(also provided to parents and carers)

If you find this letter difficult to understand you can ask your parents or another adult such as your teacher to help you understand it. It is about how we use information about you and what we do with it. We call this information about you ‘personal data’ or ‘personal information.’

Who processes your information?

The Purbeck School is the data controller of the personal information you provide to us. This means the school determines the purposes for which, and the manner in which, any personal data relating to pupils and their families is to be processed.

S Radford is the data protection officer; they act as a representative for the school with regard to its data controller responsibilities. Their role is to oversee and monitor the school’s data protection procedures, and to ensure they are compliant with the GDPR. The data protection officer can be contacted on 01929 550077 or office@purbeck.dorset.sch.uk

In some cases, your data will be outsourced to a third party processor; however, this will only be done with your consent, unless the law requires the school to share your data. Where the school outsources data to a third party processor, the same data protection standards that The Purbeck School upholds are imposed on the processor.

Why do we collect and use your information?

The Purbeck School holds the legal right to collect and use personal data relating to pupils and their families, and we may also receive information regarding them from their previous school, LA and/or the DfE. We collect and use personal data in order to meet legal requirements and legitimate interests set out in the GDPR and UK law, including those in relation to the following:

• Article 6 and Article 9 of the GDPR
• The Data Protection Act 2018
• Education Act 2011
• The Education (Information About Individual Pupils) (England) Regulations 2013

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing child and young person’s information are:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary to protect the vital interests of the data subject or another person;
• processing is necessary for the purposes of legitimate interests;

In addition, concerning any special category data:

• processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law

What information is being collected?

The categories of pupil information that the school collects, holds and shares includes, but is not restricted to:

• personal identifiers and contacts (such as name, unique pupil number, contact details and address)
• characteristics (such as ethnicity, language, and free school meal eligibility)
• safeguarding information (such as court orders and professional involvement)
• special educational needs (including the needs and ranking)
• medical and administration (such as doctors information, child health, allergies, medication and dietary requirements)
• attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
• assessment and attainment (such as key stage 2, GCSE results, post 16 courses enrolled for and any relevant results)
• behavioural information (such as exclusions and any relevant alternative provision put in place)
• information relating to catering and free school meal management

This list is not exhaustive, to access the current list of categories of information we process please see https://www.purbeck.dorset.sch.uk/information/policies/privacy-notice/ 

We will only retain the data we collect for as long as is necessary to satisfy the purpose for which it has been collected.  We hold data securely for the set amount of time shown in our data retention schedule. For more information on our data retention schedule and how we keep your data safe, please visit https://cdn.ymaws.com/irms.site-ym.com/resource/collection/8BCEF755-0353-4F66-9877-CCDA4BFEEAC4/2016_IRMS_Toolkit_for_Schools_v5_Master.pdf

Whilst the majority of the personal data you provide to the school is mandatory, some is provided on a voluntary basis. When collecting data, the school will inform you whether you are required to provide this data or if your consent is needed. Where consent is required, the school will provide you with specific and explicit information with regards to the reasons the data is being collected and how the data will be used.

How will it be used?

In accordance with the above, the personal data of pupils and their families is collected and used for the following reasons:

• To support pupil learning
• To monitor and report on pupil progress
• To provide appropriate pastoral care
• To assess the quality of our services
• to keep children safe (food allergies, or emergency contact details)

to meet the statutory duties placed upon us for DfE data collections

Who will it be shared with?

The school is required to share pupils’ data with the DfE on a statutory basis.

The National Pupil Database (NPD) is managed by the DfE and contains information about pupils in schools in England. The Purbeck School is required by law to provide information about our pupils to the DfE as part of statutory data collections, such as the school census; some of this information is then stored in the NPD. The DfE may share information about our pupils from the NDP with third parties who promote the education or wellbeing of children in England by:

• Conducting research or analysis.
• Producing statistics.
• Providing information, advice or guidance.

The DfE has robust processes in place to ensure the confidentiality of any data shared from the NDP is maintained. The Purbeck School will not share your personal information with any third parties without your consent, unless the law allows us to do so. The school routinely shares pupils’ information with:

• Pupils’ destinations upon leaving the school
• our local authority
• youth support services (pupils aged 13+)
• The NHS
• the Department for Education (DfE)

We do not share information about our children or young people with anyone without consent unless the law and our policies allow us to do so.

Youth Support Services

Once our pupils reach the age of 13, we are legally required to pass on certain information to our local authority and the EET Support Team within Dorset Council, which has responsibilities in relation to the education or training of 13-19 year-olds under section 507B of the Education Act 1996. This enables them to provide services as follows:

• youth support services
• careers advisers
• post-16 education and training providers

Parents, or pupils if aged 16 or over, can request that only their name, address and date of birth be passed to the EET Support Team – if you would prefer this please inform the Data Officer at The Purbeck School, email jdalton@purbeck.dorset.sch.uk or telephone 01929 550077.

Data is securely transferred to the youth support service via AnyComms+.

For more information about services for young people, please visit our local authority website https://www.dorsetcouncil.gov.uk/children-families/get-help-for-your-family/family-information-service.aspx

What are your rights?

Parents and pupils have the following rights in relation to the processing of their personal data. You have the right to:

• Be informed about how The Purbeck School uses your personal data.
• Request access to the personal data that The Purbeck School holds.
• Request that your personal data is amended if it is inaccurate or incomplete.
• Request that your personal data is erased where there is no compelling reason for its continued processing.
• Request that the processing of your data is restricted.
• Object to your personal data being processed.
• Object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics.

Where the processing of your data is based on your consent, you have the right to withdraw this consent at any time. If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office on 0303 123 1113, Monday-Friday 9am-5pm; or at https://ico.org.uk/concerns/

Subject access requests

Under the Data Protection Act 1998, pupils have a right to request access to information the school holds about them. This is known as a subject access request.

Subject access requests preferably need to be submitted in writing, either by letter or email and include:

• The pupil’s name
• A correspondence address
• A contact number and email address
• Details about the information requested

The school will not reveal the following information in response to subject access requests:

• Information that might cause serious harm to the physical or mental health of the pupil or another individual
• Information that would reveal that the child is at risk of abuse, where disclosure of that information would not be in the child’s best interests
• Information contained in adoption and parental order records
• Certain information given to a court in proceedings concerning the child

Subject access requests for all or part of the pupil’s educational record will be provided, free of charge, within 1 month of a request. Personal data about a child belongs to that child, and not the child’s parents. This is the case even where a child is too young to understand the implications of subject access rights. For a parent to make a subject access request, the child must either be unable to understand their rights and the implications of a subject access request, or have given their consent.

The Information Commissioner’s Office, the organisation that upholds information rights, generally regards children aged 12 and above as mature enough to understand their rights and the implications of a subject access request. Therefore, most subject access requests from parents of pupils at our school may not be granted without the express permission of the pupil.

If parents ask for copies of information, they will be required to pay the cost of making the copies.

Where can you find out more information?

If you would like to find out more information about how we and/or the DfE collect, use and store your personal data, please visit our website (https://www.purbeck.dorset.sch.uk/) or download our Data Protection Policy.

Last updated

We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This version was last updated on 9th February 2022.

Contact

If you would like to discuss anything in this privacy notice, please contact the Data Officer at The Purbeck School.

Abby Bartlett

abartlett@purbeck.dorset.sch.uk

 or call 01929 550077