GDPR Privacy Notice

Issued May 2018

Covering Letter, Paper Data Collection Form and SIMS Parent App Instructions

Crickhowell High School Privacy Notice

In accordance with the General Data Protection Regulations (GDPR) which come into force on 25 May 2018, this notice sets out what Crickhowell High School, the local authority (Powys County Council) and the Welsh Government does with the education related information that it receives about Children and Young People.

The information in this notice will be kept under review to incorporate any further changes communicated by the Information Commissioner’s Office.

Background

Crickhowell High School collects information about children and young people and their parents or legal guardians when children and young people enrol at Crickhowell High School. Crickhowell High School also collects information at other key times during the school year and may receive information from other schools or early years providers when children and young people transfer.

Crickhowell High School processes the information it collects to administer the education it provides to children and young people. For example:

the provision of educational services to individuals;
monitoring and reporting on pupils’/children’s educational progress;
the provision of welfare, pastoral care and health services;
the giving of support and guidance to children and young people, their parents and legal guardians;
the organisation of educational events and trips;
the planning and management of Crickhowell High School.

Powys County Council collects information about children and young people and their parents or legal guardians when children and young people apply for admission to Crickhowell High School. The local authority also has access to data collected by Crickhowell High School for the same reasons listed above and for the following additional purposes:

to monitor, challenge and provide support to schools and early years providers to improve performance and set credible targets
to support schools and early years providers in the services delivered to children and young people
to inform and support services provided by the Children and Young People’s Partnership (CYPP) and the Powys Youth Service to young people and their families
to carry out research and inform policy decisions including funding for schools and early years providers
to monitor the quality and scope of data held by schools and early years providers and provide support to ensure the data held about children and young people is accurate and up-to-date

Upon receipt of the information from your school or early years provider the Local Authority (Powys County Council) becomes the Data Controller.

As data controllers, Crickhowell High School and Powys County Council use the information received for the purposes listed above to enable them to carry out data processing necessary for the performance of a task carried out in the public interest and in the exercise of official authority

In addition, the Welsh Government receives information on pupils directly from schools normally as part of statutory data collections which consists of the following:

Post-16 data collection
Pupil Level Annual School Census (PLASC)
Educated other than at school (EOTAS) pupil level collection
National data collection (NDC)
Attendance collection
Welsh National Tests (WNT) data collection

In addition to the data collected as part of PLASC, the Welsh Government and Local Authorities also receive information regarding National Curriculum assessments, public examination results, and attendance data at individual pupil level which comes from Schools and /or Awarding Bodies (e.g. WJEC).

Upon receipt of the information from your school or early years provider and the Local Authority, the Welsh Government becomes the data controller.

What information is held by Crickhowell High School and Powys County Council?

The sort of personal information that will be held includes:

personal details such as name, address, date of birth, child/young person identifiers and contact details for parents and guardians;
information on any special educational needs;
information on performance in internal and national assessments and examinations;
information on the ethnic origin and national identity of children and young people (this is used only to prepare summary statistical analyses);
details about children’s and young people’s immigration status (this is used only to prepare summary statistical analyses);
medical information needed to keep children and young people safe while in the care of Crickhowell High School;
information on attendance and any disciplinary action taken;
information about the involvement of social services with individual children and young people where this is needed for the care of the child/young person

Who does Crickhowell High School and Powys County Council share your information with?

Information held by Crickhowell High School and Powys County Council on children and young people, their parents or legal guardians may also be shared with other organisations when the law allows and providing all appropriate steps are taken to keep the information secure, for example:

other education and training bodies, including schools, when children and young people are applying for courses or training, transferring schools or seeking guidance on opportunities;
bodies doing research for the Welsh Government, LA and schools/Early Years providers as long as steps are taken to keep the information secure;
central and local government for the planning and provision of educational services;
social services and other health and welfare organisations where there is a need to share information to protect and support individual children and young people;
Management Information System (MIS) providers in order to ensure that system functionality and accuracy is maintained;
The Council’s approved suppliers of the schools ‘cashless’ system to ensure all pupils, parents & guardians with parental responsibility and school staff are able to use it as appropriate;
Powys Teaching Health Board to support the provision of an effective School Nurse Service and other related health services for young people and their families;
FFT Education Research Trust (https://fft.org.uk/about-fft/) for the maintenance of the secure on-line FFT Aspire resource for schools enabling thorough self-evaluation using extensive progress measures and effective target-setting for pupil achievement;
GL Assessment (https://www.gl-assessment.co.uk/about-us/) for the administration of annual cognitive ability tests (CATs) and other similar diagnostic tools to support individual learning;
The South West and Mid-Wales Education Consortium (ERW) to support regional statistical analysis as required by Welsh Government;
various regulatory bodies, such as ombudsmen and inspection authorities, where the law requires that information be passed on so that they can do their work;
The Office of National Statistics (ONS) in order to improve the quality of migration and population statistics.

From time to time, we will ask for permission from both parents and students to use photographs and video images of the students in school publicity. All students aged 13 and above will be eligible to give their consent, along with a parent, carer or guardian. It should be noted that this content may be withdrawn at any time. A copy of the school consent form may be downloaded below.

GDPR Consent Form

Sharing personal information with curriculum-based software suppliers

Crickhowell High School may provide limited personal (but not sensitive) information to external companies providing a curriculum-based resource (which may be on-line) which is deemed to have educational value. In these circumstances the school will ensure that all reasonable precautions are taken to preserve the security of the data in line with current legislation and that the external supplier meets all legal requirements regarding the handling of this data as specified in a formal written agreement between the school and the supplier.

Crickhowell High School will endeavour to ensure that information is kept accurate at all times. Personal information will not be sent outside the United Kingdom unless it is protected by the enhanced security arrangements associated with the Welsh Government’s digital learning platform – ‘Hwb’. Details are available at: http://gov.wales/topics/educationandskills/publications/guidance/information-governance-guidance-for-schools/?lang=en

Companies and their applications currently used by the school in this way are:

Microsoft Office 365 – Emails, Sharepoint, Onedrive, Teams. Allows for collaborative working inside and outside school as well as Archiving and small factor databases.
Microsoft Azure – Offsite backup facility – Office 365 Authentication
Capita SIMS.net – The school’s core Information Management System – holds all core student data including contact information and results.
Capita – SIMS Options Online, SIMS Parent App Lite – Provides ability to choose options online for Year 8, and Parents to update information on their child(ren).
Hyperspheric Go4Schools – Provides attainment, attendance, behaviour and reporting facility
Show My Homework – Provides homework tasks for students and parents – maybe replaced with Go4Schools App
Teacher2Parent texting service – Provides texting facility to contact parents when child is off – to be replaced by Go4Schools App
CCTV – Provides building security and evidence if damage occurs – Inhouse solution with onsite monitoring
Surprema BioConnect – Biometrics for the Door Entry System
Paxton Net2 Pro – Door Control System for controlling access to doors
Examination Bodies – WJEC, OCR, Persons, AQA – Provides GCSE/GCE based awards/courses.
Tucasi – School Trip/Voluntary Fund management software – for manging and monitoring funding of school trips/voluntary visits
Capita – FMS – Core School Financial System – holds payment and salary information
WordPress – School website uses WordPress to manage the content on the school website which could contain student images.
ParentPay – PCC Provided online payment system for school meals and trips. Contains student information, year group, age, dietary requirements
NRS software – PCC provided Canteen till system – includes student information, picture age, dietary needs, balance on ParentPay account, meals chosen by students and fingerprints for procuring meals.
GCSEPod – Teachercentric – Provides revision podcasts for GCSE students – we share student names with this service – students then sign up.
Sign in App – Vistor/Staff/Student sign-in/out. We share names and photos for safeguarding and fire registers.

What information is received by Welsh Government?

Personal and special category information that will be collected and held includes:

Some personal information about you, such as:
- Name
- Address
- Date of birth
- Gender
- Ethnic group
- Disability status
- other health information
Information on any additional learning needs;
Information on performance in national assessments and examinations;
Information from your school about your education
Information on attendance

What is Welsh Government doing with your information?

