Privacy Notice Alumni

Contents

1. Introduction

Under UK data protection law, individuals have a right to be informed about how our school, and the multi-academy trust (MAT) we are part of, uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about alumni of the school.

Our trust, Crompton House Multi Academy Trust, is the ‘data controller’ for the purposes of UK data protection law.

2. The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Name
Contact details
Details about your time at the school, including records of your achievements and interests
Records of contributions you have made to the school since leaving, such as your time, expertise or money
Records of how you have engaged with our alumni network, including emails you have opened, events attended, mailing lists you have signed up to and any other interactions
Bank details and other financial information, if you make any payments to the school
Records associated with Gift Aid claims on donations
Information about your use of our information and communication systems, equipment and facilities (e.g. school computers)

We may also collect, use, store and share (when appropriate) information about you that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Photographs of your time at the school
Information required to manage your attendance at alumni events, including access arrangements and dietary requirements

We may also hold data about you that we have received from other organisations, including other schools or local authorities.

3. Why we use this data

We collect and use the data listed above to:

Help us build a community around the school
Offer enrichment and career development opportunities to current pupils
Raise extra money so that we can continue to improve the experience pupils get from the school
Notify you of alumni events you may be interested in
Keep you up to date with school news
Help us promote the school
Keep you safe and comfortable while attending alumni events
Tailor the communications we send to you, to ensure they are appropriate and relevant
Make sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely
Meet legal requirements placed upon us

We will only use your personal information for the purposes for which we have collected it, unless we reasonably consider that we need to use it for any other reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent in compliance with the above rules where this is required or permitted by law.

3.1 Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information by email or text promoting school events, campaigns, charitable causes or services that may be of interest to you.

You can withdraw consent or ‘opt out’ of receiving these emails and/or texts at any time by selecting the ‘Unsubscribe’ link at the bottom of any such communication, or by contacting us (see ‘Contact us’ below).

3.2 Use of your personal data for filtering and monitoring purposes

While you’re in our school, we may monitor your use of our information and communication systems, equipment and facilities (e.g. school computers). We do this so that we can:

Comply with health and safety and other legal obligations
Comply with our policies (e.g. child protection policy, ICT acceptable use policy) and our legal obligations
Keep our network(s) and devices safe from unauthorised access, and prevent malicious software from harming our network(s)

4. Our lawful basis for using this data

Under Article 6 of the UK General Data Protection Regulations (UK GDPR) our lawful bases for processing your personal data for the purposes listed in section 3 above are as follows:

For the purposes of ongoing communications, e.g. newsletters, issuing invitations to events, in accordance with the ‘consent’ basis – we will obtain consent from you to use your personal data
For the purposes of medical emergencies, in accordance with the ‘vital interests’ basis – we will use this personal data in a life-or-death situation
For the purposes of recording destination and achievement information, in accordance with the ‘legitimate interests’ basis – where there’s a minimal privacy impact and we have a compelling reason

Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent, and explain how you would go about withdrawing consent if you wish to do so.

4.1 Our basis for using special category data

For ‘special category’ data, we only collect and use it when we have both a lawful basis, as set out above, and 1 of the following conditions for processing as set out in Article 9 of UK data protection law:

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in UK data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

5. Collecting this data

We will only collect and use your personal information when the law allows us to, as detailed above in section 4 of this notice. Whilst the majority of information we collect about you is mandatory, there is some information that you can choose whether to provide it to us.

Whenever we seek to collect information from you, we make it clear whether you must provide this information (and if so, what the possible consequences are of not complying), or whether you have a choice.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Police forces, courts or tribunals
Other schools or trusts
Department for Education

6. How we store this data

We keep personal information about you while you remain involved in our alumni network. We may also keep it beyond this if this is necessary to comply with our legal obligations or to meet our regulatory requirements. Our records management policy sets out how long we keep information about alumni.

We have put in place appropriate security measures to prevent your personal information being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your personal data securely when we no longer have a legal requirement to retain it.

7. Who we share data with

We do not share information about you with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with UK data protection law), we may share personal information about you with:

Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns
Government departments or agencies
The Department for Education
Our regulator, Ofsted
Suppliers and service providers
Financial organisations
Our auditors
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts or tribunals

7.1 Transferring data internationally

Where we transfer your personal data to a third-party country or territory, we will do so in accordance with UK data protection law.

In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

8. Your rights

8.1 How to access personal information that we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will (subject to any exemptions that may apply):

Give you a description of it
Tell you why we are holding it, how we are processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact us (see ‘Contact us’ below).

Your other rights regarding your data

Under data protection law, you have certain rights regarding how your personal data is used and kept safe. For example, you have the right to:

Object to our use of your personal data where it is likely to cause, or is causing damage or distress
Prevent your data being used to send direct marketing
Object to and challenge the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)
In certain circumstances, have inaccurate personal data corrected
In certain circumstances, have the personal data we hold about you deleted or destroyed, or restrict its processing
Withdraw your consent, where you previously provided it for the collection, processing and transfer of your personal data for a specific purpose
In certain circumstances, be notified of a data breach
Make a complaint to the Information Commissioner’s Office if you feel we have not used your information in the right way
Claim compensation for damages caused by a breach of the data protection regulations

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task
Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent

See information on types of lawful basis in section 4 of this privacy notice.

To exercise any of these rights, please contact us (see ‘Contact us’ below).

9. Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concerns about our data processing, please raise this with us in the first instance. You can make a complaint to us at any time by contacting Stephanie Smith, our trust Data Protection Officer by email to dpo@cromptonhouse.org

Alternatively, you can make a complaint at any time to the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Contact us

If you have any questions or concerns, or would like more information about anything mentioned in this privacy notice, please contact our data protection officer Stephanie Smith, by email to dpo@cromptonhouse.org

Privacy Notice Job Applicants

Contents

1. Introduction

Under UK data protection law, individuals have a right to be informed about how our trust uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about individuals applying for jobs in our trust.

The trust, Crompton House Multi Academy Trust are the ‘data controller’ for the purposes of UK data protection law.

2. The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Your name
Contact details
Copies of right to work documentation
References
Evidence of qualifications
Employment records, including work history, job titles, training records and professional memberships
Information about your use of our information and communication systems, equipment and facilities (e.g. school computers)

We may also collect, use, store and share (when appropriate) information about you that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Information about race, ethnicity, religious beliefs, sexual orientation and political opinions
Information about disability and access requirements
Photographs and CCTV images captured in school/on site

We may also collect, use, store and share (when appropriate) information about criminal convictions and offences.

