Privacy Notice

(How we use your information)
 

Who processes your information?

Cowbridge Comprehensive School is the data controller of the personal information you provide to us. This means that the School determines the purposes for which, and the manner in which, any personal data relating to students and their families is to be processed.

In some cases, your data will be outsourced to a third party processor; however, this will only be done with your consent, unless the law requires the School to share your data. Where the School outsources data to a third party processor, the same data protection standards that the School upholds are imposed on the processor. We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.

Mr Ling is the Data Protection Officer (DPO) and Mr Stagg the Deputy DPO for the School. Their role is to oversee and monitor the School’s data protection procedures, and ensure that they are compliant with the GDPR. They can be contacted on 01446 772311 or by email: enquiries@cowbridgecs.co.uk.

 

Why do we collect and use your information?

Pupil data is essential for the Schools’ operational use. Whilst the majority of pupil information you provide to us is mandatory, some of it may be requested on a voluntary basis. In order to comply with the data protection legislation, we will inform you at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this.  We collect and use pupil information under section 6(1)(e) of the GDPR which states ‘Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’.

In addition, concerning any special category data, condition (g) Reasons of substantial public interest (with a basis in law).

The School holds the legal right to collect and use personal data relating to students and their families, and we may also receive information regarding them from their previous school, Local Authority (LA) and/or the Welsh Government (WG). We collect and use personal data in order to meet legal requirements and legitimate interests set out in the GDPR and UK law, including those in relation to the following:

• Article 6 and Article 9 of the GDPR;
• Education Act 1996.

We also process data in line with the lawful basis of ‘public task’ to enable effective planning and management of the School.

 

In accordance with the above, the personal data of students and their families is collected and used for the following reasons:

• to support student learning;
• to monitor and report on student progress;
• to provide appropriate pastoral care;
• to assess the quality of our service;
• to comply with the law regarding data sharing;
• to safeguard students (e.g. allergy or child protection information);
• as part of our admissions process;
• to support pupils to decide what they do after they leave school;
• to access our school meals, payments and school communication systems;
• to market and publicise the School (this includes images/ photographs);
• to assist with the collation of provisional Centre Determined Grades (2021 qualifications only – outlined in Centre Policy);
• for the purposes of educational research.

We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.

The categories of information that we process include:

• personal identifiers and contacts (such as name, date of birth, unique pupil number, contact details and address);
• characteristics (such as gender, ethnicity, language, nationality, country of birth and free school meal eligibility);
• safeguarding information (such as court orders and professional involvement);
• special educational needs;
• medical and administration (such as doctors information, child health, dental health, allergies, medication and dietary requirements);
• attendance (such as sessions attended, attendance code for each half day session, number of absences, absence reasons and any previous schools attended);
• additional learning needs;
• assessment and attainment (such as national curriculum assessment results);
• behavioural information (such as exclusions and any relevant alternative provision put in place);
• destinations information;
• information relating to educational visits;
• catering and free school meals arrangements including biometric fingerprints;
• ParentMail communication system.

 

How we collect your information?

We collect pupil and contact information via paper and electronic registration forms at the start of the school year or Common Transfer File (CTF) or secure file transfer from the previous school.

 

How long is your information stored?

The School will keep information on computer systems and also in paper form. Personal data relating to students and their families is stored in line with the School’s Data Protection Policy.  In accordance with the GDPR, the School does not store personal data indefinitely; data is only stored for as long as is necessary to complete the task for which it was originally collected.

 

Will my information be shared?

The Welsh Government receives information on students normally as part of what is called the Pupil Level Annual School Census (PLASC). Welsh Government uses this personal information for research which is carried out in such a way that ensures individual pupils cannot be identified. This information is also used for statistical purposes, to inform, influence and improve education policy and to monitor the performance of the education service as a whole. Examples of the sort of statistics produced can be viewed at www.wales.gov.uk/statistics .

We share pupil data with Welsh Government on a statutory basis. This data underpins school funding and educational attainment policy and monitoring.

We also share attendance data with the Welsh Government on a regular basis to enable them to understand overall attendance patterns and to identify the characteristics of pupils who are not attending.

 

The LA also uses the personal information collected via PLASC to do research. It uses the results of this research to make decisions on policy and the funding of schools, to calculate the performance of schools and help them to set targets. The research is carried out in such a way that ensures individual pupils cannot be identified. In addition, WG and LA’s receive information regarding national curriculum assessment and Public Examination results and attendance data at pupil level. The WG and LA have robust processes in place to ensure the confidentiality of any data shared is maintained.

The School will not share your personal information with any third parties without your consent, unless the law allows us to do so. The School routinely shares information with:

• pupil destinations upon leaving the School;
• the Local Authority (Vale of Glamorgan) and Central South Consortium (CSC);
• Welsh Government (WG);
• Estyn;
• the NHS;
• Exam Authorities;
• Police and courts;
• Social Services and support agencies;
• Education Software Solutions (ESS): provider of the School Integrated Management System (SIMS) for storing pupil data, curriculum and assessment data;
• GO 4 Schools assessment and reporting Management Information System;
• School Cloud Systems Ltd;
• Netmedia Limited (Parents Booking);
• Applicaa Limited;
• The Learning Records Service (LRS). The LRS issues Unique Learner Numbers (ULN) and creates Personal Learning records across England, Wales and Northern Ireland, and is operated by the Education and Skills Funding Agency, an executive agency of the Department for Education (DfE). For more information about how your information is processed, and to access your Personal Learning Record, please refer to: https://www.gov.uk/government/publications/lrs-privacy-notices.
• The Governor Support Unit (GSU) of the local authority for the parent governor election process. This process requires that we provide the GSU with all our parental email addresses. If you do not wish your email address to be shared with the GSU you must notify us to that effect. The GSU will only use your email address for the purpose of parent governor elections and will not share it with anyone else. Once the election process is concluded all information relating to parental email addresses will be deleted. All parents who do not have an email address or do not wish their email address to be shared with the GSU will receive all communications relating to the parent governor election process via hard copy;
• Careers Wales;
• Researchers from reputable institutions.

 

What are your rights?

Parents and Pupils have the following rights:

• right to be informed;
• right of access;
• right to rectification;
• right to erasure;
• right to restrict processing;
• right to data portability;
• right to object.

Where the processing of your data is based on your consent, you have the right to withdraw this consent at any time.

 

You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress;
• prevent processing for the purpose of direct marketing;
• object to decisions being taken by automated means;
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
• a right to seek redress, either through the ICO, or through the court.

 

Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, please contact the Data Protection Officers at the School. The School will respond to any requests within 1 month from the date the School receives your request. 

 

Where can you find out more information?

If you would like to find out more information about how we collect, use and store your data, please visit the School website to view our Data Protection Policy/contact the School.

 

Concerns or Complaints

If you have a concern or complaint about the way we are collecting or using your personal data, we request you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office.

 

Contact details

If you would like to discuss anything in this privacy notice, please contact:

Mr J Ling (Deputy Headteacher/Data Protection Officer)

Mr R Stagg (Deputy Data Protection Officer)

 

Contact details of the Information Commissioner’s Office.

Information Commissioner’s Office

2^nd floor

Churchill House

Churchill Way

Cardiff

CF10 2HH

Tel:  029 2067 8400           Fax: 029 2067 8399

Email: wales@ico.org.uk