A description of the type of data we collect about you/ your child
• The reasons why we need this data
• An explanation of how the law allows us to hold and use your data
• Who we might share the data with (either because they provide a service on our behalf or they need it for their own purposes and the law allows this)
• Whether your data may be sent to or stored in a country that is outside the European Economic Area (EEA)
• When will we no longer need your data and how soon after this we’ll delete it
• Which of your rights you are able to use, including the right to withdraw your consent (if this is what allows us to hold your data)
• How to complain to the Information Commissioner’s Office (ICO)
• Where we got your data from (if you didn’t give it to us yourself)
• Whether we use your data to make automated-decisions or to do profiling

We will make sure the right Privacy Notice is available to you:

• At the time you share your data with us
• When it has been shared with us by another organisation:
  • No later than a month
  • The first time we contact you, or sooner
  • Before or when we share it with someone else

See our Website for a list of published Privacy Notices

Click here for more information (ICO Website)

2. Your Right to Access your Information

The personal data we hold about you and your child is still yours. You have the right to ask us for access to the data to satisfy you that our use of your data is lawful. Unless the law prevents us from doing so, we must give you:

• Confirmation that we hold your data
• An explanation of what that data is
• Access to your information
• Confirmation of which Privacy Notice(s) explain why we have your data and what we do with it

When dealing with your request we will:

• Let you know what additional information we may need to identify you
• If a request has been made by someone on your behalf, ensure that they have your permission
• Confirm how you would like to receive your information
• Help you to make your wishes clearer if your request is not clear about the information you want.
• The information you receive is information you are entitled to under the law – having considered your rights against the rights of others whose information may be included within documents relating to you, and any other legal reason which may prevent us from sharing data.
• Let you know within a month at the latest about any expected delay, for example if your request is complex, about any fee that the law allows us to charge, or explain any reason we may have to refuse your request.

Click here for more information (ICO Website)

Please note: There is an additional “right of access” to your Child’s ‘Pupil Record’ – as defined in the Education (Pupil Information) (England) Regulations 2005.  The timescale for responding to such requests is fifteen days from receipt of the request (excluding the summer holiday). This right is not affected by GDPR.

3. Your Right to have your Data ‘Rectified’

The school has a legal responsibility to make sure the data we hold about you and your child is accurate and complete. Where we are made aware that we may hold inaccurate or misleading data about you we must ‘rectify’ it (change it). 

Where you may have moved to a new address, changed contact details or even changed a surname; these are simple changes to make. However, there may be more complex cases where you disagree with an opinion we have recorded about your child’s progress for example, and you may decide to ask us to change this. In some cases the law allows us to refuse to make changes to the personal data we hold and the professional opinion of a qualified teacher is an example where we may decline to fulfil a change request. 

Any request to change your personal data will be fairly considered and if where having reviewed a contentious record we feel it is inaccurate then we will make changes.

If we do refuse to make changes we will always:

• Explain to you in writing the reasons why we are refusing your request
• Consider adding a statement of your opinion to the record to reflect that there has been a challenge to our professional judgement.

Click here for more information (ICO Website)

4. Your Right to be Forgotten

Right to erasure (‘right to be forgotten’)

The right to Erasure, known as the right to be forgotten, is where you can ask us to consider deleting information that we hold about you or your child.

We will already have explained to you through our Privacy Notices how long we intend to hold your personal data before we delete it, however you still have the right to challenge us to delete your data at any time.

You can expect your request for deleting your personal data to be successful if:

• It is no longer ‘necessary’ for us to keep the data for the purpose stated on the relevant Privacy Notice
• We’re holding and using the data based only on your consent, and you have decided to withdraw this consent
• We’re holding and using the data for our ‘legitimate interests’. You may decide to object to this, and we can’t give a reason for keeping it that outweighs your decision.
• We’re holding and using the data to allow us to market goods and services to you and you ask us to stop.
• We have been holding and using your data unlawfully
• Deleting is required by law
• We’re using data about your child to support a chargeable online service 

The law has a number of reasons why we are allowed to refuse erasure requests, those that are most likely to apply to schools are where we’re holding or using your data:

• To comply with a legal requirement
• Where we are doing something in the public interest or acting within our role as a school
• To keep a historical record of the school’s activity for future generations
• Where we need it because it supports a legal case

When we agree to delete information about you, we will have procedures in place to let other organisations who we’ve shared your data with know, for example if we have contractors working on our behalf. Our decision to delete your data means that they should delete it also.

