Privacy notice – how the school uses pupil information

We also have a privacy notice written in child-friendly language, to aid pupils’ understanding of their rights in relation to their data. A copy of this can be accessed from the PA to Head of Centre by emailing admissions@rbnorwich.org.uk or 01603 622288.

What categories of information are processed?

The categories of personal information that we process include the following:

• Personal identifiers and contacts – e.g. name, DOB, unique pupil number, contact details and address
• Characteristics – e.g. ethnicity, language and eligibility for free school meals
• Safeguarding information – e.g. court orders and professional involvement
• Special educational needs and disabilities (SEND) information – e.g. any additional needs
• Medical and administration – e.g. doctors’ information, general health, dental health, allergies, medication and dietary requirements
• Attendance – e.g. sessions attended, number of absences, reasons for absences and any previous schools you have attended
• Assessment and attainment – e.g. any relevant test and exam results
• Behavioural information – e.g. exclusions and any relevant alternative provision put in place
• Information passed on from previous school/EHCP Co-ordinator – e.g. assessments, SEN reports, prior attainment, EHCP/annual reviews, pupil profile, safeguarding file.
• Reports sent by relevant people concerning work experience or offsite provision – e.g. Alternative provision tutors, work experience placements.
• Catering and Free School Meal Management – Processing of lunch costs and sharing and receiving of information from Norfolk County Council.

Why do we collect and use your information?

We will only collect your information when we have a good reason to do so in line with the law – this is known as having a lawful basis to use data. Here are the reasons we collect your information:

• To monitor and report on pupil attainment and progress
• To provide appropriate pastoral care
• To assess the quality of our services
• To keep pupils safe
• To meet legal duties placed on us by the government
• To improve the learning of students

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis/bases we rely on for processing pupil information are:

Article 6

1. Processing is lawful only if and to the extent that at least one of the following applies:

(c) Processing is necessary for compliance with a legal obligation to which the controller is the subject;

Article 9

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of identifying a natural person, data concerning health or data concerning a person’s sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:

1. Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide suitable and specific measures to safeguard the fundamental rights and interests of the data subject.

The Education (Information about Individual Pupils) (England) Regulations 2013 – Regulation 5 ‘Provision of information by non-maintained special schools and Academies to the Secretary of State’ states ‘Within fourteen days of receiving a request from the Secretary of State, the proprietor of a non-maintained special school (shall provide to the Secretary of State such of the information referred to in Schedule 1 and (where the request stipulates) in respect of such categories of pupils, or former pupils, as is so requested.

The Education Act 1996 – Section 537A – states that we provide individual pupil information as the relevant body such as the Department for Education.

Children’s Act 1989 – Section 83 – places a duty on the secretary of state or others to conduct research.

How do we collect your information?

We collect your personal information via the following methods:

• Registration forms
• Common Transfer File (CTF) from your previous school
• Child protection plans

Student data is essential for the school’s operational use. Whilst the majority of information you provide to us is mandatory, some of it is requested on a voluntary basis. In order to comply with data protection legislation, we will inform you at the point of collection whether you are required to provide certain information to us or if you have a choice.

How do we store your information?

We hold your personal information securely in line with the ICO guidance.

All data is stored securely either in a locked filing cabinet or on Microsoft Teams/MIS system Bromcom which is encrypted. All Microsoft Office and MIS/Cloud systems offer two factor authentication security.

Who do we share your information with?

We routinely share your information with:

• The local authority (LA) Norfolk County Council
• The Department for Education (DfE)
• Schools that you go to after leaving us
• Youth support services
• NHS/School Nurse
• Third party professional services i.e. Social Services, Social Care Teams

Why do we share your information?

We do not share information about you with anyone without your consent, unless the law and our policies allow us to do so.

We share learners’ data with the Department for Education (DFE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.

We are required to share information about our learners with the local authority (LA) and the Department of Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.

Data Collection requirements:

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to http://www.gov.uk/education/data-collection-and-census-for-schools

Youth support services

Once our pupils reach the age of 13, we also pass pupil information to our LA and/or provider of youth support services because they have responsibilities in relation to the education or training of 13- to 19-year-olds under section 507B of the Education Act 1996.

Sharing this information allows them to provide the following services:

• Youth support services
• Careers advisers
• Post-16 education and training providers

The information we share is limited to the pupil’s name, address and date of birth; however, where a parent or guardian has provided their consent, other relevant information will be shared – this right to consent is transferred to pupils once they reach 16 years old.

