GENERAL PRIVACY NOTICE RELATING TO THE PROCESSING OF PERSONAL DATA BY Coedylan Primary School
(Version 3)
Introduction
In order to deliver our statutory functions as a school, it is necessary for us to collect and use (or ‘process’) personal data about individuals’ including our current, past and prospective pupils and their parents, carers, guardians (referred to in the notice as ‘parents’) and any emergency contacts.
Transparency is very important to us, and we aim to be open, honest, and upfront with individuals about how we use their personal data. We believe that if individuals are well informed and know from the outset what personal data we hold about them, how it will be used, for what purpose and who it may be shared with, individuals will be more confident that their personal data is being used in the right way and their privacy protected.
This privacy notice seeks to explain and provide information, at a high-level, relating to how the school generally processes personal data. Specifically, it provides information relating to;
- The ‘data controller’ of the personal data processed by the school
- How to contact us in relation to a data protection matter or concern
- The Data Protection Officer and how they can be contacted
- The categories of personal data we process
- The categories of individuals whose personal data we process
- Why we process the personal data
- Our lawful basis for processing the personal data
- Who and where we get the personal data from
- The categories of organisations we share the personal data with
- How long we retain the personal data
- Your data protection rights and your right to raise a complaint with the ICO
In addition to this general privacy notice, we have also developed more detailed privacy notices that provide specific information relating to the processing of personal data for the following purposes;
- Accident and incidents
- Additional learning needs
- Attendance
- Behaviour and exclusions
- Breakfast Club
- CCTV
- Educational visits
- Insurance claims
- Learner progression assessments
- Pupil Educational & Curricular Record
- Safeguarding
- School Based Complaints
- School events and activities (including taking photographs and recording/filming)
- School Meals
These privacy notices are published by Rhondda Cynon Taf County Borough Council (RCTCBC) on our behalf, under a data protection Service Level Agreement. The privacy notices can be viewed here.
The Data Controller
The school is the data controller for the personal data we process, unless otherwise stated. This includes the personal data processed by the Governing Body, head teacher, individual governors, teachers, teaching assistants and support staff etc.
The school is registered with the ICO as a controller under registration number Z7232812
How to contact us for data protection matters or concerns
The school’s Data Protection Lead is the main point of contact for data protection matters. There are many ways you can contact the Data Protection Lead, including by phone, email, post and in person as follows;
- By post/in person: Coedylan Primary School. Tyfica Road, Pontypridd. CF37 2DB
- By telephone: 01443 486829
- By email: admin@coed-y-lanprimary.rctcbc.cymru
The Data Protection Officer
RCTCBC provides a data protection support service to the school under a Service Level Agreement, including the provision of a Data Protection Officer (DPO).
The DPO can be contacted in relation to data protection matters. However, we encourage you to contact the school in the first instance. Should you have the need to contact the Data Protection Officer directly you can do so via email to the following email address;
We recommend, when contacting the DPO, that you send a copy of the correspondence to the school as the data controller.
The categories of personal data we process
Pupils
We typically process the following categories of personal data relating to every pupil;
- Personal identifiers such as name, unique pupil number, date of birth etc.
- Contact Information such as address, telephone number, email address etc.
- Characteristics such as ethnicity, language, nationality, place of birth, sexual orientation, free school meal eligibility, child looked after status
- Relevant health and medical information such as doctor’s information, child health, dental health, allergies, sight and hearing health, medication, dietary requirements etc.
- Attendance information such as sessions attended, number of absences, absence reasons, previous schools attended etc.
- Assessment and attainment information
- Information relating to home to school transport / collection arrangements
- Images (captured by CCTV)
We may process the following categories of personal data depending on pupil needs and individual circumstance;
- Additional learning needs and disability information
- Safeguarding information such as – court orders, professional involvement.
- Information relating to behaviour and exclusions
- Information relating to accidents and incidents.
- Information relating to school-based complaints.
Parents & Emergency Contacts
We typically process the following categories of personal data relating to every parent and emergency contact;
- Personal identifiers and contact details such as – name, address, telephone
number, place of work (if applicable), email address etc.