When we agree to delete information following your request, or routinely as part of our records management procedures, we will make sure that the data in whatever format is destroyed securely and cannot be reused, or it will be permanently changed so that it can no longer identify you or your child.

Click here for more information (ICO Website)

5. Your Right to Restrict the Processing of your Data

Should you have concerns about an aspect of what we do with your personal data, such as who we share it with or how we manage it, you have the right to ask us to stop doing it; so that we are still allowed to hold it, but we are ‘restricted’ in the ways we can use your data.

Aside from storing your data, we can only continue to use it when it is under a restriction if:

· We have your consent

· It is to be used for a legal claim or case

· It is needed to support someone else’s rights

· We believe the use is in the public interest.

When use of data is restricted, this may mean we consider doing the following:

• Removing your data from one database or system and storing it in another in order to separate it from data which is still in use
• ‘Lock’ or ‘Protect’ a record containing your data to prevent staff from accessing and using it.
• Taking published data down from a website.
• Labelling the data to ensure that users are aware of the restriction

You can expect your request for restricting the use of your personal data to be successful if:

• You want our use of your data to stop whilst its accuracy is being reviewed
• The data had been used unlawfully and you opt for a restriction rather than request us to delete (erase) your data
• We don’t believe it is necessary for us to keep your data any longer, but you wish us to keep it for a potential legal case
• You have raised an ‘objection’ and we need time to consider whether your rights outweigh our potential claim that we have a legitimate need to keep using your data

As with other rights, the law allows us to refuse a request in certain circumstances. In this case we can refuse (or charge a reasonable fee) if we believe the request is unfounded or excessive. In such cases we will contact you and explain our decision, and let you know how to complain.

When we decide to lift any restriction on the use of your data, we must let you know about this in advance. We must let you know how this affects any related requests under your rights to ‘rectify’ and to ‘object’, and also let you know how to complain.

Click here for more information (ICO Website)

6. Your Right to Data Portability

The right to Data Portability gives you the means of asking an organisation to give your personal data to another organisation on your behalf, or back to you for you to give to another organisation – making your data ‘portable’, i.e. easily usable by another supplier of services to you.

The law allows this right to apply in a very narrow set of circumstances which make it highly unlikely that it would apply to any data held by the school, but in brief the right applies when data you have provided:

• Is being held and used by us under your consent or supporting a contract, AND
• The use of the data is being carried by an automated process (i.e. staff are not involved in physically doing something with the data).

If this right did apply to your data, we would need to provide it in a format that was commonly in use, allowing the majority of software products to read and use the data in an automated way.

Click here for more information (ICO Website)

7. Your Right to Object to Data Processing

The law provides you with the right to ‘object’ to us holding and using your personal data but only in certain circumstances. Our Privacy Notices will let you know the ‘legal condition’ we are relying on to hold and use your data and they will also explain when you have the right to ‘object’. If we are relying on one of the following, then the right is available to you:

• Legitimate interests, or
• Performance of a task in the public interest/ exercising our official authority (including profiling), or
• Scientific or Historical research and statistics

In order to exercise your right you must have an objection which is specific to your particular situation. You can’t therefore object to our general practices, you must be able to argue that there is something we are doing with your personal data that impacts you specifically.

If this does apply, then we must stop doing what is causing you concern unless we can do one of the following:

• Show you that there are legitimate grounds for our actions and that these outweigh your rights
• Show that our actions with your personal data are necessary to support evidence for a legal case or claim

If we hold your data for direct marketing purposes then we must stop doing so when we receive your objection. We would have no grounds to challenge your decision.