We may also hold data about you that we have received from other organisations, including other schools and local authorities, and the Disclosure and Barring Service in respect of criminal offence data.

3. Why we use this data

We collect and use the data listed above to:

Enable us to establish relevant experience and qualifications
Facilitate safe recruitment, as part of our safeguarding obligations towards pupils
Enable equalities monitoring
Ensure that appropriate access arrangements can be provided for candidates that require them
Make sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require references for this role and you fail to provide us with the relevant details, we will not be able to take your application further.

We will only use your personal information for the purposes for which we have collected it, unless we reasonably consider that we need to use it for any other reason and that reason is incompatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent in compliance with the above rules where this is required or permitted by law.

3.1 Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information by email or text promoting school events, campaigns, charitable causes or services that may be of interest to you.

3.2 Use of your personal data for filtering and monitoring purposes

While you’re in any of our trust’s schools, we may monitor your use of our information and communication systems, equipment and facilities (e.g. school computers). We do this so that we can:

Comply with health and safety and other legal obligations
Comply with our policies (e.g. child protection policy, IT acceptable use policy) and our legal obligations
Keep our network(s) and devices safe from unauthorised access, and prevent malicious software from harming our network(s)

4. Our lawful basis for using this data

Under Article 6 of the UK General Data Protection Regulation (UK GDPR) our lawful bases for processing your personal data for the purposes listed in section 3 above are as follows:

For the purposes of making recruitment and selection decisions, in accordance with the ‘public task’ basis – we need to process data to fulfil our statutory function as a trust
For the purposes safeguarding, in accordance with the ‘legal obligation’ basis – we need to process data to meet our responsibilities under law
For the purposes of medical emergencies, in accordance with the ‘vital interests’ basis – we will use this personal data in a life-or-death situation
For the purposes of employment, in accordance with the ‘contract’ basis – we need to process personal data to fulfil a contract with you or to help you enter into a contract with us
For the purposes of making sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely, in accordance with the ‘legitimate interests’ basis – where there’s a minimal privacy impact and we have a compelling reason

4.1 Our basis for using special category data

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in UK data protection law. Conditions include:

We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

5. Collecting this data

We will only collect and use your data when the law allows us to (as detailed above in section 4 of this notice). While the majority of information we collect about you is mandatory, there is some information that can be provided voluntarily.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Police forces, courts or tribunals
Other schools or trusts

6. How we store this data

We keep personal information about you during the application process. We may also keep it beyond this if this is necessary to comply with our legal obligations or to meet our regulatory requirements. Our records management policy sets out how long we keep information about applicants and is available on request.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your personal data securely when we no longer have a legal requirement to retain it.

7. Who we share data with

We do not share information about you with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with UK data protection law), we may share personal information about you with:

Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns
Suppliers and service providers – to enable them to provide the service we have contracted them for, such as HR and recruitment support, and filtering and monitoring
Professional advisers and consultants
Employment and recruitment agencies
The Department for Education

We will only share your personal information with the above parties for the purposes of processing your application. All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes in accordance with our instructions.

7.1 Transferring data internationally

Where we transfer your personal data to a third-party country or territory, we will do so in accordance with UK data protection law. In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

8. Your rights

8.1 How to access personal information that we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will (subject to any exemptions that may apply):

Give you a description of it
Tell you why we are holding it, how we are processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact us (see ‘Contact us’ below).

8.2 Your other rights regarding your data

Under data protection law, you have certain rights regarding how your personal data is used and kept safe. For example, you have the right to:

Object to our use of your personal data where it is likely to cause, or is causing damage or distress
Prevent your data being used to send direct marketing
Object to and challenge the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)
In certain circumstances, have inaccurate personal data corrected or blocked
In certain circumstances, have the personal data we hold about you deleted or destroyed, or restrict its processing
Withdraw your consent, where you previously provided it for the collection, processing and transfer of your personal data for a specific purpose
In certain circumstances, be notified of a data breach
Make a complaint to the Information Commissioner’s Office if you feel we have not used your information the right way
Claim compensation for damages caused by a breach of the data protection regulations

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task
Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent

To exercise any of these rights, please contact us at (see ‘Contact us’ below).

9. Complaints

We take any complaints about our collection and use of personal information very seriously.

Alternatively, you can make a complaint at any time to the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Contact us

If you have any questions or concerns, or would like more information about anything mentioned in this privacy notice, please contact Stephanie Smith, our data protection officer (DPO) by email to dpo@cromptonhouse.org

Privacy Notice Members, Trustees and Local Governors

Contents

1. Introduction

Under UK data protection law, individuals have a right to be informed about how the trust, and each of our schools, uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about individuals working with our trust in a voluntary capacity, including members, trustees and local governors.

Our trust, Crompton House Multi academy Trust is the ‘data controller’ for the purposes of UK data protection law.

2. The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Name, date of birth, postal address, email address, telephone number
Contact details
Governance details (such as role, start and end dates, skills and experience)
Recruitment details
References
Evidence of qualifications
Employment details
Minutes of meetings
Information about business and pecuniary interests
Information about your use of our information and communication systems, equipment and facilities

We may also collect, use, store and share (when appropriate) information about you that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Information about any health conditions you have that we need to be aware of
Information about disability and access requirements
Photographs and CCTV images captured in school/on site

We may also collect, use, store and share (when appropriate) information about criminal convictions and offences.

3. Why we use this data

We use the data listed above to:

Establish and maintain effective governance
Meet statutory obligations for publishing and sharing details about members, trustees and local governors
Facilitate safe recruitment, as part of our safeguarding obligations towards pupils
Undertake equalities monitoring
Ensure that appropriate access arrangements can be provided for volunteers who require them
Make sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you, or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers and pupils).

We will only use your personal information for the purposes for which we have collected it, unless we reasonably consider that we need to use it for another reason and that reason if compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent in compliance with the above rules where this is required or permitted by law.

3.1 Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information by email or text promoting school events, campaigns, charitable causes or services that may be of interest to you.