As data controller, the Welsh Government uses the information received for the below purposes to enable us to carry out data processing necessary for the performance of a task carried out in the public interest and in the exercise of official authority:

For school performance reporting purposes, identifiable data will be shared back with the relevant schools.
For statistical and research purposes which will help to inform, influence and improve education policy for the with planning services for people in Wales.To monitor the performance and how well the education services are being provided so that they can be improved.To help monitor and target funding effectively.For publication purposes which includes a range of statistical outputs on the Welsh Government website.

School information published on My Local School website.

Production of school and local authority level analysis for schools, LA’s and consortia.

Link with other datasets, including non-educational data sets, in order to inform wider education and social policies. Examples of data sets that we may link include data on students in further or higher education institutions, or employment and welfare data from The Department of Work and Pensions. We will only link data sets where the law allows us to do so.

For research purposes wider than education we will use techniques that ensure the data are anonymized before any research takes place.

No action will be taken in relation to you personally.

Information will not be shared or combined in a way that could lead to you being identified, unless we are legally able to do so.

No data could ever be published that would identify individual pupils.

A full list of Welsh Government statistical publications can be viewed at:

www.statswales.gov.wales

Who does Welsh Government share your information with?

Information held by the Welsh Government about children and young people, their parents, or legal guardians, may be shared upon request and where the law allows, with organisations linked to education and training and specified in Regulations made under section 537A of the Education Act. The Welsh Government will only share or link data where there is a legal requirement to do so.

Persons or Organisations Welsh Government share your personal information with:

The local authority that maintains the school at which a pupil is or was registered
The Office of Her Majesty’s Chief Inspector of Education and Training in Wales (Estyn)
Careers Wales
Qualifications Wales
Any body recognised by Qualifications Wales as a body awarding qualifications in Wales
The Office for National Statistics
The Education and Skills Funding Agency
The Office of Qualifications and Examinations Regulation (Ofqual)
Any body recognised by Ofqual in respect of the award or authentication of a specified qualification or description of qualification
Any persons conducting research into the educational achievements of pupils and who require individual pupil information for that purpose
Information collators which, for the purposes of or in connection with the functions of the Welsh Ministers relating to education, is responsible for collating or checking information relating to pupils

Welsh Government will only provide data for a specific purpose and for a limited time period, after which the organisation must confirm that it has been destroyed.

Any analysis produced must follow Welsh Government disclosure rules to ensure that individual pupils cannot be identified.

For research purposes wider than education, Welsh Government will use techniques that ensure the data are anonymised before any research takes place. Sharing of anonymised data is outside of the GDPR. Further information can be found on the Welsh Government website at: www.gov.wales/School Data

How long will this data be kept?

Crickhowell High School, Powys County Council and Welsh Government will keep this data until the pupil’s 25^th birthday or for the duration of the criteria which underpin the statutory regulation. After this point the data will be anonymised in line with best practices and used only for statistical and research purposes.

Your rights under the GDPR

You have the right to:

Have access to the personal data that Crickhowell High School, Powys County Council and Welsh Government are processing about you;
Require these organisations to rectify inaccuracies in that data;
The right (in some circumstances) to object to processing on grounds relating to your particular situation;
The right to restrict processing (in some circumstances)
Lodge a complaint with the Information Commissioner who is the independent regulator for data protection.

For further information about the information which Crickhowell High School, Powys County Council or Welsh Government holds and its use, or if you wish to exercise your rights under the GDPR, please see contact details below:

Crickhowell High School:	Data Protection Officer Crickhowell High School New Road, Crickhowell Powys NP8 1AW
Tel:	01873 813500
Email Address:	dpo@crickhowell-hs.powys.sch.uk
Powys County Council:	Data Protection Schools Information Compliance Team County Hall, Llandrindod Wells Powys LD1 5LG
Tel:	01597 826000
Email:	foi.queries@powys.gov.uk
Welsh Government:	Welsh Government Cathays Park CARDIFF CF10 3NQ
Tel:	029 2082 3650
Email Address:	Data.ProtectionOfficer@gov.wales

To contact the Information Commissioner’s Office, please see details below:

Information Commissioner’s Office:	Wycliffe House Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone – Helpline:	029 2067 8400 (Wales helpline) or 0303 123 1113 (UK helpline)
Website:	www.ico.org.uk