(How we use pupil information)
Why do we collect and use pupil information?
We collect and use pupil information on the following grounds:
- where you, the pupil (if aged 13 or over), or your parent or guardian (if under 13), have given consent to us doing so for a specific purpose;
- where it is necessary in order for the school or Hamwic Education Trust to comply with a legal obligation that it is subject to;
- where it is necessary for the performance of a contract to which you are party;
- where it is necessary to protect your vital interests or those of another person;
- where it is necessary for the performance of a task carried out by the school or Hamwic Education Trust in the public interest; and
- where it is necessary for archiving purposes.
Special categories of data include those relating to:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data;
- biometric data for the purpose of uniquely identifying a natural person;
- health; and
- sex life or sexual orientation.
Special categories of data can only be processed if the Trust also meets one of the following conditions:
- The individual has given explicit consent to the processing of it;
- The data is manifestly made public by the individual;
- The processing is necessary:
- For carrying out and exercising the Trust's or the individual's rights for employment purposes or social security and social protection purposes as authorised by law;
- To protect the vital interests of an individual who is physically or legally incapable of giving consent;
- For the establishment, exercise or defence of legal claims;
- For reasons of substantial public interest, on a legal basis that is proportionate to the aim pursued and provides for suitable and specific measures to safeguard the individual's rights;
- For medical reasons including for medical diagnosis and provision of treatment; and
- For reasons of public interest in the area of public health.
We use the pupil data:
- to support pupil learning;
- to monitor and report on pupil progress;
- to assess pupils;
- to provide appropriate pastoral care;
- to review pupil outcomes across the Trust;
- to carry out safeguarding activities;
- to provide services and assess the quality of our services; and
- to comply with the law regarding data sharing.
The categories of pupil information that we collect, hold and share include:
- Personal information (such as name, unique pupil number and address);
- Characteristics (such as ethnicity, nationality, country of birth and language, including English as an additional language information);
- Eligibility information (such as for free school meals and pupil premium);
- Assessment information (such as results of examinations and mock examinations);
- Attendance information (such as sessions attended, number of absences and absence reasons);
- Medical information;
- Special Educational Needs information;
- Exclusions/behavioural information;
- Post-16 learning information; and
- Fingerprints for secondary age pupils for catering purposes.
- CCTV images and videos
Collecting pupil information
Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.
Storing pupil data
We hold pupil data for the period of time set out in the Hamwic Education Trust's record retention schedule (details of which are available upon request); this may involve data being held until a pupil has reached the age of 25.
We do not store data outside of the UK.
Who do we share pupil information with?
We routinely share pupil information with:
- our academy trust company, Hamwic Education Trust;
- other schools within Hamwic Education Trust;
- schools that the pupil attends after leaving us;
- the relevant local authority;
- the Department for Education (DfE); and
- health and wellbeing professionals that provide pupil services for our school (such as speech and language therapists and educational psychologists).
We may also share data with third party suppliers who process data on our behalf, such as publishers of school handbooks, official photographs and web designers or IT providers.
Why we share pupil information
We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.
We share pupils’ data with the DfE on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.
We are required to share information about our pupils with the DfE under regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.
Data collection requirements:
To find out more about the data collection requirements placed on us by the DfE (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.
The National Pupil Database (NPD)
The NPD is owned and managed by the DfE and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the DfE. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.
To find out more about the pupil information we share with the DfE, for the purpose of data collection, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.
To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.
The DfE may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
- conducting research or analysis;
- producing statistics; and
- providing information, advice or guidance.
The DfE has robust processes in place to ensure that the confidentiality of our data is maintained and there are stringent controls in place regarding access to and use of the data. Decisions on whether the DfE releases data to third parties are subject to a strict approval process and are based on a detailed assessment of:
- who is requesting the data;
- the purpose for which it is required;
- the level and sensitivity of data requested; and
- the arrangements in place to store and handle the data.
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the DfE's data sharing process, please visit:
For information about which organisations the DfE has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received.
To contact the DfE: https://www.gov.uk/contact-dfe.
Who may provide us with data about you
We receive information about pupils from a number of external sources, e.g. previous schools, local authorities, social services and the police.