3.2 Use of your personal data for filtering and monitoring purposes

While you’re in any of our trust’s schools, we may monitor your use of our information and communication systems, equipment and facilities (e.g. school computers). We do this so that we can:

Comply with health and safety and other legal obligations
Comply with our policies (e.g. child protection policy, ICT acceptable use policy) and our legal obligations
Keep our network(s) and devices safe from unauthorised access, and prevent malicious software from harming our network(s)

4. Our lawful basis for using this data

Under Article 6 of the UK General Data Protection Regulation (UK GDPR) our lawful bases for processing your personal data for the purposes listed in section 3 above are as follows:

For the purposes of recording information about business and pecuniary interests, keeping meetings records, in accordance with the ‘public task’ basis – we need to process data to fulfil our statutory function as a trust
For the purposes of monitoring your use of our information and communication systems, equipment and facilitiesprocessing a DBS check and providing information to the DfE, in accordance with the ‘legal obligation’ basis – we need to process data to meet our responsibilities under law
For the purposes of [list the relevant letter(s) from section 3 above], in accordance with the ‘consent’ basis – we will obtain consent from you to use your personal data
For the purposes of medical emergencies, in accordance with the ‘vital interests’ basis – we will use this personal data in a life-or-death situation
For the purposes of recording your personal and contact details, in accordance with the ‘contract’ basis – we need to process personal data to fulfil a contract with you or to help you enter into a contract with us
For the purposes of CCTV, making sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely, in accordance with the ‘legitimate interests’ basis – where there’s a minimal privacy impact and we have a compelling reason

4.1 Our basis for using special category data

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in UK data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

5. Collecting this data

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Police forces, courts or tribunals

6. How we store this data

We keep personal information about you while you volunteer in our trust. We may also keep it beyond your work in our trust if this is necessary to comply with our legal obligations or to meet our regulatory requirements. Our records management policy sets out how long we keep information about members, trustees, local governors and other volunteers and is available on request.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your personal data securely when we no longer have a legal requirement to retain it

7. Who we share data with

We do not share information about you with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with UK data protection law), we may share personal information about you with:

Our local authority – to meet our legal obligations to share certain information with it such as safeguarding concerns
Government departments or agencies
Our regulator, Ofsted
Department for Education
Suppliers and service providers
Our auditors
Health authorities
Security organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts or tribunals
Training providers

7.1 Transferring data internationally

Where we transfer your personal data to a third-party country or territory, we will do so in accordance with UK data protection law.

In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

8. Your rights

8.1 How to access personal information that we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will (subject to any exemptions that may apply):

Give you a description of it
Tell you why we are holding it, how we are processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact us (see ‘Contact us’ below).

8.2 Your other rights regarding your data

Under UK data protection law, you have certain rights regarding how your personal data is used and kept safe. For example, you have the right to:

Object to our use of your personal data where it is likely to cause, or is causing damage or distress
Prevent your data being used to send direct marketing
Object to and challenge the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)
In certain circumstances, have inaccurate personal data corrected or blocked
In certain circumstances, have the personal data we hold about you deleted or destroyed, or restrict its processing
Withdraw your consent, where you previously provided it for the collection, processing and transfer of your personal data for a specific purpose
In certain circumstances, be notified of a data breach
Make a complaint to the Information Commissioner’s Office if you feel we have not used your information in the right way
Claim compensation for damages caused by a breach of the data protection regulations

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task
Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent

See information on types of lawful basis in section 4 of this privacy notice.

To exercise any of these rights, please contact us (see ‘Contact us’ below).

9. Complaints

We take any complaints about our collection and use of personal information very seriously.

You can make a complaint to us at any time by contacting Stephanie Smith, our Data Protection Officer by email to dpo@cromptonhouse.org

Alternatively, you can make a complaint at any time to the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Contact us

If you have any questions or concerns, or would like more information about anything mentioned in this privacy notice, please contact our data protection officer Stephanie Smith by email to dpo@cromptonhouse.org

Privacy Notice Parents and Carers

Contents

1. Introduction

Under UK data protection law, individuals have a right to be informed about how our school, and the multi-academy trust we are part of, uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about parents and carers of pupils at our school.

Our trust, Crompton House Multi Academy Trust, is the ‘data controller’ for the purposes of UK data protection law.

2. The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about pupils and parents/carers includes, but is not restricted to:

Contact details and contact preferences (such as your name, address, email address and telephone numbers)
Bank details
Details of your family circumstances
Details of any safeguarding information including court orders or professional involvement
Records of your correspondence and contact with us
Details of any complaints you have made
Information about your use of our information and communication systems, equipment and facilities (e.g. school computers)

We may also collect, use, store and share (when appropriate) information about you that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Information about any health conditions you have that we need to be aware of
Photographs and CCTV images captured in school
Information about your religion, as part of our admission arrangements

We may also hold data about you that we have received from other organisations, including other schools and local authorities.

3. Why we use this data

We collect and use this data to:

Report to you on your child’s attainment and progress
Keep you informed about the running of the school (such as emergency closures) and events
Process payments for school services and clubs
Provide appropriate pastoral care
Protect pupil welfare
Administer admissions waiting lists
Assess the quality of our services
Carry out research
Comply with our legal and statutory obligations
Make sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely

We will only use your personal information for the purposes for which we have collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

3.1 Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information by email or text promoting school events, campaigns, charitable causes or services that may be of interest to you.

3.2 Use of your personal data for filtering and monitoring purposes

While you’re in our school, we may monitor your use of our information and communication systems, equipment and facilities (e.g. school computers). We do this so that we can:

Comply with health and safety and other legal obligations
Comply with our policies (e.g. child protection policy, ICT acceptable use policy) and our legal obligations
Keep our network(s) and devices safe from unauthorised access, and prevent malicious software from harming our network(s)
Protect your child’s welfare

4. Our lawful basis for using this data

Under Article 6 of the UK General Data protection Regulations (GDPR) our lawful bases for processing your personal data for the purposes listed in section 3 above are as follows:

For the purposes of providing your child with an education including educational assessments and behaviour monitoring, safeguarding and promoting both your welfare, your child’s welfare and the welfare of other children, facilitating the efficient operation of the school including correspondence and complaints, ensuring we comply with all our legal obligations in accordance with the ‘public task’ basis – we need to process data to fulfil our statutory function as a school
For the purposes of safeguarding, health and safety, provide information to Government agencies, including the police, in accordance with the ‘legal obligation’ basis – we need to process data to meet our responsibilities under law
For the purposes of facilitating our school meals payment system and capturing pupil’s digital images, in accordance with the ‘consent’ basis – we will obtain consent from you to use your personal data. Whilst the majority of processing of personal data we hold about you will not require your consent; we will inform you if your consent is required and seek that consent before any processing takes place.
For the purposes of medical emergencies, in accordance with the ‘vital interests’ basis – we will use this personal data in a life-or-death situation
For the purposes of school trips and functions, school transportation, in accordance with the ‘contract’ basis – we need to process personal data to fulfil a contract with you or to help you enter into a contract with us
For the purposes of CCTV monitoring, making sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely alumni relations, admissions process, in accordance with the ‘legitimate interests’ basis – where there’s a minimal privacy impact and we have a compelling reason

4.1 Our basis for using special category data

For ‘special category’ data we only collect and use it when we have both a lawful basis, as set out above, and 1 of the following conditions for processing as set out in Article 9 of UK data protection law:

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in UK data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

5. Collecting this data

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Your children
Police forces, courts or tribunals
Other schools or trusts

6. How we store this data

We keep personal information about you while your child is attending our school. We may also keep it beyond their attendance at our school if this is necessary to comply with our legal obligations or to meet our regulatory requirements. Our records management policy sets out how long we keep information about parents and carers and is available on request.

We have put in place appropriate security measures to prevent your personal information being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your personal data securely when we no longer have a requirement to retain it.

7. Who we share data with

We do not share information about pupils with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with UK data protection law), we may share personal information about you with:

Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and information about exclusions
Government departments or agencies
Department for Education
Our regulator – Ofsted
Suppliers and service providers
Financial organisations
Our auditors
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts or tribunals
Schools that your child may attend after leaving us

7.1 Transferring data internationally

Where we transfer your personal data to a third-party country or territory, we will do so in accordance with UK data protection law.

In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

8. Your rights

8.1 How to access personal information that we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will (subject to any exemptions that may apply):

Give you a description of it
Tell you why we are holding it, how we are processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact us (see ‘Contact us’ below).

8.2 Your other rights regarding your data

Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe, including the right to:

Object to our use of your personal data where it is likely to cause, or is causing, damage or distress
Prevent your data being used to send direct marketing
Object to and challenge the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)
In certain circumstances, have inaccurate personal data corrected or blocked
In certain circumstances, have the personal data we hold about you deleted or destroyed, or restrict its processing
Withdraw your consent, where you previously provided it for the collection, processing and transfer of your personal data for a specific purpose
In certain circumstances, be notified of a data breach
Make a complaint to the Information Commissioner’s Office
Claim compensation for damages caused by a breach of the data protection regulations

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task
Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent

See information on types of lawful basis in section 4 of this privacy notice.

To exercise any of these rights, please contact us (see ‘Contact us’ below).

9. Complaints

We take any complaints about our collection and use of personal information very seriously.

To make a complaint, please contact Stephanie Smith, our data protection officer by email to dpo@cromptonhouse.org

Alternatively, you can seek advice directly from the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Contact us

If you have any questions or concerns, or would like more information about anything mentioned in this privacy notice, please contact our data protection officer, Stephanie Smith by email to dpo@cromptonhouse.org

Privacy Notice Parents and Carers Use of Child's Data Primary

Contents

1. Introduction

This privacy notice explains how we collect, store and use personal data about pupils at our school.

This privacy notice applies while we believe your child is not capable of understanding and exercising their own data protection rights.

Once your child is able to understand their rights over their own personal data (generally considered to be age 13, but this has to be considered on a case-by-case basis), you should instead refer to our privacy notice for pupils to see what rights they have over their own personal data.

Our trust, Crompton House Multi Academy Trust, is the ‘data controller’ for the purposes of UK data protection law.

2. The personal data we hold

We hold personal data about pupils at our school to support teaching and learning, to provide pastoral care and to assess how the school is performing.

Personal data that we may collect, use, store and share (when appropriate) about your child includes, but is not restricted to:

Contact details, contact preferences, date of birth, identification documents
Results of internal assessments and externally set tests
Pupil and curricular records
Exclusion information
Attendance information
Safeguarding information
Details of any support received, including care packages, plans and support providers
Information about their use of our information and communication systems, equipment and facilities (e.g. school computers)

We may also collect, use, store and share (when appropriate) information about your child that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Information about any medical conditions that we need to be aware of, including physical and mental health
Photographs and CCTV images captured in school
Information about characteristics, such as ethnic background or special educational needs (SEN)

We may also hold data about your child that we have received from other organisations, including other schools or trusts, and local authorities.

3. Why we use this data

We collect and use the data listed above to:

Support pupil learning
Monitor and report on pupil progress
Provide appropriate pastoral care
Protect pupil welfare
Assess the quality of our services
Administer admissions waiting lists
Carry out research
Administer school property
Comply with the law regarding data sharing
Make sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely

We will only use your child’s personal information for the purposes for which we have collected it, unless we reasonably consider that we need to use it for any other reason and that reason is incompatible with the original purpose. If we need to use your child’s personal information for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

Please note that we may process your child’s personal information without your knowledge or consent in compliance with the above rules where this is required or permitted by law.

3.1 Use of your child’s personal data for marketing purposes

Where you have given us consent to do so, we may send your child marketing information by email or text promoting school events, campaigns, charitable causes or services that may be of interest to them.

3.2 Use of your child’s personal data for filtering and monitoring purposes

While your child is in our school, we may monitor their use of our information and communication systems, equipment and facilities (e.g. school computers). We do this so that we can:

Comply with health and safety and other legal obligations
Comply with our policies (e.g. child protection policy, ICT acceptable use policy) and our legal obligations
Keep our network(s) and devices safe from unauthorised access, and prevent malicious software from harming our network(s)
Protect your child’s welfare

4. Our lawful basis for using this data

Under Article 6 of the UK General Data Protection Regulation (UK GDPR) our lawful bases for processing your child’s personal data for the purposes listed in section 3 above are as follows:

For the purposes of of providing your child with an education including behaviour monitoring, safeguarding and promoting their welfare, in accordance with the ‘public task’ basis – we need to process data to fulfil our statutory function as a school
For the purposes of safeguarding, health and safety, provide information to Government agencies, including the police, in accordance with the ‘legal obligation’ basis – we need to process data to meet our responsibilities under law
For the purposes of photographs and biometric data to pay for school meals, in accordance with the ‘consent’ basis – we will obtain consent from you to use your child’s personal data
For the purposes of medical emergencies, in accordance with the ‘vital interests’ basis – we will use this personal data in a life-or-death situation
For the purposes of school trips, school transportation and functions, in accordance with the ‘contract’ basis – we need to process personal data to fulfil a contract with your child or to help them enter into a contract with us
For the purposes of of CCTV monitoring, making sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely, alumni relations, admissions process, in accordance with the ‘legitimate interests’ basis – where there’s a minimal privacy impact and we have a compelling reason

Where you have provided us with consent to use your child’s data, you may withdraw this consent at any time. We will make this clear when requesting your consent, and explain how you would go about withdrawing consent if you wish to do so.