Click here for more information (ICO Website)

8. Rights over Automated decision-making & Profiling

What do these terms mean?

Automated decision-making

This is making decisions about you or your child using your personal data through an automated process, i.e. a computer calculation with no human involvement.

Profiling

Using personal data to make decisions about categorising you or your child based on any number of characteristics

Where we do this we have to let you know about it on our Privacy Notices. These will explain the process we go through and what the potential consequences are of the decisions made

The law only allows us to do this kind of activity where decisions are made completely without the need of human help and the outcome of the decision can have a significant impact on an individual in the following circumstances:

• If we were evaluating you or your child as part of entering into a contract (i.e. to see whether someone meets the criteria to be eligible for a contractual service)
• If the law specifically allows it
• You have given us your recorded consent

And we can only use sensitive personal data if:

• We have your recorded consent, or
• We can claim that what we’re doing is important in the public interest

If what we’re doing isn’t completely automated and the decisions are not significant, then we don’t need to rely on these reasons, but we still need to let you know what we’re doing and explain how the law allows us to do it.

The law says that this type of activity has the potential for error that may have consequences, or has concerns that decisions are made in ways that aren’t transparent and are potentially unfair. You therefore have the right to:

• Challenge us over decisions we make in this way
• Demand that a member of staff undertakes the process rather than a computer
• Make us aware of your opinions to support decision making

We must make sure that the systems we use to make such decisions are working as they should in order to avoid errors and to ensure we are fair, and we must take reasonable steps to keep your data secure within this process.

Any system we use to carry out this type of process will have been risk assessed and will have been approved by our Data Protection Officer as complying with the law.

Click here for more information (ICO Website)

The school does not collect biometric data (e.g. fingerprints).  For more information about the school's use of photographs, see the relevant privacy notice on this website.

Managing Security

To ensure the school premises are a safe environment for children, school employees, visitors and parents/ guardians, for example by the use of Security ID Cards, Visitor registration, Employee and Governor photographic displays.  The types of personal information we need for this purpose include:

· Personal Images (Photographs)

· Name, vehicle registration (Visitor registration)

The purpose of this use of data is for public safety and the prevention of crime, and our legal basis for using the information in this way is a task in the public interest.

The school is the data controller.  We may share this information with the Police or other certified investigators.

Our visitor records will be held for seven years.

No personal information is routinely available outside of the UK.  Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

Closed Circuit Television Surveillance (CCTV)

To ensure the school premises are a safe environment for children, school employees, visitors and parents/ guardians by using CCTV.

The types of personal information we need for this purpose include:

· Personal Images (CCTV)

· Vehicle registration

The purpose of this use of data is for public safety and the prevention of crime, and our legal basis for using the information in this way is a task in the public interest.

The school is the data controller.  We may share this information with the Police or other certified investigators.

We retain CCTV footage for 30 days before it is overwritten.  The information may be retained for a longer period if imagery is required for evidential purposes.

No personal information is routinely available outside of the UK.  Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

For information about your rights in relation to this use of your personal information please see of our overarching privacy notice.

We sometimes use personal information for marketing purposes, for example school prospectuses, newsletters (which include advertisements for events and products external to the school) and marketing emails to let you know what is available within the school and the wider community.  Direct marketing only applies when communications are targeted to named individuals.

The personal information likely to be used for these activities is:

· Names

· Contact Details

· School Year/Class

· Digital Images

Where the activity is not directly linked to the school’s provision of education we will be relying on your consent.  We will seek the consent of the parent/carer, or where pupils are aged 12 or above, from the pupil themselves.  As we are relying on your consent you can withdraw consent at any time by contacting the school. 

Every effort will be made to delete the information when consent is withdrawn, but please note that where consent has been provided for publication, the school may not be able to locate and delete the information on request, although reasonable steps will be taken to do so.

Where consent has been provided for the use of personal information, and the pupil has left the school, we will rely on legitimate interests as our legal basis when retaining digital information for archiving purposes. If you would like a copy of the Legitimate Interest Assessment we have completed for this activity, please contact the school office.