We will explain to you when we receive information from any of these sources.
Requesting access to your personal data
Under data protection legislation, parents and pupils have certain rights to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s progress and attainment record, contact the school's Data Compliance Officer, or the Data Protection Officer of Hamwic Education Trust.
Please note that parents/guardians do not have an automatic right to see all information about their child and certain rights may only be exercised by a pupil or with their permission.
You also have the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress;
- prevent processing for the purpose of direct marketing;
- object to decisions being taken by automated means;
- in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
- claim compensation for damages caused by a breach of the data protection regulation.
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/
If you would like to discuss anything in this privacy notice, obtain a copy of your personal data or exercise any of your rights, please contact:
- Rebekah Kennedy – firstname.lastname@example.org.
- The Trust's Data Protection Officer, Gemma Carr, Deputy CEO (Business), who can be contacted by email at email@example.com or by telephone on 023 8078 6833. Alternatively, the DPO can be contacted at the Trust's address which is Hamwic Education Trust, Unit E, The Mill Yard, Nursling Street, Southampton, Hampshire SO16 0AJ.
Staff Privacy Notice
- This notice is to help you understand how and why we collect personal information about you and what we do with that information. It also explains the decisions that you can make about your own information.
- We are Hamwic Education Trust (the Trust). The Trust operates [name of School] (the School). The Trust is ultimately responsible for how the School handles your personal information. In this privacy notice, we use the term "Trust" to mean both the School and the Trust.
- If you have any questions about this notice, please contact the Data Protection Officer (DPO).
- This notice is aimed at all Trust staff (including Governors, volunteers and certain contractors) and applicants for employment vacancies. This privacy notice does not form part of your contract of employment and the Trust may amend this notice at any time.
What is personal information?
- Personal information is information which is about you and from which you can be identified.
- This includes your contact details, next of kin and financial information. We may also hold information such as your religion or ethnic group. CCTV, photos and video recordings of you are also personal information.
What personal information does the Trust hold about you and how is this obtained?
- We set out below examples of the personal information the Trust holds about you and where this personal information comes from.
- Information about you is gathered during the recruitment process:
- such as information about your education, qualifications and professional achievements;
- you will provide certain information to us, for example, on your application form and during any interviews;
- we may obtain information from publicly available sources such as your social media profiles; and
- we will receive your personal information (from you and third parties) when we carry out pre-employment checks, for example, when we receive references, confirmation of your fitness to work, your right to work in the UK and criminal records checks.
- We will hold information about your job performance. This includes information about skills, achievements, career progression, performance and disciplinary related matters.
- We hold and use your financial information, such as, your bank details, your salary and pension details.
- We will hold information about any physical or mental health condition you may have which is disclosed to the Trust during the recruitment process or at any stage during your employment.
- We will hold information about any protected characteristics you may have (e.g. a disability) which you provide, for example on the Equal Opportunities Monitoring Form.
- Your personal information may be created internally by the Trust during the course of your employment. An email from the Head to a member of staff complimenting them on class management would be an example of this.
- Your personal information may be acquired from outside of the Trust community such as from occupational health practitioners or from public authorities such as the Police or the Local Authority Designated Officer.
- Pupils may provide us with your personal information, for example, if a pupil emails their tutor to say how much you are helping them with their work.
Why does the School use your personal information?
- We commonly use personal information for:
- ensuring that we provide a safe and secure work environment;
- providing employment services (such as payroll and references);
- providing training and support;
- protecting and promoting the Trust's interests and objectives (including fundraising);
- personnel, administrative and management purposes and to enable us to meet our legal obligations as an employer. For example, to pay staff and to monitor their performance;
- safeguarding and promoting the welfare of all staff and pupils; and
- fulfilling our contractual and other legal obligations.
- Some specific examples of when the Trust uses your personal information as set out below:
- We use your personal information to consider your suitability to work in your role at the Trust.
- We will check that you have the right to work in the UK by reviewing your identification documents and keeping copies on your personnel file.
- We may use your personal information in addressing performance or disciplinary concerns.
