New School Privacy Notice

This policy is intended to provide information about how the school will use (or “process”) personal data about individuals including: its staff; its current, past and prospective pupils and their parents, carers or guardians (referred to in this policy as “parents”).

This Privacy Notice applies alongside any other information the school may provide about a particular use of personal data, for example when collecting data via an online or paper form.

This Privacy Notice also applies in addition to the school’s other relevant terms and conditions and policies, including:

• any contract between the school and its staff or the parents of pupils;
• the school’s policy on taking, storing and using images of children and staff;
• the school’s retention of records policy;
• the school’s safeguarding, pastoral, or health and safety policies, including as to how concerns or incidents are recorded; and
• the school’s IT policies.

Anyone who works for (or acts on behalf of) the school, should also be aware of and comply with this Privacy Notice. This applies to staff, volunteers and service providers. They should also be aware of the School’s Data Protection Policy for staff, which also provides further information about how personal data about those individuals will be used.

This privacy notice aims to clarify

• why the school needs to process personal data
• the types of personal data we collect and process
• how the school collects data
• the legal basis of our use of your personal data
• where we disclose your information to other parties
• how long we will keep your information for
• your rights
• our use of cookies on our website
• how to contact us

Why the school needs to process personal data

In order to carry out its ordinary duties to staff, pupils and parents, the school needs to process a wide range of personal data about individuals (including current, past and prospective staff, pupils or parents) as part of its daily operation.

Some of this activity the school will need to carry out in order to fulfil its legal rights, duties or obligations – including those under a contract with its staff, or parents of its pupils.

Other uses of personal data will be made in accordance with the school’s legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals, and provided it does not involve special or sensitive types of data.

The types of personal data we collect and process

This may include the following categories, by way of example:

• personal identifiers and contacts (such as name, unique pupil number, contact details and address)
• medical and administration (such as doctors information, child health, dental health, allergies, medication and dietary requirements)

• bank details and other financial information, e.g. about parents who pay fees to the school;
• past, present and prospective pupils’ academic, disciplinary, admissions and attendance records (including information about any special needs);
• personnel files, including in connection with academic records, employment or safeguarding;

• references given or received by the school about pupils, and relevant information provided by previous educational establishments and/or other professionals or organisations working with pupils;
• correspondence with and concerning staff, pupils and parents past and present; and
• images of pupils (and occasionally other individuals) engaging in school activities, (in accordance with the school’s policy on taking, storing and using images of children).

How the school collects data

Generally, the school receives personal data from the individual directly (including, in the case of pupils, from their parents). This may be via a form, or simply in the ordinary course of interaction or communication (such as email or written assessments).

However, in some cases personal data will be supplied by third parties (for example another school, or other professionals or authorities working with that individual) or collected from publicly available resources.

The legal basis of our use of your personal data

The school identifies that personal data is used under the following legal bases:

On the basis of fulfilling our contractual obligations:

• To provide education services, including musical education, physical training or spiritual development, career services, and extra-curricular activities to pupils, and monitoring pupils’ progress and educational needs;
• To safeguard pupils’ welfare and provide appropriate pastoral care;
• To give and receive information and references about past, current and prospective pupils and staff, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend; and to provide references to potential employers.

On the basis of its legitimate interests:

• For the purposes of pupil selection (and to confirm the identity of prospective pupils and their parents);
• Maintaining relationships with alumni and the school community, including direct marketing or fundraising activity;
• For the purposes of management planning and forecasting
• To monitor (as appropriate) use of the school’s IT and communications systems in accordance with the school’s IT Acceptable Use Policy;
• To carry out or cooperate with any school or external complaints, disciplinary or investigation process; and
• Where otherwise reasonably necessary for the school’s purposes, including to obtain appropriate professional advice and insurance for the school.

On the basis of meeting our legal or regulatory obligations:

• For the purposes of research and statistical analysis, including that imposed or provided for by law (such as tax, diversity or gender pay gap analysis);
• To enable relevant authorities to monitor the school’s performance and to intervene or assist with incidents as appropriate.

On the basis of consent:

• To make use of photographic images of pupils in school publications, on the school website and (where appropriate) on the school’s social media channels in accordance with the school’s policy on taking, storing and using images of children.

Where the school is relying on consent as a means to process personal data, any person may withdraw this consent at any time (subject to age considerations). Please be aware however that the school may not be relying on consent but have another lawful reason to process the personal data in question even without your consent.

In addition, the school will, on occasion, need to process special category personal data (concerning health, ethnicity or religion) or criminal records information (such as when carrying out DBS checks) in accordance with rights or duties imposed on it by law, including as regards safeguarding and employment, or from time to time by explicit consent where required. These reasons will include:

• To safeguard pupils’ welfare and provide appropriate pastoral and, where necessary, medical care, and to take appropriate action in the event of an emergency, incident or accident. This would include disclosing details of an individual’s medical condition or other relevant information where it is in the individual’s interests to do so, such as when seeking professional medical advice, for social protection, safeguarding, and cooperation with police or social services and also for insurance purposes. It also applies to caterers or organisers of school trips who need to be made aware of dietary or medical needs;
• To provide educational services in the context of any special educational needs of a pupil;
• To provide spiritual education in the context of any religious beliefs;
• In connection with employment of its staff, for example DBS checks, welfare, union membership or pension plans;

• As part of any school or external complaints, disciplinary or investigation process that involves such data, for example if there are SEN, health or safeguarding elements; or

• For legal and regulatory purposes (for example child protection, diversity monitoring and health and safety) and to comply with its legal obligations and duties of care.

