Data Protection at Leechpool (GDPR)
GENERAL DATA PROTECTION REGULATION (GDPR)
From 25th May 2018 Data protection regulations have changed. This page will show how Leechpool Primary School use and store your data. It will also give you information about how to access and change the data we hold on you or your child and what consent you will be asked to give.
As part of the new regulations the school have appointed Daniel Clement as the Data Protection Officer. Any enquiries about data should go to the Data Protection Officer via the Leechpool e-mail address office@leechpool.w-sussex.sch.uk or by calling 01403 210 233
Leechpool Primary School is registered with the ICO. Registration reference Z6724985
POLICIES / PRIVACY NOTES
FREEDOM OF INFORMATION
Identifying our lawful basis for processing data
In schools, we use public task as your lawful basis for most of your processing. This means that we need to process personal data to carry out your official functions in the public interest.
We also use consent for processing data where it's not necessary for you to fulfil your function. This is used when none of the other bases apply, as the standard for getting consent is very high and consent can be withdrawn at any time.
Six principles of data protection
There were 8 principles under the DPA and now there are 6. Essentially the same but condensed. Article 5 of the GDPR states that personal data must be:
- Processed fairly, lawfully and in a transparent manner in relation to the data subject.
- Collected for specified, explicit and legitimate purposes and not further processed for other purposes incompatible with those purposes.
- Adequate, relevant and limited to what is necessary in relation to the purposes for which data is processed.
- Accurate and, where necessary, kept up to date.
- Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
- Processed in a way that ensures appropriate security of the personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Rights
Individuals have the following rights:
- be informed of data processing (which is covered by the School’s Privacy Notice)
- access information (also known as a Subject Access Request)
- have inaccuracies corrected
- have information erased
- restrict processing
- data portability (this is unlikely to ever be relevant to schools)
- intervention in respect of automated decision making (automated decision making is rarely operated within schools)
- Withdraw consent
- Complain to the Information Commissioner’s Office
How we deal with records
Data with third parties
Leechpool use third party IT systems in order to process data such as attendance, communication and special needs information. All providers are GDPR compliant and have strict procedures in please to protect any information they hold.
The main third party providers are:-
BROMCOM and MyChildAtSchool (MCAS) - this is the system run on behalf of West Sussex County Council. It holds all of the pupils information that is required for their education. Contact details for the pupils and parents/guardian as well as any special needs and medical information. This information is passed to any school that the pupil transfers to through an electronic CTF file. This system also provides the Government details for census and exam results as well as recording registration and attendance information. The MyChildAtSchool platform allows for parents evening bookings to be made. Bromcom GDPR
e4education - This is the schools communication platform. for families Payments for trips Reports can also be viewed by logging in to your account. Data is transferred from SIMS to e4education. The data required will be basic name, gender and email address that is used for communicating. e4education privacy notice
CPOMS - This is our safeguarding system. All information is entered by staff regarding any special needs or safeguarding information that is relevant for the school. The information on this system is restricted. cpoms privacy statement
Insight - On this system test results and assessments are kept to help the school monitor pupil progress. This system gets data from SIMS. Insight Tracking privacy policy
See Saw - Used mainly in Early Years to capture observations of the children's progress. This can be shared with parents. See Saw can also be used to online learning and communication for all year groups. https://web.seesaw.me/privacy-policy
Libresoft - Library System for pupils to borrow books from the library. Names, date of birth and class information is gather from SIMS. Libresoft Privacy Policy
Bug Club - run by ActiveLearn. Hold name and date of birth. Information comes from SIMS. Pupils details are deleted when they leave. Click on link for more details Bug Club GDPR
TT Rock Stars - This maths system use minimal pupil data such as name and date of birth. Pupil data is deleted once they leave Leechpool. TT Rockstars GDPR statement
My Maths- This maths system use minimal pupil data such as name and date of birth. Pupil data is deleted once they leave Leechpool. My Maths privacy policy
Whiterose Maths- This maths system use minimal pupil data such as name and date of birth. Pupil data is deleted once they leave Leechpool. Whiterose maths privacy policy
JSPC - This is our IT supplier who manage our server and IT systems. Data is held on a cloud system. JSPC work with many schools in the West Sussex area are are GDPR compliant. JSPC Privacy Policy
Cool Milk - When a reception child starts at Leechpool their name, date of birth and class are sent to cool milk to provide free milk. Cool milk privacy policy
Vancols Photography - Vancols take the school photos each year. They are given, via SIMS, a list of all of the children with a barcode that hold identification information. Once the photos are taken this barcode enables the photographs to be uploaded into SIMS for identification of children. Vancols GDPR statement
Languagenut - used by MFL. https://www.languagenut.com/en-gb/terms/
Zoom - Used for video meetings. emails are used to invite people to the meetings. Zoom privacy policy
Microsoft Teams - Used for video meetings. emails are used to invite people to the meetings. Microsoft privacy statement
Google Classrooms - Used for remote learning. Use to communicate and share work. Require a login and password. Google classroom privacy security
Edukey - a system used by the SENCO to monitor SEND and pupil premium children. The system helps with provision mapping. Edukey Data sharing agreement
Wonde - a system that takes information from SIMS into other IT package such as e4educate. It enables the school to manage what each IT package can get from SIMS. This is also a system used to provide supermarket vouchers. Wonde privacy policy
Edenred - A free school meal voucher supplier. Only parents email address is required. Edenred privacy policy
FFT Education - Test tracking system to enable schools to compare test results across schools. FFT privacy policy
Reception baseline assessment national pilot - use by DFE to analyse early years performance. Holds all basic pupil information plus results from assessments. rebl pilot privacy notice pupil data
ParentPay & Cypad - The system used in school for booking school meals. ParentPay privacy policy Cypad privacy policy
EdShed / Spelling Shed - The system used in school for spellings. EdShed Privacy Police
Training
All Governors and staff have been made aware of the new GDPR regulations. New staff are given this information at their induction and are expected to read the Data Protection policy. Staff have access to the important policies and some are displayed in the staff room.
