Pupil Privacy Notice

When collecting and using personal data relating to students and their families, Beckfoot Trust complies with the requirements of Data Protection Legislation (being the UK General Data Protection Regulation, Data Protection Act 2018 and the Privacy an Electronic Communications (EC Directive) Regulations 2003) and all other applicable laws and regulations relating to processing of personal data and privacy, as amended ad replaced from time to time.

For the purpose of Data Protection requirements, the data controller is Beckfoot Trust, Wagon Lane, Bradford BD16 1EE. This means our schools determine the purposes and means for which any personal data is to be processed.

We are registered as a Data Controller with the ICO: Ref ZA023846.

Each school has a GDPR Lead who acts as a representative for the school with regard to its data controller responsibilities.

Harriette Taylor is the Data Protection Officer (DPO). This role is to oversee and monitor the Trust’s data protection procedures, and to ensure they are compliant with the Data Protection Legislation. That Data Protection Officer can be contacted on 01274 771444 or [email protected]

• personal identifiers and contacts (such as name, unique pupil number, contact details, date of birth, identification documents, next of kin, and emergency contacts)
• characteristics (such as ethnicity, language and eligibility for free school meals)
• safeguarding information (such as court orders an professional involvement)
• special educational needs (including the needs and ranking)
• medical and administration (such as doctors’ information, child health, dental health, allergies, medications, dietary requirements, and accident records)
• attendance (such as sessions attended, number of absences, absence reasons and at previous schools attended)
• results of internal assessments ad externally set tests
• pupil and curricular records
• behavioural information (such as exclusions and any relevant alternative provision put in place)
• details of any support received, including care packages, plans, and support providers)
• use of internet and ICT resources in school
• photographs and moving images
• images on surveillance systems (such as CCTV images captured in and around our premises)

We collect and use personal data as set out under the GDPR
and UK law. We use this data

• to support teaching and learning
• to monitor and report on pupil attainment progress
• to provide appropriate pastoral care
• to assess the quality of our services
• to protect pupil welfare
• to keep children safe (food allergies, or emergency contact details)
• to safeguard pupils
• to enable pupils to take part in national or other assessments and to publish the results of public examinations or other achievements of students
• to share news about our work and promote our services
• enable us to carry out specific functions for which we are responsible
• to comply with the law regarding data sharing
• to meet statutory duties placed upon us for the Department of Education (DfE) data collections

We must make sure that information we collect and use, is in line with the UK GDPR and Data Protection Act. This means that we must have a lawful reason to collect the data and that if we share it with another organisation or individual we must have a legal basis to do so.

Under the UK GDPR, processing of the data held is lawful if at least one lawful basis applies. The bases which we rely on for processing personal information, which is collected and used for the reasons listed above, are as follows:

• Consent (Article 6(1)(a)) – we have permission from you to process the personal data. You do have the right to withdraw your consent at any time.
• Contract (Article 6(1)(b)) – we collect and process personal data necessary for the performance of a contract.
• Legal Obligation (Article 6(1)(c)) – we collect and process personal data so we can comply with the law.
• Vital Interests (Article 6(1)(d)) – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk.
• Public Task (Article 6(1)(e)) – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours.
• Legitimate Interest (Article 6(1)(f)) – for the purposes of our legitimate interest.

We may process personal information based on legitimate interests, provided that such interests are not overridden by your rights and freedoms. In the context of the school, our legitimate interests include:

• Ensuring the effective operation and administration of the school, including the coordination of teaching, learning, and extracurricular activities.
• Protecting the safety and welfare of pupils, staff, and visitors, including monitoring school premises.
• Maintaining the security and efficient functioning of school systems, networks, and data.
• Conducting internal audits, investigations, and due diligence as needed.

Where we are required to collect special category data, we will use the following lawful bases of the UK GDPR which permits us to process special category data:

