Privacy Notice – General Data Protection Regulation (GDPR)
This Privacy Notice has been written to inform parents, guardians and pupils of Ingleton Primary School about how and why we process your personal data.
This Privacy Notice has been written to inform parents, guardians and pupils of Ingleton Primary School about how and why we process your personal data.
Ingleton Primary School is a ‘Data Controller’ as defined by the the UK GDPR. This means that we determine the purposes for which your personal data is processed and the manner of the processing. We will only collect and use your personal data in ways that are compliant with data protection legislation.
The school has appointed Veritau Ltd as its Data Protection Officer (DPO). The role of the DPO is to monitor our compliance with the UK GDPR and the Data Protection Act 2018 and advise on data protection issues. If you would like to discuss this privacy notice or our use of your data, please contact Veritau or Joanna Colledge (Headteacher)
Veritau’s contact details are:
Schools Data Protection Officer
Veritau
West Offices
Station Rise
York
North Yorkshire
YO1 6GA
[email protected]
01904 554025
The personal data we collect about you includes:
We will also process certain ‘special category’ data about our pupils including:
We process your information for the purposes outlined below:
Under the UK GDPR, it is essential to have a lawful basis when processing personal information. We normally rely on the following lawful bases:
Where we are processing your personal data with your consent you have the right to withdraw that consent. If you change your mind or are unhappy with our use of your personal data, please let us know by contacting Joanna Colledge.
There may be occasions where our processing is not covered by one of the legal bases above. In that case, we may rely on Article 6(1)(f) – legitimate interests. We only rely on legitimate interests when we are using your data in ways you would reasonably expect.
Some of the information we collect about you is classed as special category data under the UK GDPR. The additional conditions that allow for processing this data are:
The applicable substantial public interest conditions in Schedule 1 of the Data Protection Act 2018 are:
We normally receive this information directly from you, for example via admissions forms, or secure file transfer from a previous school. However, we may also receive some information from the following third parties:
Who do we share your personal data with?
We may share your information with the following organisations:
For more information on information sharing with the DfE please visit the DfE website.
We may also share information with other third parties where there is a lawful basis to do so. For example, we sometimes share information with the police for the purposes of crime detection or prevention. We also regularly share information with appropriate organisations for the purposes of arranging school trips.
We will retain your information in accordance with our Records Management Policy and Retention Schedule. The retention period for most of the information we process about you is determined by statutory obligations. Any personal information which we are not required by law to retain will only be kept for as long as is reasonably necessary to fulfil its purpose.
We may also retain some information for historical and archiving purposes in accordance with our Records Management policy.
Although we are based in the UK, some of the digital information we hold may be stored on computer servers located outside the UK. Some of the IT applications we use may also transfer data outside the UK.
Normally your information will not be transferred outside the European Economic Area, which is deemed to have adequate data protection standards by the UK government. In the event that your information is transferred outside the EEA, we will take reasonable steps to ensure your data is protected and appropriate safeguards are in place.
Under the UK GDPR, parents and pupils have the following rights in relation to the processing of their personal data:
Please be aware that usually pupils are considered to have the mental capacity to understand their own data protection rights from the age of 12 years old. The school may therefore consult with a pupil over this age if it receives a request to exercise a data protection right from a parent.
If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO using the details provided above.
If we cannot resolve your concerns then you may also complain to the Information Commissioner’s Office, which is the UK’s data protection regulator. Their contact details are below:
Phone: 0303 123 1113 or via their live chat. Opening hours are Monday to Friday between 9am and 5pm (excluding bank holidays). You can also report, enquire, register and raise complaints with the ICO using their web form on Contact us | ICO.
Changes to this notice
We reserve the right to change this privacy notice at any time. We will normally notify you of changes that affect you. However, please check regularly to ensure you have the latest version.
This privacy notice was last reviewed 23/11/2023.