Welldon Crescent, Harrow, Middlesex HA1 1QQ Telephone: 020 8863 8769

Norbury School Privacy Notice (Pupils & Parents)

Article 16: Children have the right to privacy

Article 29: Children have the right to an education which develops their interests, talents and abilities

Article 36: Children have the right to protection from any kind of exploitation (being taken advantage of)

Norbury is committed to protecting the privacy and security of your personal information. We take care to protect the privacy of Parents, Carers and Pupils that communicate (online or offline) with us in person, over the phone, using emails/text messages or through our mobile applications, websites and social media platforms.]

We have therefore developed this privacy notice to inform you of the data we collect, what we do with your information, what we do to keep it secure as well as the rights and choices you have over your personal information.

Throughout this document we refer to Data Protection Legislation which means the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation  (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where data is processed by a controller or processor established in the European Union or comprises the data of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). This includes any replacement legislation coming into effect from time to time.

How we use pupil and parent information

Under General Data Protection Regulations (GDPR) we are obliged to inform you of the information we hold on and your child(ren), what we use it for, who we share it with, and for how long we keep it. This privacy notice also covers other members of pupils’ families who we may process data about from time to time, including, for example, siblings, aunts and uncles and grandparents. This privacy notice (also known as a fair processing notice) aims to provide you with this information. If it, or any information linked to is unclear, please contact the school office, or the school’s Data Controller. Contact details for are available at the end of this privacy notice.

We, Norbury Primary School at Welldon Crescent, Harrow HA1 1QQ are the Data Controller for the purposes of data protection law. As a public body our Data Protection Officer details are as follows,

The DPO Centre Ltd

020 3797 1289

dpo@norbury.harrow.sch.uk

www.dpocentre.com

The schools Data Protection Leads are Mr M Hirani, Network & Facilities Manager and Ms J Hastings, School Manager

  1. The categories of parent, carer & pupil information that we collect, hold and share include but are not limited to:

• Personal information (such as name, unique pupil number and address, national insurance number).
• Contact details including other contacts and relatives (contact telephone numbers, email addresses, postal addresses, date of birth, identification documents)
• Characteristics (such as language, nationality, country of birth and free school meal eligibility)
• Attendance information (such as sessions attended, number of absences and absence reasons)
• Assessment information (such as data scores, tracking, and internal and external testing)
•Family circumstances
• IT and internet access information, including internet websites accessed.
• Photographs and videos (for internal safeguarding & security purposes, school newsletters, social media and promotional purposes).
• CCTV images captured on school grounds.
• Payment/banking details

We may also collect, store and use information about you that falls into “special categories” of more sensitive personal data. This includes information about (where applicable):

We collect information about pupils when they join the school and update it during their time on the roll as and when new information is acquired. We may also ask you to review some of the personal information we hold to ensure that it is accurate

We may also hold data about pupils that we have received from other organisations, including other schools, local authorities and the Department for Education.

  1. Why we collect and use this information

We use the pupil and parent data:

  1. The lawful basis on which we use this information

Our lawful basis for collecting and processing personal information is defined under Article 6, and the following sub-paragraphs in the GDPR apply:

(a) Data subject gives consent for one or more specific purposes.

(c) Processing is necessary to comply with the legal obligations of the controller.

(d) Processing is necessary to protect the vital interests of the data subject.

(e) Processing is necessary for tasks in the public interest or exercise of authority vested in the controller (the provision of education).

Our lawful basis for collecting and processing personal information is also further defined under Article 9, in that some of the information we process is deemed to be sensitive, or special category, information and the following sub-paragraphs in the GDPR apply:

(a) The data subject has given explicit consent.

(b) It is necessary to fulfil the obligations of controller or of data subject.

(c) It is necessary to protect the vital interests of the data subject.

(d) Processing is carried out by a foundation or not-for-profit organisation (includes religious, political or philosophical organisations and trade unions)

(e) Reasons of public interest in the area of public health

(f) It is in the public interest

Where we have obtained consent to use personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights. In limited circumstances we may approach you for your written consent to allow us to process certain particularly sensitive data.  If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.  You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Some of the reasons listed above for collecting and using personal data overlap, and there may be several grounds which justify our use of this data.