The school is the Data Controller for this information.  The information might be shared with:

· Social Media applications

· Communications providers (for example ParentMail)

· School website providers

· Prospective parents (in the case of the prospectus)

No personal information is routinely available outside of the UK.  However, where information is used on social media, in publications, or on our website we cannot restrict the access to such information to the UK.

The personal information will be retained for the duration of its purpose plus one year, unless it is retained in perpetuity for archiving purposes.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

School photos and additional activities

We are required by law to retain a photo of each pupil as part of our educational record.  We sometimes wish to use digital images, e.g. photos, videos, audio recordings to enhance education provision, inclusion and recreation.  When this is the case we will seek the consent of the parent/carer, or where pupils are aged 12 or above, from the pupil themselves.  Where consent has been provided for the use of images, and the pupil has left the school, we will rely on legitimate interests as our legal basis when retaining digital images for archiving purposes. If you would like a copy of the Legitimate Interest Assessment we have completed for this activity, please contact the school office.

As we will be relying on consent when displaying or publishing digital images, that consent can be withdrawn at any time simply by contacting the school.  Every effort will be made to delete the images, but please note that where consent has been provided for the publication of the images, the school may not be able to locate and delete the image on request, although reasonable steps will be taken to do so.

The school is the Data Controller for this information.  This information may be shared in order to celebrate successes or promote our education services.  Please note we only share information required for that particular purpose and then only the minimum required.  We may share digital images with your consent with:

• The school website provider
• Local media
• School photographer
• Essex Records Office
• Social Media platforms

No digital images are routinely available outside of the UK.  However, where digital images are used on social media, in publications, or on our website we cannot restrict the access to such images to the UK.

Additional school activities

We may offer extra-curricular activities, for example recreational school trips, sporting events and pupil support services (e.g. Speech and Language Therapy).  The types of personal information we may use include:

Names

Emergency contacts

Health information

Date of birth

Passport information

In these circumstances we rely on your consent.  We will seek the consent of the parent/carer, or where pupils are aged 12 or above, from the pupil themselves.  Permission for pupils to go on trips will be sought from the parent/carer.  As we are relying on your consent you can withdraw consent at any time by contacting the school. 

Personal information used for such purposes will be kept for the duration of the planning and execution of the event, and for as long post event is reasonable to handle any resulting queries or complaints.

No personal information is routinely available outside of the UK.  However, in the case of overseas trips information will be used in other countries.  Where this is the case this will be with your consent and with appropriate safeguards in place.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

We use personal information, for example:

• Names and address
• Contact details
• Date of birth
• Education attainment
• Emergency contacts
• Family relationships
• General case information.

We also use some special category personal information, for example:

• Health information
• Ethnicity
• Religion.

This information is provided by parent/carers, the local authority and any previous education settings.  It is used to deliver our statutory education duties and assure the health and wellbeing of our pupils.

The school is the Data Controller for this information.

This information may be shared in order to provide our education service.  Please note we only share information required for that particular purpose and then only the minimum required.  We may share information with:

• Central & Local Government,
• Health Providers
• Other Education Providers
• Regulatory Bodies, e.g. Ofsted, The Information Commissioners Office.

This information will be held for 25 years from the date of birth of the student.  When a pupil changes school, this record will go with them and will not be retained by the previous school, other than to meet statutory returns.

Our school management system is provided under contract and they act as data processors for this information.

No personal information is routinely available outside of the UK.  Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

We are required to maintain employee records for our staff.  The type of information used in these records includes:

• Name and contact details
• Date of Birth
• Financial details
• Vetting information
• Pensions and payroll data
• References
• Performance data

The records also contain special category personal information, for example:

• Ethnicity
• Religion
• Health information
• Trade Union Membership

This information is generally provided by you, and sometimes it is provided by others, such as:

• Previous employers
• DBS service
• Occupational Health providers

The school is the data controller for this information.  Data processors support this activity through the provision of systems.  The legal basis we rely on when using this personal information is our employment contract.  The legal basis we rely on for the special category personal data is Employment, Social Security and Social Protection, and Substantial Public Interest.

