Students' Data Privacy Notice
How We Use Pupil Information
Introduction
This privacy notice explains how we collect, use, store and share personal information about our pupils. It should be read with the School’s Data Protection Policy and is updated annually.
Categories of Pupil Information We Process
- Personal identifiers & contacts (name, unique pupil number, contact details, address).
- Characteristics (ethnicity, language, free school meal eligibility).
- Safeguarding information (court orders, professional involvement).
- Special educational needs (including plans and support ranking).
- Medical & administration (doctors, allergies, health conditions, dietary needs).
- Attendance (sessions attended, absences, previous schools).
- Assessment & attainment (KS results, exams, post-16 applications).
- Behaviour & exclusions.
- Trips, visits, clubs and enrichment activities.
- Catering and free school meal management.
- Identity management & authentication (site access permissions).
- Post-16 destinations (UCAS, apprenticeships, careers).
- CCTV images (for safety, crime prevention and investigation).
- Communications (emails/phone calls where recorded for training, safeguarding or evidence).
Why We Collect and Use Pupil Information
We use pupil data to:
- Deliver education and pastoral care.
- Support transition between schools and higher education.
- Monitor attainment and progress.
- Keep children safe (including allergy/emergency contact info).
- Assess and improve our services.
- Meet statutory duties (census, exam administration, funding).
- Manage trips, events, IT systems and secure access.
Our Lawful Bases
Providing education & safeguarding – Article 6(1)(e) (public task) & Article 9(2)(g) (substantial public interest).
SEND/EHCP support – Article 6(1)(e) & Article 9(2)(g).
Statutory returns (school census, exams) – Article 6(1)(c) (legal obligation, Education Acts 1996 & 2005, Education Regulations 2013).
Health & medical care – Article 6(1)(d) (vital interests) & Article 6(1)(e), Article 9(2)(h) (health care).
Optional activities (marketing, photos) – Article 6(1)(a) (consent) & Article 9(2)(a) (explicit consent).
How We Collect Pupil Information
- Registration & admissions forms.
- Secure transfer from previous schools (Common Transfer File).
- Direct contact (meetings, phone calls, emails).
- School systems (learning platforms, safeguarding records).
- CCTV on site (images retained normally for [X] days unless required longer for investigation).
Storing Pupil Information
Data is held securely on protected systems. Retention follows our Data Retention Schedule (available on request or via our website).
Who We Share Pupil Information With
- Next schools, colleges, universities.
- Lincolnshire Local Authority (admissions, safeguarding, Fair Access).
- Department for Education (DfE).
- Youth Support Services (for pupils aged 13+).
- Examination Boards & UCAS.
- School Nursing Team / NHS.
- Educational psychology & SEND services.
- Careers guidance services.
- Approved IT & cloud service providers (e.g. Microsoft, AWS, Cloud Design Box, Century).
- Auditors or regulators when legally required.
- We do not share data unless permitted by law or policy, or where you give consent.
Youth Support Services
Age 13+: We provide name, address, DOB to LA or youth support services under s.507B Education Act 1996. Other data shared only with parental consent.
Age 16+: Young people can request we stop sharing their contact details.
Data is transferred securely and kept by youth support services for their statutory period.
How the DfE Uses Pupil Data
The DfE uses pupil data to:
- Calculate school funding.
- Monitor performance and support accountability.
- Conduct research and long-term policy evaluation.
The DfE shares data only where lawful, secure and ethical, following strict approval and security checks.
More: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data
Your Data Protection Rights
Parents and pupils have the right to:
- Be informed about how we use your data.
- Access your/your child’s data (Subject Access Request).
- Rectify inaccurate data.
- Request erasure where no lawful reason to keep it.
- Restrict or object to processing in certain cases.
- Not be subject to solely automated decisions with legal effect.
- Withdraw consent where processing is based on consent.
- Complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/.
(Some rights do not apply where processing is legal obligation or public task.)
Contact
Mrs C. Hausermann, Data Protection Officer