4.1 Our basis for using special category data

We have obtained your explicit consent to use your child’s personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your child’s life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in UK data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your child’s life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

5. Collecting this data

We will only collect and use your child’s information when the law allows us to (as detailed above in section 4 of this notice).

While the majority of information we collect about your child is mandatory, there is some information that can be provided voluntarily.

Most of the data we hold about your child will come from you, but we may also hold data about your child from:

Local authorities
Government departments or agencies
Police forces, courts or tribunals
Other schools or trusts
Department for Education

6. How we store this data

We keep personal information about your child while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary to comply with our legal obligations or to meet our regulatory requirements. Our records management policy sets out how long we keep information about pupils.

We have put in place appropriate security measures to prevent your child’s personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your child’s personal data securely when we no longer have a legal requirement to retain it.

7. Who we share data with

We do not share information about your child with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with UK data protection law), we may share personal information about your child with:

Schools that your child may attend after leaving us
Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and information about exclusions
Government departments or agencies
Youth support services provider
Department for Education
Our regulator, Ofsted
Suppliers and service providers
Financial organisations
Our auditors
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts or tribunals
- Sharing data with the Department for Education (DfE)

The Department for Education (a government department) collects personal data from schools and local authorities via various statutory data collections. We are required to share information about our pupils with the DfE either directly or via our local authority, via various statutory data collections.

The data shared will be in line with Regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013

The data is transferred securely and held by the Department for Education under a combination of software and hardware controls that meet the current government security policy framework.

The data we share with the DfE is used for a number of purposes, including to:

Inform funding
Monitor education policy and school accountability
Support research

The information shared with the DfE could include:

Your child’s name and address
Unique pupil numbers
Pupil matching reference numbers
Gender or ethnicity
Details of any special educational needs (SEN)
Details of schools attended
Absence and exclusion information
Information relating to exam results
Information relating to any contact with children’s services
What they did after they finished school

Please note: this list is not exhaustive.

Once your child reaches the age of 13, we are legally required to pass on certain information to the local authority or youth services provider, which has responsibilities regarding the education or training of 13 to 19 year olds under section 507B of the Education Act 1996. Parents/carers, or pupils if aged 16 or over, can request that only their name, address and date of birth be passed to these agencies by informing the data protection officer (DPO).

National Pupil Database

We are required to provide information about pupils to the Department for Education as part of statutory data collections such as the school and early years census.

Some of this information is then stored in the National Pupil Database (NPD), which is owned and managed by the Department for Education and provides evidence on school performance to inform research.

The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.

The Department for Education may share information from the NPD with third parties, such as other organisations that promote children’s education or wellbeing in England. These third parties must agree to strict terms and conditions about how they will use the data.

For more information, see the Department for Education’s webpage on how it collects and shares personal data.

You can also contact the Department for Education with any further questions about the NPD.

7.2 Transferring data internationally

Where we transfer your child’s personal data to a third-party country or territory, we will do so in accordance with UK data protection law.

In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

8. Your rights

8.1 How to access personal information that we hold about your child

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about your child.

If you make a subject access request, and if we do hold information about your child, we will (subject to any exemptions that apply):

Give you a description of it
Tell you why we are holding it, how we are processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have the right for your child’s personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact us (see ‘Contact us’ below).

Once your child is able to understand their rights over their own data (generally considered to be age 13, but this has to be considered on a case-by-case basis), we will need to obtain consent from your child for you to make a subject access request on their behalf.

8.2 Your other rights regarding your child’s data

Under UK data protection law, you have certain rights regarding how your child’s personal data is used and kept safe. For example, you have the right to:

Object to our use of your child’s personal data
Object to the processing of personal data that is likely to cause, or is causing, damage or distress
Prevent your child’s data being used to send direct marketing
Object to and challenge the use of your child’s personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)
In certain circumstances, have inaccurate personal data corrected or blocked
In certain circumstances, have the personal data we hold about your child deleted or destroyed, or restrict its processing
Withdraw your consent, where you previously provided it for the collection, processing and transfer of your child’s personal data for a specific purpose
In certain circumstances, be notified of a data breach
Make a complaint to the Information Commissioner’s Office (ICO)
Claim compensation for damages caused by a breach of the data protection regulations

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task
Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t have the right to object, but you have the right to withdraw consent

See information on types of lawful basis in section 4 of this privacy notice.

To exercise any of these rights, please contact us (see ‘Contact us’ below).

9. Complaints

We take any complaints about our collection and use of personal information very seriously.

You can make a complaint to us at any time by contacting Stephanie Smith, our data protection officer by email to dpo@cromptonhouse.org.

Alternatively, you can make a complaint at any time to the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Contact us

If you have any questions or concerns, or would like more information about anything mentioned in this privacy notice, please contact our data protection officer (DPO) Stephanie Smith by email to dpo@cromptonhouse.org

Privacy Notice Pupils

Contents

1. Introduction

You have a legal right to be informed about how our school, and the multi-academy trust (MAT) we are part of, uses any personal information that we hold about you. To comply with this, we provide a ‘privacy notice’ to you where we are processing your personal data.

This notice explains how we collect, store and use personal data about pupils at our school, like you.

Our trust, Crompton House Multi Academy Trust is the ‘data controller’ for the purposes of UK data protection law.

2. The personal data we hold

We hold some personal information about you to make sure we can help you learn and look after you at school.

For the same reasons, we get information about you from some other places too – such as other schools, the local council and the government.

Personal information that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Your name
Your contact details
Your test results, details about your learning and what you have achieved at school
Your attendance records
Details of any behaviour issues or exclusions
Information about how you use our information and communication systems, equipment and facilities (e.g. school computers)

We may also collect, use, store and share (when appropriate) information about you that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Information about your characteristics, like your ethnic background or any special educational needs (SEN)
Information about any medical conditions you have
Photographs and CCTV images

We may also hold data about you that we have received from other organisations, including other schools and local authorities.

