The Keystone Academy Trust is a data controller for the purposes of the General Data Protection Regulation (GDPR) 2018. The Data Protection Officer for each academy can be contacted as follows ThurlbyDPO@ses.lincs.sch.uk, WestfieldDPO@ses.lincs.sch.uk, TowerroadDPO@ses.lincs.sch.uk, or for Long Sutton Primary School-Joe.Lee@ark.me.uk .
The Trust collects personal information on all pupils at all its Academies, including children who are defined in law as children in need or those who are looked after by the Local Authority (LA).
Why do we collect and use your information?
We collect and use personal data in accordance with legal requirements and legitimate interests set out in the GDPR and UK law, including those in relation to the following:
· Articles 6 and 9 of the GDPR
· The Education Act 1996
· Regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013
In accordance with above, we use this information to:
· support a pupil’s learning;
· monitor and report on a pupil’s progress;
· provide appropriate pastoral care;
· assess the quality of our services; and
· comply with the law regarding data sharing.
What data is collected?
In line with Article 6 of the Regulation, the Keystone Academy Trust considers the processing of the following information to be in the public interest and therefore consent forms are not considered necessary:
Other categories of pupil information collected, held and shared include:
The Trust may also receive information about pupils from their previous school(s) and the Learning Records Service.
Privacy in collecting, using, storing and disposing of data.
The Trust or Academy will comply with the requirements of the GDPR that govern the processing of personal data. Under these requirements, the information will be collected and used fairly, stored safely and not disclosed to any other person where to do so would be in breach of those requirements or would otherwise be unlawful.
Lawful Basis for Processing
As stated previously, the majority of information provided to the Trust comes under Article 6 (e) of ‘performance of a task carried out in the public interest’ and is therefore mandatory.
We also process information where:
1) the data subject has given consent for one or more specific purposes
2) processing is necessary in order to protect the vital interests of the data subject or another natural person (medical information, for example) When collecting data on a voluntary basis, the Academy will inform parents/carers whether they are required to provide this data or if consent is needed. Where consent is required, the Academy will provide specific and explicit information concerning the reasons the data is being collected and how the data will be used. For the processing of any special categories of personal data (including racial or ethnic origin, religious or philosophical beliefs and the processing of health data, genetic or biometric data), specific conditions as stated in Article 9 (2) of the General Data Protections Regulations must also apply. These include:
Photographs and Film
Occasionally, the Trust may photograph or film pupils undertaking Academy activities. We may use the photographs or films either within or outside of Trust/Academy buildings. We would always seek consent for these purposes. Pupils will always be made aware if they are being photographed or filmed, what the purpose of this is and will be given the opportunity to object. Where the relevant consent has been obtained, photographs and films may be:
· used on displays, in presentations and in publications.
· used on websites and on social media sites which can be viewed throughout the world and not just in the United Kingdom where UK law applies.
· supplied to the media for use in newspapers and magazines and on TV, websites or social media sites.
How long is your data stored for?
Personal data relating to pupils and their parents/carers is stored in line with ICO guidelines as detailed in the Trust’s Data Protection and Record Managements policies. In accordance with the GDPR, the Trust does not store personal data indefinitely; data is only stored for as long as is necessary to complete the task for which it was originally collected.
Will my data be shared?
The Trust will not share information about our pupils with any third parties without consent, unless the law and our policies allow us to do so. Academies routinely share pupils’ information with:
· Pupils’ destinations upon leaving the school
· The LA
· The NHS
· The DfE
The Trust also has a Data Sharing Agreement with Lincolnshire Local Authority through an automated and secure data exchange process. This is central to the success of integrated working across Trust Academies and the LA MIS systems, thus maintaining reliable and accurate pupil and school records.
· Conducting research or analysis.
· Producing statistics.
· Providing information, advice or guidance.
The DfE has robust processes in place to ensure the confidentiality of any data shared from the NPD is maintained. Under schedule 2, part 1 of the Data Protection Act 2018 and article 6 (1) (d) of the GDPR, the Trust may need to disclose personal data with local police services for the purposes of the prevention or detection of crime, the apprehension or prosecution of offenders and to protect the vital interests of an individual. A full list of the external parties and suppliers who we share pupils’ data with, and the type of data that is shared, is shown in the Privacy Notice on the individual Academy website and is also available from the individual Academy office.
If you need more information about how the LA and DfE store and use information, then please go to the following websites:
· Local Authority: www.lincolnshire.gov.uk
· Department for Education: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data Department for Education: Public Communications Unit Department for EducationSanctuary Buildings Great Smith Street London SW1P 3BT Email: http://www.education.gov.uk/help/contactus Telephone: 0370 000 2288
Requesting access to your personal data
Under the GDPR, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or to be given access to your child’s educational record, please contact your Academy office. You also have the right to:
· object to processing of personal data that is likely to cause, or is causing, damage or distress;
· prevent processing for the purpose of direct marketing;
· object to decisions being taken by automated means;
· in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed;
· claim compensation for damages caused by a breach of the Data Protection regulations.
Withdrawal of consent
Where the processing of your data is based on your consent, you have the right to withdraw this consent at any time. Please contact your Academy office to do this.
If you have a concern about the way the Trust or an individual Academy is collecting or using your personal data, we request that you raise your concern with us in the first instance. By contacting the individual Academy office. Alternatively, you can contact the Information Commissioner’s Office (ICO) at https://ico.org.uk/concerns. They can also be contacted on 0303 123 1113 (Monday-Friday 9am-5pm).