• Explicit Consent (Article 9(2)(a)) – we may request explicit consent from individuals (or parents/guardians in the case of minors) to process special category data for specific purposes, such as, using biometric information to identify individuals to school IT systems
• Employment, Social Security, and Social Protection (Article 9(2)(b)) – we may process special category data necessary for fulfilling obligations in the fields of employment law, social security, or social protection, such as medical conditions, allergies, or disabilities, to comply with laws that require them to ensure a safe environment.
• Vital Interests (Article 9(2)(c)) – in situations where processing is essential to protect someone’s life, such as during a medical emergency, schools may process special category data without prior consent.
• Made public by the data subject (Article 9 (2)(e)) – to process special category data if that data has been manifestly made public by the data subject.
• Legal claims (Article 9(2)(f)) – where the processing is for the purposes of establishing, exercising, or defending legal claims or by courts when they are acting in their judicial capacity.
• Substantial Public Interest (Article 9(2)(g)) – we often process special category data in the public interest, for instance, to comply with equality legislation, ensure diversity and inclusion, or meet safeguarding obligations.
• Provision of Health or Social Care (Article 9(2)(h)) – we may collect health-related data to provide appropriate health care services or health management for pupils, such as managing disability accommodations or providing necessary medical care.
• Archiving, Research, or Statistical Purposes (Article 9(2)(j)) – we may process special category data for academic research, statistical purposes, or archiving in the public interest, provided that appropriate safeguards are in place.

Some of the reasons listed above for collecting and using personal data overlap, and there may be several grounds which justify our use of this data.

Collecting pupil data is essential for our schools’ operational use. Whilst the majority of pupil information you provide to us is compulsory, we do request some on a voluntary basis. In order to comply with the data protection legislation, we will inform you at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this.

Most of the personal information we process is provided to us by you for one of the following reasons:

• You have enrolled a pupil
• You wish to attend, or have attended, an event organised by us
• You have made an enquiry to us
• You have made a complaint to us
• You have made an information request to us.

We also receive personal information indirectly, for example:

• We have contacted another organisation about a pupil, and it gives us personal information in its response.
• Personal information is contained in reports from other agencies such as Local Authority or the NHS
• A complainant refers to you in their complaint correspondence
• Other parents include information about you in their reporting to us
• From other public authorities, regulators, or law enforcement bodies.

In accordance with the UK GDPR, the school does not store personal data indefinitely. We will only use and store personal information for as long as it is required for the purposes it was collected for.

All personal information is kept secure either on encrypted, password protected devices and systems, or paper copies kept on the school site. Once the deadline for retaining information has passed, data stored electronically is deleted and paper copies destroyed.

We routinely share student information with:

• Educational Institutions that the pupils attend after leaving us
• The Local Authority – for admissions, exclusions, and safeguarding
• The Department for Education (DfE) – see section below
• Trust staff
• The pupil’s family and representatives
• Parents or carers of Trust school students
• Educators and examining bodies
• Ofsted
• Suppliers and service providers – to enable them to provide the service we have contracted them for
• Financial organisations
• Central and local government
• Our auditors
• Survey and research organisations
• Health authorities
• Health and social welfare organisations
• Professional advisers and consultants
• Charities and voluntary organisations
• Media publications
• Police forces, courts, tribunals
• Youth Support Services (Pupils aged 13+) – see section below

We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.

When we use suppliers and service providers to process information, we ask them to demonstrate compliance with our security requirements, adhere to any instructions we give them and comply with relevant data protection legislation. We have contractual agreements with these organisations which clearly define their obligations about what information they hold.

Once our pupils reach the age of 13, we also pass pupil information to our local authority and/or provider of Youth Support Services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.This enables them to provide services through Youth Support Services and careers advisers.

The information shared is limited to the child’s name, address and date of birth. However, where a parent or guardian provides their consent, other information relevant to the provision of youth support services will be shared. This right is transferred to the child/student once he/she reaches the age 16.

We will also share certain information about pupils aged 16+ with our local authority and/or provider of Youth Support Services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services via post-16 education and training providers, Youth Support Services and careers
advisers.

For more information about services for young people, please visit www.bradford.gov.uk.

The Department for Education (DfE) collects personal data from educational settings and local authorities via various statutory data collections. We are required to share information about our pupils with the Department for Education (DfE) either directly or via our local authority for the purpose of those data collections, under regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.

All data is transferred securely and held by the Department for Education (DfE) under a combination of software and hardware controls, which meet the current government security policy framework.

For privacy information on the data the Department for Education collects and uses, please see: Privacy information: early years foundation stage to key stage 3 – GOV.UK (www.gov.uk) and Privacy information: key stage 4 and 5 and adult education – GOV.UK (www.gov.uk)

The pupil data that we lawfully share with the Department for Education (DfE) through data collections:

• underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school
• informs ‘short term’ education policy monitoring and school accountability and intervention (for example, school GCSE results or Pupil Progress measures)
• supports ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school).