For more information about services for young people, please visit the Norfolk Local Offer page on the Children’s Services website and Just One Norfolk.

Department for Education (DfE)

The DfE collects personal information from us and our LA through various collections the school is required to undertake legally. We are required to share information about pupils with the DfE either directly or via our LA for the purpose of those data collections, under:

All information we share with the DfE is transferred securely and held by the DfE under a combination of software and hardware controls which meet the current government security policy framework,, which can be found by following this link: https://www.gov.uk/government/publications/security-policy-framework 

How does the government use your data?

The pupil data that we lawfully share with the DfE through data collections:

• Underpins school funding, which is calculated based upon numbers of pupils and their characteristics in each school.
• Informs ‘short-term’ education policy monitoring and school accountability and intervention.
• Supports ‘longer-term’ research and monitoring of educational policy, e.g. how certain subject choices go on to affect education or earnings beyond school.

To find out more about the data collection requirements placed on us by the DfE, e.g. via the school census, follow this link: https://www.gov.uk/education/data-collection-and-censuses-for-schools

The National Pupil Database (NPD)

Much of the data about pupils in England goes on to be held in the NPD.

The NPD is owned and managed by the DfE and contains information about pupils in schools in England – it provides evidence on educational performance to inform independent research as well as studies commissioned by the DfE.

Information on the NPD is held in an electronic format for statistical purposes and it is securely collected from a range of sources, including schools, LAs and awarding bodies.

You can find out more about the NPD by following this link: https://www.gov.uk/guidance/how-to-access-department-for-education-dfe-data-extracts.

Sharing by the DfE

The DfE is legally allowed to share pupils’ personal information with certain third parties, including the following:

• Schools
• LAs
• Researchers
• Organisations connected with promoting the education or wellbeing of children in England
• Other government departments and agencies
• Organisations fighting or identifying crime

Organisations fighting or identifying crime, such as the Home Office and the police, may use their legal powers to contact the DfE to request access to individual level information relating to a crime.

For more information about how the DfE collects and shares pupil information, you can look at the information in the following two links:

• https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data
• https://www.gov.uk/government/publications/dfe-external-data-shares

How to find out what personal information the DfE holds about you

Under the Data Protection Act 2018, you are entitled to ask the DfE what personal information it holds about you. You have the right to ask the DfE:

• If it processes your personal data.
• For a description of the data it holds about you.
• The reasons it is holding your data and any recipient it may be disclosed to.
• For a copy of your personal data and any details of its source.

To exercise these rights, you should make a subject access request. Information on how to do this can be found by following this link: https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter

You can also contact the DfE directly using its online contact form by following this link: https://www.gov.uk/contact-dfe.

What are your rights?

You have specific rights to the processing of your data; these are the right to:

• Request access to the information the school holds about you.
• Restrict our processing of your personal data, i.e. permitting its storage but no further processing.
• Object to direct marketing (including profiling) and processing for the purposes of scientific and/or historical research and statistics.
• Have your personal data rectified if it is inaccurate or incomplete.
• Not be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you.
• Request the deletion or removal of personal data where there is no compelling reason for the continued processing.

If you want to request access to the personal information that we hold about you, please contact: Mark Anderson Head of Centre on 01603 622288 or via: admissions@rbnorwich.org.uk

If you are concerned about the way we are collecting or using your information, please raise your concern with the school’s DPO in the first instance. You can also contact the Information Commissioner’s Office (ICO) at https://ico.org.uk/concerns. The ICO is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

How to withdraw consent and lodge complaints

Where our school processes your personal data with your consent, you have the right to withdraw your consent.

If you change your mind or are unhappy with how our school uses your personal data, you should let us know by contacting the DPO, Mark Anderson, on admissions@rbnorwich.org.uk and 01603 622288.

Updating this privacy notice

We may need to update this privacy notice periodically if we change how we collect and process data. The school will inform you when this privacy notice has changed; however, we also recommend that you revisit this privacy notice periodically.

This privacy notice was last updated on 21/11/2023.

How can you find out more information?

If you would like to discuss anything in this privacy notice, please contact Mark Anderson on 01603 622288 or admissions@rbnorwich.org.uk

If you require further information about how we and/or the DfE store and use your personal data, please visit our website, Red Balloon Norwich – Red Balloon Learner Centres, the Gov.UK website, (https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data) or download our Data Protection policy also available on the school website.

—————————————————————————————————————————