Privacy information for Chiseldon Primary & Nursery School

Privacy information for Chiseldon Primary & Nursery School

This page explains how Chiseldon Primary & Nursery School uses and protects personal data, how to contact our Data Protection Officer, and how to make requests under UK data protection law and the Freedom of Information Act 2000.

Data controller

Chiseldon Primary & Nursery School is the data controller for the personal data we process.

Data Protection Officer

DPO: Adam Timlin
Email: dpo@chiseldon.swindon.sch.uk
Postal address: Chiseldon Primary & Nursery School, Castle View Rd, Swindon SN4 0NS
Telephone: 01793 740349

What personal data we collect and why

We collect and process personal data about pupils, parents and carers, staff, governors, volunteers, visitors and others so that we can run the school, meet our statutory duties and provide education, pastoral care and safeguarding.

This may include:

• pupil and family information, including names, contact details, date of birth, attendance, assessment, behaviour, medical and SEND information;
• parent/carer and emergency contact details;
• staff information, including employment details, payroll information, qualifications, training records and safer recruitment information;
• safeguarding and child protection information;
• CCTV where CCTV is in operation;
• information needed for school administration, communication and statutory reporting.

We process personal data where we have a lawful basis to do so. This may include legal obligation, public task, contract, legitimate interests, vital interests or consent, depending on the circumstances.

Where we rely on consent, for example for some uses of photographs or optional activities, we will explain this at the time and explain how consent can be withdrawn.

How we use and share personal data

We use personal data to:

• provide education and support pupils;
• safeguard pupils and members of the school community;
• manage attendance, assessment, behaviour and pastoral support;
• communicate with parents, carers and staff;
• meet statutory reporting duties;
• manage admissions, staffing, payroll, finance and school administration.

We may share information with organisations where there is a lawful reason to do so. This may include the Department for Education, the local authority, health services, safeguarding partners, examination or assessment bodies, police or other agencies where required by law or where necessary to safeguard pupils.

We also use trusted third-party service providers, such as school information systems and other educational platforms. Where these organisations process data on our behalf, appropriate contracts and safeguards are used.

Retention

We keep personal data only for as long as necessary and in line with statutory requirements and recognised school retention guidance.

Different types of records are kept for different periods. For example, pupil records, safeguarding records, financial records and staff records may all have different retention periods. If you would like details about the retention period for a particular type of record, please contact the DPO.

Security

We use appropriate technical and organisational measures to protect personal data. Access to personal data is limited to those who need it for their role, and staff are expected to handle information securely and confidentially.

Your rights under UK data protection law

Depending on the circumstances, you may have the right to:

• access personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• request erasure of data in limited circumstances;
• request restriction of processing in limited circumstances;
• object to certain types of processing;
• request transfer of your data to another organisation in certain circumstances;
• withdraw consent where processing is based on consent.

Some rights are not absolute and may not apply in every case.

How to make a Subject Access Request

A Subject Access Request, often called a SAR, is a request for personal data that we hold about you or, in some circumstances, about someone you are authorised to act for.

To make a SAR, please contact the DPO using the details above. Please include:

• the name of the person whose data is being requested;
• your relationship to that person, if you are requesting information on their behalf;
• details of the information you are requesting;
• any relevant dates or information that may help us locate the records.

We may ask for evidence of identity or authority to act where this is necessary before responding to the request.

We will normally respond without undue delay and within one month. In complex cases, or where a number of requests have been received, this period may be extended by up to a further two months. If this applies, we will explain why.

In most cases there is no fee for a SAR. We may charge a reasonable fee or refuse to respond where a request is manifestly unfounded or excessive, in line with data protection law and ICO guidance. The ICO says organisations need strong justification if they decide a request is manifestly unfounded or excessive.

How to make a Freedom of Information request

The Freedom of Information Act 2000 gives people the right to request recorded information held by public authorities, including maintained schools.

To make an FOI request, please send a written request by email or post to the DPO using the contact details above.

Your request should:

• clearly describe the information you want;
• include your name;
• include an email or postal address for our response.

We will respond promptly and within the statutory timescale. For schools, this is normally 20 school days, or 60 working days if this is sooner.

Some information may be withheld where an exemption applies, for example where disclosure would involve releasing personal data about another person, prejudice safeguarding, or disclose legally privileged information. If information is withheld, we will explain the reason where we are able to do so.

We may charge for disbursements such as photocopying or postage where permitted under FOI rules. If a charge applies, we will tell you before providing the information.

Complaints

If you are concerned about how we have handled your personal data or an information request, please contact the DPO first so we can try to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office.

ICO website: ico.org.uk
ICO helpline: 0303 123 1113