3. Why we use this data

We collect and use the data listed above to help run the school, including to:

Get in touch with you and your parents/carers when we need to
Check how you’re doing in exams and work out whether you or your teachers need any extra help
Track how well the school as a whole is performing
Look after your wellbeing and keep you safe
Make sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely
Answer your questions and complaints
Publish statistics, for example, about the number of pupils or learners in schools
Meet legal requirements placed upon us

We will only use your personal information for the purposes for which we have collected it, unless we reasonably consider that we need to use it for any other reason and that reason is incompatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

Please note that we may process your personal information without your knowledge or consent in compliance with the above rules where this is required or permitted by law.

3.1 Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you messages by email or text promoting school events, campaigns, charitable causes or services that you might be interested in.

You can take back this consent or ‘opt out’ of receiving these emails and/or texts at any time by selecting the ‘Unsubscribe’ link at the bottom of any such communication, or by contacting us (see ‘Contact us’ below).

3.2 Use of your personal data for filtering and monitoring purposes

While you’re in our school, we may monitor your use of our information and communication systems, equipment and facilities (e.g. school computers). We do this so that we can:

Comply with health and safety and other legal obligations
Comply with our policies (e.g. child protection policy, ICT acceptable use policy) and our legal obligations
Keep our network(s) and devices safe from unauthorised access, and prevent malicious software from harming our network (s)
Protect your welfare

4. Our lawful basis for using this data

We will only collect and use your information when the law allows us to. We need to establish a ‘lawful basis’ to do this as set out in Article 6 of the UK General Data Protection Regulations (GDPR).

Our lawful bases for processing your personal information for the reasons listed in section 3 above are:

For the purposes of providing you with an education including behaviour monitoring, safeguarding and promoting your welfare, in accordance with the ‘public task’ basis – – we need to process data to fulfil our statutory function as a school
For the purposes of safeguarding, health and safety, provide information to Government agencies, including the police, in accordance with the ‘legal obligation’ basis – we need to process data to meet our responsibilities under law
For the purposes of photographs and biometric data to pay for school meals, in accordance with the ‘consent’ basis – we will obtain consent from you to use your personal data
For the purposes of medical emergencies, in accordance with the ‘vital interests’ basis – we will use this personal data in a life-or-death situation
For the purposes of school trips, school transportation and functions, in accordance with the ‘contract’ basis – we need to process personal data to fulfil a contract with you or to help you enter into a contract with us
For the purposes of CCTV monitoring, making sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely, alumni relations, admissions process, in accordance with the ‘legitimate interests’ basis – where there’s a minimal privacy impact and we have a compelling reason

Where you’ve given your consent for us to use your information, you may take back this consent at any time.

We’ll make this clear when requesting your consent and explain how you’d go about withdrawing consent if you want to.

4.1 Our basis for using special category data

For ‘special category’ data (more sensitive personal information), we only collect and use it when we have both a lawful basis, as set out above, and 1 of the following conditions for processing as set out in Article 9 of UK data protection law:

We have got your explicit consent to use your information in a certain way
We need to use your information under employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The information has already been made obviously public by you
We need to use it to make or defend against legal claims
We need to use it for reasons of substantial public interest as defined in legislation
We need to use it for health or social care purposes, and it’s used by, or under the direction of, a professional obliged to confidentiality under law
We need to use it for public health reasons, and it’s used by, or under the direction of, a professional obliged to confidentiality under law
We need to use it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the use is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in UK data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made obviously public by you
We need to use it as part of legal proceedings, to obtain legal advice, or to make or defend against legal claims
We need to use it for reasons of substantial public interest as defined in legislation

5. Collecting this data

We will only collect and use personal information when the law allows us to as detailed above in section 4 of this notice. While most of the information we collect about you is mandatory (i.e. you have to give us the information), there is some information that can be provided voluntarily.

Whenever we want to collect information from you, we make it clear whether you have to give us this information (and if so, what the possible consequences are of not doing that), or whether you have a choice.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local councils
Government departments or agencies
Police forces, courts or tribunals
Other schools or trusts
The Department for Education (DfE)

6. How we store this data

We keep personal information about you while you’re attending our school. We may also keep it after you stop attending our school, if this is necessary to comply with our legal obligations or to meet our regulatory requirements. Our records management policy sets out how long we keep information about pupils and is available on request.

We have security measures in place to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We’ll dispose of your personal data securely when we no longer have a legal requirement to retain it.

7. Who we share data with

We don’t share information about you with any third party without your consent unless the law and our policies allow us to do so.

Where it’s legally required, or necessary (and it complies with UK data protection law), we may share personal information about you with:

Schools that you may attend after leaving us
Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and information about exclusions
Government departments or agencies
Youth support services provider
Department for Education
Our regulator, Ofsted
Suppliers and service providers – so they can provide the services we have contracted them for
Financial organisations
Our auditors
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts or tribunals
- Sharing data with the Department for Education (DfE)

We have to share information about you with the Department for Education either directly or via our local authority, via various statutory data collections.

The data shared will be in line with the Regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013

The data is transferred securely and held by the Department for Education under a combination of software and hardware controls which meet the current government security policy framework.

The data we share about you with the Department for Education is used for a number of different purposes, including to:

Help decide the amount of money that our school receives
Monitor how well the education system is working and how well our school is doing in terms of educating our pupils
Support research

The information shared with the Department for Education about you could include:

Your name and address
Your unique pupil number
Pupil matching reference numbers
Details of your gender or ethnicity
Details of any special educational needs (SEN)
Details of schools attended
Absence and exclusion information
Information relating to exam results
Information relating to any contact with children’s services
What you have done since finishing school

This list is not exhaustive.

Once pupils in our school reach the age of 13, we are legally required to pass on certain information to the local authority or youth services provider, which has responsibilities regarding the education or training of 13- to 19-year-olds under section 507B of the Education Act 1996.

Parents/carers, or pupils if aged 16 or over, can request that only their name, address and date of birth be passed to these agencies by informing the DPO at dpo@cromptonhouse.org

National Pupil Database

We have to provide information about you to the Department for Education as part of data collections such as the school census.

Some of this information is then stored in the National Pupil Database (NPD), which is managed by the Department for Education and provides evidence on how schools are performing. This, in turn, supports research.