- We will use information relating to any medical condition you may have in order to verify fitness to work, monitor sickness absence and comply with our duty of care towards you.
- We may use your information when dealing with complaints and grievances (e.g. from other staff and parents).
- We may use information about you and photographs and video recordings of you for marketing and promotion purposes including in School or Trust publications, in social media and on the school or Trust website.
- We may use your information to enable the development of a comprehensive picture of the workforce and how it is deployed
- We may use your information to inform the development of recruitment and retention policies
- We may also allow external publication of certain media where appropriate (for example, a photograph or article in a local newspaper).
- We may also make recordings for teaching purposes, for example, recording a drama lesson to provide feedback to you or pupils. We may also record lessons for pupils who were not able to attend in person.
- We use CCTV recordings for the purposes of crime prevention and investigation and also in connection with our obligation to safeguard the welfare of pupils, staff and visitors to the School site.
- The School / Trust regularly monitors and accesses its’ IT system for purposes connected with the operation of the School or the Trust. The IT system includes any hardware, software, email account, computer, device or telephone provided by the Trust or used for Trust business. The Trust may also monitor staff use of the Trust telephone system and voicemail messages. Staff should be aware that the Trust may monitor the contents of a communication (such as the contents of an email).
- The purposes of such monitoring and accessing include:
- to help the School / Trust with its day to day operations. For example, if a member of staff is on holiday or is off sick, their email account may be monitored in case any urgent emails are received; and
- to check staff compliance with the School / Trust's policies and procedures and to help the Trust fulfil its legal obligations. For example, to investigate allegations that a member of staff has been using their email account to send abusive or inappropriate messages.
- Monitoring may be carried out on a random basis or it may be carried out in response to a specific incident or concern.
- The School / Trust also uses software which automatically monitors the IT system (for example, it would raise an alert if a member of Staff visited a blocked website or sent an email containing an inappropriate word or phrase).
- The monitoring is carried out by the School / Trust. If anything of concern is revealed as a result of such monitoring, then this information may be shared with the School Leader / Line Manager this may result in disciplinary action. In exceptional circumstances concerns may need to be referred to external agencies such as the Police.
How does the Trust share staff personal information with third parties?
- We may need to share your information with the Disclosure and Barring Service (DBS) or the National College for Teaching and Leadership (NCTL) when carrying out safer recruitment checks or in making a referral to the DBS or the NCTL.
- We may need to share your information with UK Visas and Immigration (UKVI) in order to sponsor you as an employee if you are from outside of the European Economic Area and to meet the Trust's sponsorship duties.
- Occasionally we may use consultants, experts and other advisors (including legal advisors) to assist us in fulfilling our obligations and to help run the Trust properly. We might need to share your information with them if this is relevant to the work they carry out.
- In accordance with our legal obligations, we may share information with Ofsted, for example, during the course of an inspection, and may need to share your information with the Department for Education.
- We may share information about you with the other schools in the multi-academy trust. For example, information about which pupils you teach and/or information relating to the pre-employment checks the School has carried out.
- We may share some of your information with our insurance company or benefits providers, for example, where there is a serious incident.
- If the Trust is dealing with a complaint or grievance (e.g. from a parent) we may share your information with other parties, for example, the appropriate staff at the Trust, the parents making the complaint and governors.
- We may share your information with individuals connected to the Trust who are exercising their data protection rights, for example, when responding to a subject access request.
- We may share personal information about staff with the relevant statutory agencies who may need this information to investigate allegations of misconduct.
- We may need to share your information with the police for the prevention and investigation of crime and the prosecution of offenders.
- CCTV recordings may be disclosed to third parties such as the police.
- We may share your information with parents and pupils where this is related to your professional duties.
- We may need to share your information if there is an emergency, for example, if you are hurt in an accident.
- We sometimes use contractors to handle personal information on our behalf. The following are examples:
- Portsmouth City Council - our payroll provider;
- For how long does the Trust keep staff personal information?
- We keep your information for as long as we need to in relation to your employment. We will keep some information after you have left the Trust in case this is needed, for example, in relation to our legal obligations and in accordance with the School / Trust record retention schedule.
- In exceptional circumstances we may keep your information for a longer time than usual but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.