Data security
Leechpool Primary have a procedure to deal with any breach in data security. Any breach will be reported to and dealt with by the DPO. The breach will be recorded, investigated and steps taken to lessen any impact. The DPO will decide if the breach is significant enough to report to the ICO. This must be done within 72 hours of the data breach. The DPO will evaluate the breach, risk assess and put in any changes to data security or process as required.
Data protection officer/governance
The DPO for Leechpool Primary School is Daniel Clement. He is responsible for update policies and produces and ensuring they are kept too. All policies are agreed with the School Governors.
Any queries relating to Data should be address to the Data Protection Officer.
Consent
The lawful basis for processing personal data of students and staff is that it is necessary in order for the School to discharge its legal obligations and statutory duties. In respect of this processing the Privacy Notices are sufficient to ensure lawful processing. It is not usual for Schools to process personal data solely based on written consent. Where the School takes a photograph or film of someone on school premises, events or trips and wants to use this image for educational purposes, consent is not required. However, the pupil if over 16 years old, or if younger their guardian must still be informed that photography or filming is taking place and the context in which the image will be used.
Consent will be required where there is additional processing of personal data which is not within the reasonable expectation of those involved.
Whose consent?
Where the child is below the age of 16 years, consent must be given by the holder of parental responsibility over the child.
How we obtain consent.
When a pupil starts at Leechpool a consent form is sent out in the new starter pack. This will cover their time at Leechpool until they leave. If additional consent is required a separate form will be sent out to cover the consent for a particular event. Due to the changes in Data Protection the school will be sending out new consent forms to cover all children in Years R to 5 for their remaining time at Leechpool.
Guidance on consent and withdrawal.
Anything requiring consent requires a positive opt-in. If another organisation/third party is relying on the consent we will name them in the consent form.
Consent can be withdrawn at any time. We will require this in writing and given to the office. You will receive a receipt of a withdrawal of consent and it will be acted upon within a reasonable period of time and no longer than one month from the date of receipt.
Updating and reviewing
All policies and procedures will be reviewed and updated once a year. The review date is set for Spring 2023. This review will be carried out by the DPO and any changes agreed with the Headteacher and Governors.
Policies and procedures will also be reviewed if there are any changes to how data is managed at the school, Government guidelines or following a breach of data security.
Leechpool events and fundraising
At Leechpool, we are very lucky to hold events throughout the year to raise money for the school. Leechpool Events and Fundraising [LEAF] is a "Friends of " charity that has been set up. The committee of this group is set up of parents and staff of Leechpool. Mrs Davenport, the Headteacher sits on this committee. TBA is the Treasurer and the Clerk to LEAF is TBA. TBA is employed by the school and her time then charged to LEAF. This means that she is under all of the same confidentially rules as any other staff member which enables her to have access to the schools computer.
LEAF hold very little data and anything held is kept at school or on the school computer system.
Data held includes:-
Class lists for discos - produced by school and shredded after the event
List of volunteers for events - only name is keep on the sheet
List of external stall holders - list of email and contact details. Consent will is required for this list
Raffle ticket stubs - all destroyed after event
Committee member details for the Charity Commission - Consent is required for this.
Gift Aid information such as name and address - following the Government guidelines for Gift Aid and GDPR
All communication about events, request for help and advertising is via the school office. This is sent via e4education in the same way as all school communication. Consent is given for this communication when an email address is given to the school or e4education app is downloaded. You can withdraw your consent at anytime if you do not wish to receive any information from LEAF. If you wish to withdraw consent then please send a letter to the school office.
As LEAF is run by staff at the school, the data comes under the school policies / procedures such as data security, rights etc. At no time is data shared with any non staff members of the committee except in the form of simple name lists which are then destroyed. The Data Protection Officer for LEAF is TBA. Please contact TBA if you have any questions about how LEAF use data.
For further information and to look at LEAF specific policies and procedure go to the LEAF webpage.