The database is held electronically so it can easily be turned into statistics. The information it holds is collected securely from schools, local authorities, exam boards and others.

The Department for Education may share information from the database with other organisations, such as organisations that promote children’s education or wellbeing in England. These organisations must agree to strict terms and conditions about how they will use your data.

You can find more information about this on the Department for Education’s webpage on how it collects and shares personal data.

You can also contact the Department for Education if you have any questions about the database.

7.2 Transferring data internationally

Where we transfer your personal data to a third-party country or territory, we will do so in accordance with UK data protection law.

In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

8. Your rights

8.1 How to access personal information that we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will (unless there’s a really good reason why we shouldn’t):

Give you a description of it
Tell you why we are holding it, how we are using it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data (decisions made by a computer or machine, rather than by a person), and any consequences of this
Give you a copy of the information in an understandable form

You may also have the right for your personal information to be shared with another organisation in certain circumstances.

If you would like to make a request, please contact us see ‘Contact us’ below).

8.2 Your other rights regarding your data

Under UK data protection law, you have certain rights regarding how your personal information is used and kept safe. For example, you have the right to:

Say that you don’t want your personal information to be used
Object to the processing of personal data that is likely to cause, or is causing, damage or distress
Stop it being used to send you marketing materials
Say that you don’t want it to be used for automated decisions (decisions made by a computer or machine, rather than by a person)
In some cases, have it corrected if it’s inaccurate
In some cases, have it deleted or destroyed, or restrict its use
Withdraw your consent, where you previously provided consent for your personal information to be collected, processed and transferred for a particular reason
In some cases, be notified of a data breach
Make a complaint to the Information Commissioner’s Office (ICO) if you feel we have not used your information in the right way
Claim compensation if the data protection rules are broken and this harms you in some way

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task
Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t have the right to object, but you have the right to withdraw consent

See information on types of lawful basis in section 4 of this privacy notice.

To exercise any of these rights, please contact us (see ‘Contact us’ below).

9. Complaints

We take any complaints about our collection and use of personal information very seriously.

You can make a complaint to us at any time by contacting Stephanie Smith, our data protection officer by email to dpo@cromptonhouse.org

Alternatively, you can make a complaint at any time to the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Contact us

Privacy Notice Suppliers

Contents

1. Introduction

Under UK data protection law, individuals have a right to be informed about how our trust, either directly or through 1 or more of our schools, uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about suppliers of goods and services that the trust, either directly or through 1 of our schools, contracts with, including their individual representatives, employees and agents. References to “you” in this privacy notice cover all of these individuals.

Our trust, Crompton House Multi academy Trust, is the ‘data controller’ for the purposes of UK data protection law.

2. The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Names, characteristics and contact details
References, CVs and details of an individual’s employment history, if collected as part of a bidding, tendering or engagement process
Bank details and other financial information where it relates to an individual, such as if you’re operating as a sole trader
Any other personal information necessary to fulfil the terms of a contract we have with you
Information relating to visits to the school, e.g. the individual’s company or organisation name, arrival and departure time, vehicle number plate
Information about your use of our information and communication systems, equipment and facilities

If our contract with you requires you to visit or carry out any work at our school sites/premises, our privacy notice for visitors to the school will also apply.

We may also collect, use, store and share (when appropriate) information about you that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Information about any access arrangements that may be required
Photographs for identification purposes
CCTV images captured in school

We may also hold data about you that we have received from other organisations, including other schools or trusts and local authorities.

3. Why we use this data

We use the data listed above to:

Decide whether to engage you
Fulfil the terms of our contract with you, including payment
Keep accurate records of the suppliers that we use
Identify you while on the school site, and keep all individuals safe
Keep pupils and staff safe while you are on the school site
Keep accurate records of visits to the school
Make sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely
Meet legal requirements placed upon us

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you, or we may be prevented from complying with our legal obligations.

We will only use your personal information for the purposes for which we have collect it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

3.1 Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information by email or text promoting school events, campaigns, charitable causes or services that may be of interest to you.

3.2 Use of your personal data for filtering and monitoring purposes

While you’re in any of our trust’s schools, we may monitor your use of our information and communication systems, equipment and facilities (e.g. school computers). We do this so that we can:

Comply with health and safety and other legal obligations
Comply with our policies (e.g. child protection policy, ICT acceptable use policy) and our legal obligations
Keep our network and devices safe from unauthorised access, and prevent malicious software from harming our network(s)

4. Our lawful basis for using this data

Under Article 6 of the UK General Data Protection Regulation (UK GDPR) our lawful bases for processing your personal data for the purposes listed in section 3 above are as follows:

In accordance with the ‘public task’ basis – we need to process data to fulfil our statutory function as a trust
For the purposes of meeting our responsibilities under law and keeping our pupils and staff safe whilst on school premises, in accordance with the ‘legal obligation’ basis – we need to process data to meet our responsibilities under law
In accordance with the ‘consent’ basis – we will obtain consent from you to use your personal data
For the purposes of medical emergencies, in accordance with the ‘vital interests’ basis – we will use this personal data in a life-or-death situation
In accordance with the ‘contract’ basis – we need to process personal data to fulfil a contract with you or to help you enter into a contract with us
In accordance with the ‘legitimate interests’ basis – where there’s a minimal privacy impact and we have a compelling reason

4.1 Our basis for using special category data

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in UK data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

5. Collecting this data

While the majority of information we collect about you is mandatory, there is some information that can be provided voluntarily.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Police forces, courts or tribunals

6. How we store this data

We keep personal information about you while you work with our trust or 1 or more of our schools. We may also keep it beyond your work with our trust or 1 or more of our schools if this is necessary to comply with our legal requirements or to meet our regulatory requirements. Our records management policy sets out how long we keep information about suppliers.

We have put in place appropriate security measures to prevent your personal information being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your personal data securely when we no longer have a legal requirement to retain it.

7. Who we share data with

We do not share information about you with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with UK data protection law), we may share personal information about you with:

Our local authority– to meet our legal obligations to share certain information with it such as safeguarding concerns
Government departments or agencies
Department for Education
Our regulator, Ofsted
Suppliers and service providers
Financial organisations
Our auditors
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts or tribunals

7.1 Transferring data internationally

Where we transfer your personal data to a third-party country or territory, we will do so in accordance with UK data protection law.