To find out more about the data collection requirements placed on us by the Department for Education, for example, via the school census, go to Data collection and censuses for schools – GOV.UK (www.gov.uk)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

The data in the NPD is provided as part of the operation of the education system and use used for research and statistical purposes to improve, and promote, the education and well-being of children in England.

The evidence and data provide DfE, education providers, Parliament and the wider public with a clear picture of how the education and children’s services sectors are working in order to better target, and evaluate, policy interventions to help ensure all children are kept safe from harm and receive the best possible education.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-studentdatabase-user-guide-and-supporting-information.

DfE will only share pupils’ personal data where it is lawful, secure and ethical to do so. Where these conditions are met, the law allows the Department for Education (DfE) to share pupils’ personal data with certain third parties, including:

• schools and local authorities
• researchers
• organisations connected with promoting the education or wellbeing of children in England
• other government departments and agencies
• organisations fighting or identifying crime.

For more information about the Department for Education’s (DfE) NPD data sharing process, please visit: How DfE shares personal data – GOV.UK (www.gov.uk)

Organisations fighting or identifying crime may use their legal powers to contact the Department for Education (DfE) to request access to individual level information relevant to detecting that crime.

For information about which organisations the Department for Education (DfE) has provided pupil information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the Police please visit the following website: DfE external data shares – GOV.UK (www.gov.uk)

Under the terms of the UK GDPR, you are entitled to ask the Department for Education (DfE):

• if they are processing your personal data
• for a description of the data they hold about you
• the reasons they’re holding it and any recipient it may be disclosed to
• for a copy of your personal data and any details of its source.

If you want to see the personal data held about you by the Department for Education (DfE), you should make a ‘subject access request’. Further information on how to do this can be found within the Department for Education’s (DfE) personal information charter that is published at the address below:

Requesting your personal information from the Department for Education – GOV.UK (www.gov.uk)

To contact the Department for Education (DfE): Contact the Department for Education (DfE) – GOV.UK (www.gov.uk)

The UK GDPR gives parents and pupils certain rights about how their information is collected and used. To make a request for your personal information, or be given access to your child’s educational record, contact the relevant school.

You also have the following rights:

• Right to be informed – to be informed about how and why we process your personal information.
• Right of access – to ask for copies of your personal data that we hold about you, this is known as a subject access request (SAR), data subject access request or right of access request.
• Right of rectification – to ask us to change any information you think is not accurate or complete.
• Right to erasure – to ask us to delete your personal information.
• Right to restriction of processing – to ask us to stop using your information.
• Right to object to processing of your information, in certain circumstances.
• Right of data portability – allows individuals to obtain and reuse their personal data for their own purposes across different services.
• Rights related to automated decision-making including profiling.
• Right to withdraw consent at any time (where relevant).
• Right to complain to the Information Commissioner if you feel we have not used your information in the right way.

There are legitimate reasons why we may refuse your information rights request, which depends on why we are processing it. For example, some rights will not apply:

• Right to erasure does not apply when the lawful basis for processing is legal obligation or public task.
• Right to portability does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests.
• Right to object does not apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t have the right to object, but you have the right to withdraw consent.

If you would like to discuss anything on this Privacy Notice or are unhappy with the way your request for information has been dealt with or you think your data has been misused or not held securely, please contact:

• Data Protection Officer
• Tel: 01274 771444
• Email: [email protected]

If you are unhappy with the outcome of your query or complaint, you can escalate your complaint please contact the Information Commissioner’s Office (ICO). ICO helpline, Telephone: 0303 123 1113 https://ico.org.uk/concerns/

Data requests for pupils may be received after a student has left the school e.g. exam and reference requests, these will be dealt with as set out in this Privacy Notice and our Data Protection Policy.

Schools may receive requests from Police for information about a student. The school will share the following;

• the pupil’s registration at the school
• the pupil’s full name and/or date of birth
• the pupil’s address and/or telephone number
• the pupil’s next of kin as informed to the school
• the pupil’s attendance at the school on identified dates

All other Police requests will be dealt with as set out in our GDPR Data Protection and FOI Policy.

Consent for photographs and filming of students will be requested on the Admission Form at point of entry and on the annual Pupil Information Form.

The Trust may use a student’s work for assessment and moderation purposes, displays, shows, productions and for any other purpose unless permission is withdrawn by the pupil.

Once published/shared some information may not be able to be retrieved so we will not be able to comply with the individual’s data rights as the information is outside our control. Where information is within our control we will make reasonable attempts to carry out their wishes.