- Relationship to the child
We may process the following categories of personal data relating to parents, depending on pupil needs and family circumstance;
- Information relating to whether a parent is a member of the armed forces
- Legal access to the child and any court orders indicating access rights
- Relevant household/family information such as siblings, childcare arrangements etc.
- Relevant information relating to support service involvement e.g. social services, safeguarding, additional learning needs etc.
- Financial information e.g. relating to payments that are made or due to the school
- Relevant information relating to school-based complaints
- Images – captured by CCTV
Why we process the personal data
We process the personal data to deliver our statutory functions as a school. This includes but is not limited to the following activities and functions;
- admissions
- pupil learning
- record, monitor, address and report on pupil progress, attainment, performance etc.
- record, monitor, address and report on pupil behaviour and exclusions
- record, monitor, address and report on pupil attendance
- refer, review, monitor and support in respect of Additional Learning Needs provision
- safeguard pupils
- provide appropriate pastoral care
- meet the statutory duties placed upon us for data collections
- statutory inspections
- general administration and finance
- school governance
- arrange and provide educational visits
- organise/co-ordinate home to school transport
- organise/co-ordinate school meal provision
organise/co-ordinate breakfast club provision
- manage school-based complaints
- health and safety
- accident and incident recording and reporting
- recording appropriate information in respect of insurance claims
- document and keep a record of events or activities e.g sports day, award ceremonies
- engage with parents and keep in touch in relation to the pupil’s education provision and progress
- contact parents in the case of urgency
- review and assess the quality of our education provision
- resource planning
Our lawful bases for processing the personal data
Under the General Data Protection Regulation (GDPR), our lawful basis for processing the personal data deliver our statutory functions as a school is;
- Legal Obligation (c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
- Public Task – Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Substantial public interest – Article 9 (2) (g) – processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
In limited circumstances (for example when recording school concerts) we will rely on;
- Consent – Article 6(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Where consent is the lawful basis for processing it will be sought from pupils or parents (depending on pupil age) prior the personal data is collected. Individuals have the right to withdraw this consent at any time (see ‘Your data protection rights’ section below for further information).
Less commonly (for example in a medical emergency situation) we may rely on;
- Vital Interests – Article 6(d) and Article 9(c) – processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.
Who or where we get the personal data from;
We may receive the personal data from the following categories of individuals or organisations;
- Pupils
- Parents
- Emergency Contacts
- School staff – head teacher, teachers, teaching assistant, support staff etc.
- Governing Body, Individual School Governors, Independent Panels
- Local Authority support services such as the Admissions Team, Catering Service, Transport Service, Local Education Authority Data Team, Attendance & Wellbeing Service, Access and Inclusion etc.
- Local Authority business support services such as Governors Support, Insurance Section, Legal Services etc.
- Safeguarding organisations, services and professionals that may be involved in assessing, supporting or providing services to a pupil and their family (e.g. Local Authority Children’s Services, Cwm Taf Morgannwg Safeguarding Board, Health Boards, health professionals etc.).
- Private sector organisations and charities that may be involved in supporting or providing services to a pupil and their family (e.g. CAMHS).
- Public or visitor to the school
Who we share personal data with
We share personal data with the following key organisations to fulfil our statutory functions as a school. For more detailed information please refer to the more detailed process specific privacy notices which can be viewed here.
It should be noted that not all the personal data outlined above (the categories of personal data we process) is shared with every organisation. Only relevant information is shared in relation to the purpose.