Disclosure of your details to others

We will not pass your information to any third parties without consent unless the law and our policies allow us to do so. If at any time you no longer wish to receive marketing correspondence from us, please contact us and we will remove you from our records.

We regularly share pupil information with:

• Schools that the pupils attend after leaving us;
• government authorities (e.g. HMRC, DfE, police or the local authority); and
• appropriate regulatory bodies

For the most part, personal data collected by the school will remain within the school, and will be processed by appropriate individuals only in accordance with access protocols (i.e. on a ‘need to know’ basis). Particularly strict rules of access apply in the context of:

• pastoral or safeguarding files and medical information

However, a certain amount of any SEND pupil’s relevant information will need to be provided to staff more widely in the context of providing the necessary care and education that the pupil requires.

Staff, pupils and parents are reminded that the school is under duties imposed by law and statutory guidance (including Keeping Children Safe in Education) to record or report incidents and concerns that arise or are reported to it, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness in their nature or regularity. This is likely to include file notes on personnel or safeguarding files, and in some cases referrals to relevant authorities such as the LADO or police. For further information about this, please view the school’s Safeguarding Policy.

Finally, in accordance with Data Protection Law, some of the school’s processing activity is carried out on its behalf by third parties, such as IT systems, web developers or cloud storage providers. This is always subject to contractual assurances that personal data will be kept securely and only in accordance with the school’s specific directions.

How long we will keep your information for

The school will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason. Typically, the legal recommendation for how long to keep ordinary staff and pupil personnel files is up to 7 years following departure from the school. However, incident reports and safeguarding files will need to be kept much longer, in accordance with specific legal requirements.

The Department of Education

The Department of Education (DfE) collects personal data from educational settings and local authorities via various statutory data collections. We are required to share information about our pupils with the Department of Education (DfE) either directly or via our local authority for the purpose of those data collections, under:

• Section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.
• To ask us for access to information about you that we hold
• To have your personal data rectified, if it is inaccurate or incomplete
• To request the deletion or removal of personal data where there is no compelling reason for its continued processing
• To restrict out processing of your personal data (i.e. permitting its storage but no further processing)
• To object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
• Not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you

Requesting access to your personal data

Under data protection regulation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact the Headmistress via emil on headmistress@thenewschoolexeter.co.uk.

The school will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time-limits (which is one month in the case of requests for access to information).

The school will be better able to respond quickly to smaller, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, the school may ask you to reconsider, or require a proportionate fee (where Data Protection Law allows it).

You also have the right to:

The right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information which identifies other individuals (and parents need to be aware this may include their own children, in certain limited situations – please see further below), or information which is subject to legal privilege (for example legal advice given to or sought by the school, or documents prepared in connection with a legal action).

In general, the school will assume that pupils’ consent is not required for ordinary disclosure of their personal data to their parents, e.g. for the purposes of keeping parents informed about the pupil’s activities, progress and behaviour, and in the interests of the pupil’s welfare. That is unless, in the school’s opinion, there is a good reason to do otherwise.

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/

Withdrawal of consent and the right to lodge a complaint

Where we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with out use of your personal data, please let us know by contacting Michelle Taylor at headmistress@thenewschoolexeter.co.uk.

Access of our digital services and our use of cookies

When someone visits our website, we collect standard internet log information and details of visitor behaviour patterns. This is to allow us to monitor user behaviour and visit rates. This information is anonymous. Where we gather personal information, this will be made clear.

Our website makes use of cookies to improve your browsing experience. A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.

Cookies may be either persistent cookies or session cookies. A persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date. A session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.

Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.

We use cookies for the following purposes:

(a)analysis - we use cookies to help us to analyse the use and performance of our website and services; and

(b)cookie consent - we use cookies to store your preferences in relation to the use of cookies more generally.

Where we link to third party websites, they will have their own privacy and cookies policies and it is your responsibility to review these. We cannot accept any responsibility or liability for the policies of third party websites.

Responsibility for Data Protection

The Compliance Officer for the New School is Mr Ash who can be contacted on his email office@thenewschoolexeter.co.uk or 01392 496122

Last updated

We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated on 18^th October 2018.

Contact us

If you have any questions about this privacy notice or our treatment of your personal data, please write to us by email to office@thenewschoolexeter.co.uk or by post to The Compliance Officer, The New School, The Avenue, Exminster, Devon EX6 8AT.

How Government uses your data

The pupil data that we lawfully share with the DfE through data collections:

• Underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school
• Informs ‘short term’ education policy monitoring and school accountability and intervention (for example, Pupil Progress measures)
• Supports ‘longer term’ research and monitoring of educational policy (for example, how certain subject choices go on to affect education or earnings beyond school)

Data collection requirements

To find out more about the data collection requirements placed on us by the Department for Education (for example, via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools

The National Pupil Database (NPD)

Much of the data about pupils in England goes on to be held in the National Pupil Database (NPD). The NPD is owned and managed by the DfE and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department.

It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

To find out more about NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information

Sharing by the Department

The law allows the Department to share pupil’s personal data with certain third parties, including:

• Schools and local authorities
• Researchers
• Organisations connected with promoting the education or wellbeing of children in England
• Other government departments and agencies
• Organisations fighting or identifying crime

For more information about the Department’s NPD data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data