An example of how we use the information you provide is:

The submission of the school census returns, including a set of named pupil records, is a statutory requirement on schools under Section 537A of the Education Act 1996. Putting the school census on a statutory basis:

  1. Collecting information

We collect pupil information via admission forms when you child first starts at the school, registration forms at the start of the school year or Common Transfer File (CTF) or secure file transfer from previous school.
Whilst the majority of information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain information to us or if you have a choice in this.
We hold (on your behalf) additional contacts 3 & 4 that we may use in an emergency, should we be unable to contact either parent/carer.
From you about other people:

If you provide information on behalf of anyone else, then in doing so you are confirming that you have explained to them how their information may be used by us and they have given you permission to do so. You will also contact us immediately if they no longer wish their data to be held by us or their data needs to be updated.

Where we have obtained consent to use personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

  1. Storing data

We keep personal information about you while your child is attending our school. We may also keep it beyond their attendance at our school if this is necessary in order to comply with our legal obligations. The Information and Records Management Society’s toolkit for schools sets out how long we keep information about pupils, parents and carers.

  1. Who we share information with

Personal data is not shared with third party without consent unless required by law and our policies allow us to do so.

We may share the following information with third party where legally required and ensure they comply with data protection act,

NHS Test and Trace

All UK schools have an obligation to respond appropriately to the Government’s advice regarding coronavirus. In order to aid the Government in fighting COVID-19 (coronavirus) and to help keep everyone safe as children return to school, the school will take part in the NHS “Test and Trace” service.

If there is a suspected or confirmed case of COVID-19 then we may be required to share staff, students, parents and visitor’s personal data with NHS Test and Trace, who act as a Data Controller in their own right. We may also share this information with the Local Authority, who will use it for the purposes of COVID-19 prevention and detection only. This information may include:

Your full name

Your date of birth

Your contact details

Relevant medical information

We will keep a record of any information shared.

 If the NHS Test and Trace service contacts you, the service will use text messages, email or phone.

All information which we share through this service is shared in accordance with Article 6 and 9 of the GDPR:

Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’

 Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare’

 For more information about the service please see the Government guidance and Public Health England’s privacy notice:

https://www.gov.uk/guidance/nhs-test-and-trace-how-it-works

https://contact-tracing.phe.gov.uk/help/privacy-notice

Transferring data internationally

Where we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

  1. Why we share information

We do not share information with anyone without consent unless the law and our policies allow us to do so.

We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.

We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.

  1. Data collection requirements:

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

  1. The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to: https://www.gov.uk/government/collections/national-pupil-database

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website:

https://www.gov.uk/government/publications/dfe-external-data-shares

To contact DfE:

https://www.gov.uk/contact-dfe

  1. Requesting access to your personal data and your Data Protection Rights

Under data protection legislation, parents, carers and pupils have the right to request access to information about them that we hold, through a Subject Access Request. Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.

Parents also have the right to make a subject access request with respect to any personal data the school holds about them.

If you make a subject access request, and if we do hold information about you or your child, we will:

Individuals also have the right for their personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request please contact our data protection officer.

Parents/carers also have a legal right to access to their child’s educational record. To request access, please contact: office@norbury.harrow.sch.uk 

Please mark your email for attention of Ms L Browning, Headteacher

You also have the right to:

Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our data protection officer.

Alternatively, you can make a complaint to the Information Commissioner’s Office:

Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our Data Protection Officer,

The DPO Centre Ltd

50 Liverpool Street

London

EC2M 7PY

020 3797 1289

dpo@norbury.harrow.sch.uk

If you need more information about how the LA and DfE collect and use your information, then please contact:

The Data Protection Officer

The London Borough of Harrow

Civic Centre

PO Box 7

Station Road

Harrow

HA1 2UL

Website: www.harrow.gov.uk

Email: info@harrow.gov.uk

Tel: 020 8863 5611

Public Communications Unit

Department for Education

Sanctuary Buildings

Great Smith Street

London

SW1P 3BT

Website: www.education.gov.uk

Email: http://www.education.gov.uk/help/contactus

Tel: 0370 000 2288

Changes to this PRIVACY NOTICE

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

There is a printable version of the Privacy Notice below.

 Norbury Privacy Notice Pupils & Parents