Sometimes we may share this personal information, for example with one or more of the following:

• Central and local government departments
• Health providers
• Other education providers
• Regulatory bodies
• Professional Associations
• Disclosure and Barring service
• Insurance providers

This information will be retained for a minimum of 7 years from the end of the employment contract.

Recruitment Records

We collect information when recruiting to vacant posts.  The information is likely to include:

• Name
• Contact Details
• Education History
• Employment History
• Vetting information
• Referee Contact Details
• Proof of Identity (e.g. Drivers licence, passport)      
• Proof of right to work in UK where required
• National Insurance Number
• Proof of professional qualifications

The records may also contain special category personal information, for example:

• Additional Needs (for interview purposes)
• Proof of right to work in UK where required

This information is generally provided by you, and sometimes it is provided by others, such as:

• Previous employers
• DBS service
• Occupational Health providers

The school is the data controller for this information.  Data processors support this activity through the provision of systems.  The legal basis’s we rely on when using this personal information is our Legitimate Interests and Legal Obligation.  The legal basis we rely on for the special category personal data is and Substantial Public Interest.

Sometimes we may share this personal information, for example with one or more of the following:

• Health providers
• Referees
• Regulatory bodies
• Professional Associations
• Disclosure and Barring service

For unsuccessful candidates this information will be retained for a minimum of one year.  Successful candidates’ information will become part of their employee record (see first section of this notice – Employee Records).

General Information

No personal information is routinely available outside of the UK.  Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

To enable our School Trustee to support our school we use personal information, for example:

• Name and contact details
• Declarations of interest
• Vetting information
• Digital images
• Behaviours

We are required by law to collect and use this information and our legal basis for using the personal information is our Legal Obligation.  Our legal basis for using special category personal information is Substantial Public Interest.

We sometimes need to share some information, for example with:

• Central or local government departments
• Other education  providers
• Regulatory Bodies

The information we use will be retained until the Trustee ceases to work with the school, plus one year.

No personal information is routinely available outside of the UK.  Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

We sometimes have volunteers who come in to support our school activities.  We are required to collect some information about them, for example:

• Name and contact details
• Vetting information
• Relationship information

Our legal basis for collecting and using this information is consent, but where we collect vetting information this is on the basis of our Legal Obligation.  Where we are using your information with your consent you can withdraw your consent at any time by contacting the school.

We will keep your information whilst you are volunteering at the school, and retain for one year after your last support activity.

We also use personal information to:

• help investigate any worries or complaints you have about your/your child’s education;
• keep track of spending;
• check the quality of education delivery; and
• to help with research and planning of new education initiatives.

No personal information is routinely available outside of the UK.  Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

We use limited personal data about Pupils and Parents/ Guardians with online payment providers to manage payments to the school.  The personal information used for this purpose is likely to include:

• Child’s name
• Child’s identifiers (class, year, UPN)
• Dietary needs (where relevant)
• Medical needs (where relevant)
• Parent’s names and contact details

This information is shared with our online payments provider who works for us under contract.  The school is the data controller and the online payment provider is the data processor.  Our legal basis for using personal data for this purpose is that it is a task in the public interest.

The information will be retained in line with our statutory pupil record.

No personal information is routinely available outside of the UK.  Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

We may wish to celebrate the achievements of pupils and promote the School through publishing of coursework.  When this is the case we will seek the consent of the parent/carer, or where pupils are aged 12 or above, from the pupil themselves.  As we are relying on your consent you can withdraw consent at any time by contacting the school.  Every effort will be made to delete the coursework, but please note that where consent has been provided for the publication, the school may not be able to locate and delete the coursework on request, although reasonable steps will be taken to do so.

Where consent has been provided for the use of coursework, and the pupil has left the school, we will rely on legitimate interests as our legal basis when retaining coursework for promotional purposes.