| Who | Why |
| Welsh Government | National reporting, assessment etc. |
| Central South Consortium (via Welsh Government) | Reporting, assessment, school improvement etc. |
| ESTYN | Inspection purposes |
| Governing Body / School Governors / Independent Panels | Functions of the Governing Body and Independent Panel |
| Local Authority – Support Services | The school works alongside, and in conjunction with a number of Local Authority support services to deliver its statutory functions. These include but are not limited to; Admissions Team – manage schools admissions process, transfers etc.Transport Service – home to school transport provisionCatering Service – catering provision at the schoolData Team – statutory reporting, financial managementAttendance & Wellbeing Service – record, monitor and address pupil attendanceAccess & Inclusion Service – referrals, assessments of need, implement and review ongoing supportSocial Services – referrals, assessments of need, implement and review ongoing supportResilient Families Service – – referrals, assessments of need, implement and review ongoing support |
| Cwm Taf Morgannwg Multi-Agency Safeguarding Hub (MASH) | The MASH is a single point of contact for all professionals to report safeguarding concerns, across Cwm Taf Morgannwg. The MASH comprises of staff from the Social Services, Education, Police, Health, National Probation Service and the Community Rehabilitation Company Safeguarding |
| Local Authority – Business Support Services | A number of Local Authority services support the business operations of the school. These include, but are not limited to; Governors Support – support, advice and guidance to the governing body etc.Human resources – employee services. Insurance Section – claims handling/management, advice, support, guidance etc.Legal Services – legal advice, support etc. Information Management – advice, support etc. |
| Health and Safety Executive | Reporting of accidents/incidents in compliance with Health and Safety legation. |
Data Processors
A data processor is a company or organisation that processes personal data on behalf of a controller. The school uses a number of data processors that provide services to us. The categories of data processors we use are;
- IT system suppliers
- IT secure data transfer system suppliers
- Home to school communication system suppliers
- Risk assessment system supplier (relating to educational visits)
Our data processors act only upon our instruction. They cannot do anything with your personal data unless we have instructed them to do it. They will not share your personal information with any organisation apart from us or use it for their own purposes. They will hold it securely and retain it for the period we instruct. Should you have a specific query relating to our data processors, please contact the Data Protection Lead.
How long we retain the personal data
In keeping with the General Data Protection Regulation storage limitation principle, records are periodically reviewed. Only personal data that is relevant to the record is retained for the entire retention period (e.g. documents that contain assessments, decisions, outcomes etc.). Information that has no long term or evidential value is routinely destroyed in the normal course of business.
Records that are retained, are kept in line with the guidance set out in the Retention Schedule contained within the Information Records Management Society Toolkit for Schools. Following retention period expiry, information is destroyed securely and permanently.
For further information on specific record types, please refer to our more detailed privacy notices which can be viewed here.
Your data protection rights
Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your personal data.
Your right of access
You have the right to ask us for copies of your personal data. This right always applies. There are some exemptions, which means you may not always receive all the data we process. You can read more about this right on the ICO’s website.
Your right to get your data corrected
You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete data you think is incomplete. This right always applies. You can read more about this right on the ICO’s website.
Your right to get your data deleted
You have the right to ask us to erase your personal data in certain circumstances. You can read more about this right on the ICO’s website.
Your right to limit how organisations use your data
You have the right to ask us to restrict the processing of your personal data in certain circumstances. You can read more about this right on the ICO’s website.
Your right to object to the use of your data
You have the right to object to us processing your personal data in certain circumstances. You can read more about this right on the ICO’s website.
Your right to data portability
This only applies to personal data you have given us. You have the right to ask that we transfer the personal data you gave us from one organisation to another or give it to you. This right only applies if we are processing the personal data based on your consent or under, or in talks about entering a contract and the processing is automated. You can read more about this right on the ICO’s website.
Please contact the school’s Data Protection Lead if you wish to make a request.
Your right to make a data protection complaint to the school
You have the right to complain to the school if you believe we have not handled your personal data responsibly and in line with good practice.
If you have a concern, we encourage you to contact the Data Protection Lead in the first instance. Most concerns can be resolved relatively quickly through a simple phone call or email to the school. Should you wish to make a formal complaint you can do so via our complaints policy.
Your right to make a data protection complaint to the ICO
You can also complain to the ICO if you are unhappy with how we have used your data, but we encourage you to contact us first.
The ICO’s contact information is:
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline number: 0303 123 1113
- Website: https://www.ico.org.uk