- We can keep information about you for a very long time or even indefinitely if we need this for historical, research or statistical purposes. For example, if we consider the information might be useful if someone wanted to write a book about the Trust.
The school and Trust have a records retention schedule which can be found on the intranet or by requesting a copy from your School Data Compliance Officer (DCO).
Processing in line with your rights
- From May 2018 data protection legislation gives you a number of rights regarding your information. Some of these are new rights whilst others build on your existing rights. Your rights are as follows:
- if information is incorrect you can ask us to correct it;
- you can also ask what information we hold about you and be provided with a copy. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to;
- you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information;
- you can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer;
- our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.
You also have the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress
- prevent processing for the purpose of direct marketing
- object to decisions being taken by automated means
- in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
- claim compensation for damaged caused by a breach of the Data Protection regulations
The DPO can give you more information about your data protection rights.
Our legal grounds for using your information
This section contains information about the legal basis that we are relying on when handling your information as described above.
We will need to use your information in order to comply with our contractual obligations. For example:
- we need your name and bank details so that we can pay you your salary;
- we may need to provide your personal information to a pension provider;
- we also need to use your personal information to provide contractual benefits;
- if we provide you with accommodation under your contract we will use your personal information as part of this provision.
We have to comply with various laws and this entitles us to use your information where necessary. For example:
- we have to make sure that you have the right to work in the UK;
- to fulfil our duty of care to you and your colleagues;
- we have to fulfil our safeguarding duties towards pupils; and
- we may be legally obliged to disclose your information to third parties such as the DBS, local authorities or the police.
We may use your information where this is necessary to protect your vital interests or someone else's. For example, to prevent someone from being seriously harmed or killed.
Performance of a task carried out in the public interest
We use your information for a variety of reasons in the public interest, for example:
- facilitating our teaching requirements, for example, to help us decide which member of staff will teach a particular class based on skills, experience, qualifications and so on;
- looking after your welfare and development and the welfare and development of others;
- safeguarding and promoting the welfare of our pupils;
- ensuring the security of the school site which may involve issuing you with a photocard;
- making sure that you are complying with your employment obligations;
- facilitating the efficient operation of the Trust; and
- ensuring that we comply with all of our legal obligations.
If you object to us using your information when we are relying on this ground please speak to your school’s DCO.
The Trust must also comply with an additional condition where it processes special categories of personal information. These special categories are as follows: personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation. The grounds that we are relying on to process special categories of personal data are set out below:
Employment, social security and social protection
The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the Trust and staff in the field of employment, social security or social protection.
To protect the vital interests of any person where that person cannot give consent, for example, if they are seriously hurt and are unconscious.
The processing is necessary for the establishment, exercise or defence of legal claims. This allows us to share information with our legal advisors and insurers.
This includes medical treatment and the management of healthcare services.
Substantial public interest
The Trust is also allowed to use special categories of personal information where doing so is necessary in the substantial public interest. This is similar to "Public interest" in the table above, for example the Trust may use special categories of information when providing an education to pupils, looking after the welfare of pupils or when the Trust is inspected.
We may ask for your consent to use your information in certain ways. If we ask for your consent to use your personal information you can take back this consent at any time. Any use of your information before you withdraw your consent remains valid. Please speak to the DCO if you would like to withdraw any consent given.
In some cases, we will rely on more than one of the grounds above for a particular use of your information. For example, we may rely on legitimate interests and public interest grounds when using your information to safeguard our pupils.
- Contact: If you would like any further information about anything within this notice please contact your school’s Data Compliance Officer, Rebekah Kennedy or the Trust’s Data Protection Officer. The Trust’s Data Protection Officer's contact details are Gemma Carr – firstname.lastname@example.org
- Please speak to the Data Compliance Officer in your school, Rebekah Kennedy if:
- you object to us using your information for marketing purposes e.g. to send you information about school events; or
- you would like us to update the information we hold about you; or
- you would prefer that certain information is kept confidential.
- ICO: If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner's Office: ico.org.uk.
- If you have a concern about the way we are collecting or using your personal data, we ask that you raise your concern with us in the first instance.