The personal information likely to be used in this activity is:

• Student Name
• School Year
• Coursework

The school is the Data Controller for this information.  The information might be shared with:

• Other students
• Social Media applications
• School website providers

No coursework is routinely available outside of the UK.  However, where it is used on used on social media, in publications, or on our website we cannot restrict the access to the UK.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

The school uses software to automatically monitor the activity of all users of the school's network: the software will store the websites visited and will look for certain keywords entered by a user.  The school employs this software to help it carry out its legal obligation to safeguard children.  The software is not used to provide information for any issues relating to work productivity.  The logs generated by the software will be looked at for the purposes of safeguarding or investigating pastoral incidents - they will not be looked at for any other purpose.

The school regularly receives visitors.  Visitors may be from other organisations, or be emergency contacts for pupils, parent/carers or suppliers. 

To ensure the safety of our students and staff we ask visitors to sign in on arrival.  For this purpose, we collect the following data where relevant:

• Name
• Car registration
• Car make/model
• Who they are visiting
• The purpose of the visit
• The date and time of arrival
• The date and time of departure
• A digital image of the visitor

The records may also contain special category personal information, for example:

• Ethnicity (only if determined from the digital image)
• Religion (only if determined from the digital image)

The school is the data controller for this information.  Data processors support this activity through the provision of systems.  The legal basis we rely on when using this personal information is a Task in the Public Interest as we undertake this activity to maintain a safe environment for our students, staff and visitors. 

We do not share this personal information unless we are required to by law, or where it is necessary to protect others.

This information will be retained for a minimum of 7 years from the date of the visit.

General Information

No personal information is routinely available outside of the UK.  Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

For information about your rights in relation to this use of your personal information please see our overarching privacy notice.

We hold personal information, for example:

• Names and address
• Contact details
• Date of birth
• Education attainment
• Emergency contacts
• Family relationships
• General case information.

We also hold some special category personal information, for example:

• Health information
• Ethnicity
• Religion.

The law requires us to create pupil records and maintain them until the young person reaches the age of 25. When a pupil changes school, this record will go with them and will not be retained by the previous school, other than to meet statutory returns.

The information is provided by parent/carers, the local authority, the last education setting and any previous education settings. 

The school is the Data Controller for this information. Our legal basis for processing personal data for this purpose is our Legal Obligation under The Education (School Records) Regulations 1989.  Our legal basis for processing special category personal data is Substantial Public Interest (Data Protection Act 2018 Schedule 1, Part 2, section 6 (2) (a)).

This information may be shared in order to comply with any legal obligation to do so, for example with the Department of Education; or where we feel there is a good reason that’s more important than protecting your privacy, for example if there are serious risks to others, to protect vulnerable individuals, or where we have reason to believe there has been criminal or fraudulent activity.

No personal information is routinely available outside of the UK.  Should a transfer of personal information be necessary we will only do so where it is permitted by law and where appropriate safeguards are in place.

For information about your rights in relation to this use of your personal information please see section 5 of our overarching privacy notice.

Please note, digital images may be retained in line with our privacy notices for Photos & Activities, and Marketing.

1.    Who are we?  
We are your school.   We help you learn and prepare you for the future. 

2.    Why do we keep personal information about you?
We use the information to teach you and keep you safe.

3.    What information do we keep about you? 
It includes your name, where you live, who looks after you outside school, your health, and what you have learned.

4.     How do we collect information about you?
We collect information from you and your family.  We also get information from others, for example, your council, doctor or social worker if they tell us.   
 

5.    How do we use your information?
We securely hold information about you so that we can teach you and keep you safe.  Sometimes we have to share information about you.  For example:
•    The Government Department for Education and Local Authority
•    With Examination Boards and Inspectors
•    When you take part in some of our activities – such as residential trips, or educational competitions that are hosted outside of KEGS
•    Sometimes we may need to share your information if you are at risk of harm to yourself or others

6. How long do we keep your information?
We keep your information as long as we need to help you or as long as the law needs us to. 

7.    Your rights
•    We only keep information about you that we really need
•    We do not share it unless we have to
•    You have the right to know what we hold about you and have a copy
•    You can have incorrect information corrected
        
For more information please speak to the school office.