In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

8. Your rights

8.1 How to access personal information that we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will (subject to any exemptions that may apply):

Give you a description of it
Tell you why we are holding it, how we are processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact us (see ‘Contact us’ below).

8.2 Your other rights regarding your data

Under UK data protection law, you have certain rights regarding how your personal data is used and kept safe. For example, you have the right to:

Object to our use of your personal data where it is likely to cause, or is causing damage or distress
Prevent your data being used to send direct marketing
Object to and challenge the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)
In certain circumstances, have inaccurate personal data corrected
In certain circumstances, have the personal data we hold about you deleted or destroyed, or restrict its processing
Withdraw your consent, where you previously provided it for the collection, processing and transfer of your personal data for a specific purpose
In certain circumstances, be notified of a data breach
Make a complaint to the Information Commissioner’s Office if you feel we have not used your information in the right way
Claim compensation for damages caused by a breach of the data protection regulations

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task
Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent

See information on types of lawful basis in section 4 of this privacy notice.

To exercise any of these rights, please contact us (see ‘Contact us’ below).

9. Complaints

We take any complaints about our collection and use of personal information very seriously.

Alternatively, you can make a complaint at any time to the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Contact us

If you have any questions or concerns, or would like more information about anything mentioned in this privacy notice, please contact Stephanie Smith, our Data Protection Officer by email to dpo@cromptonhouse.org

Privacy Notice Visitors

Contents

1. Introduction

Under UK data protection law, individuals have a right to be informed about how our school, and the multi-academy trust we are part of uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about visitors to the school.

Our trust, Crompton House Multi Academy Trust, is the ‘data controller’ for the purposes of UK data protection law.

2. The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Name
Contact details
Information relating to the visit, e.g. company or organisation name, arrival and departure time, vehicle number plate
Information about your use of our information and communication systems, equipment and facilities

We may also collect, use, store and share (when appropriate) information about you that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Information about any access arrangements that may be required
Photographs for identification purposes
CCTV images captured in school

We may also hold data about you that we have received from other organisations, including other schools and local authorities.

3. Why we use this data

We collect and use the data listed above to:

Identify you and keep you safe while on the school site
Keep pupils and staff safe
Maintain accurate records of visits to the school site
Provide appropriate access arrangements
Make sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely
Meet legal requirements placed upon us

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

3.1 Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information by email or text promoting school or trust-wide events, campaigns, charitable causes or services that may be of interest to you.

3.2 Use of your personal data for filtering and monitoring purposes

While you’re in our school, we may monitor your use of our information and communication systems, equipment and facilities (e.g. school computers). We do this so that we can:

Comply with health and safety and other legal obligations
Comply with our policies (e.g. child protection policy, ICT acceptable use policy) and our legal obligations
Keep our network and devices safe from unauthorised access, and prevent malicious software from harming our network

4. Our lawful basis for using this data

Under Article 6 of the UK General Data Protection Regulations (UK GDPR) our lawful bases for processing your personal data for the purposes listed in section 3 above are as follows:

In accordance with the ‘public task’ basis – we need to process data to fulfil our statutory function as a school or trust
For the purposes of safeguarding, health & safety, insurance policy requirements in accordance with the ‘legal obligation’ basis – we need to process data to meet our responsibilities under law
In accordance with the ‘consent’ basis – we will obtain consent from you to use your personal data
For the purposes of medical emergencies in accordance with the ‘vital interests’ basis – we will use this personal data in a life-or-death situation
In accordance with the ‘contract’ basis – we need to process personal data to fulfil a contract with you or to help you enter into a contract with us
For the purposes of keeping our network and devices safe from unauthorised access, and prevent malicious software from harming our network, in accordance with the ‘legitimate interests’ basis – where there’s a minimal privacy impact and we have a compelling reason

4.1 Our basis for using special category data

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in UK data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

5. Collecting this data

We will only collect and use your personal information when the law allows us to, as detailed above in section 4 of this notice. While the majority of information we collect about you is mandatory, there is some information that can be provided voluntarily.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Police forces, courts or tribunals
Other schools or trusts
The Department for Education

6. How we store this data

We keep personal information about you while you are visiting our school. We may also keep it beyond your visit with our school if this is necessary to comply with our legal obligations or to meet our regulatory requirements. Our records management policy sets out how long we keep information about visitors.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your personal data securely when we no longer have a legal requirement to retain it.

7. Who we share data with

We do not share information about you with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with UK data protection law), we may share personal information about you with:

Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns
Government departments or agencies
Department for Education
Our regulator, Ofsted
Suppliers and service providers
Our auditors
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts or tribunals

7.1 Transferring data internationally

Where we transfer your personal data to a third-party country or territory, we will do so in accordance with UK data protection law.

In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

8. Your rights

8.1 How to access personal information that we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will (subject to any exemptions that may apply):

Give you a description of it
Tell you why we are holding it, how we are processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact us (see ‘Contact us’ below).

8.2 Your other rights regarding your data

Under UK data protection law, you have certain rights regarding how your personal data is used and kept safe. For example, you have the right to:

Object to our use of your personal data where it is likely to cause, or is causing, damage or distress
Prevent your data being used to send direct marketing
Object to and challenge the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)
In certain circumstances, have inaccurate personal data corrected
In certain circumstances, have the personal data we hold about you deleted or destroyed, or restrict its processing
Withdraw your consent, where you previously provided it for the collection, processing and transfer of your personal data for a specific purpose
In certain circumstances, be notified of a data breach
Make a complaint to the Information Commissioner’s Office if you feel we have not used your information the right way
Claim compensation for damages caused by a breach of the data protection regulations

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task
Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent

See information on types of lawful basis in section 4 of this privacy notice.

To exercise any of these rights, please contact us (see ‘Contact us’ below).

9. Complaints

We take any complaints about our collection and use of personal information very seriously.

Alternatively, you can make a complaint at any time to the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Contact us

If you have any questions or concerns, or would like more information about anything mentioned in this privacy notice, please contact our data protection officer Stephanie Smith by email to dpo@cromptonhouse.org

Privacy Notice Workforce

Contents

1. Introduction

This privacy notice explains how we collect, store and use personal data about individuals we employ, or otherwise engage to work in our trust.

The trust, Crompton House Multi academy Trust, is the ‘data controller’ for the purposes of UK data protection law.

2. The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:

Your name
Contact details
Date of birth, marital status, gender
Next of kin and emergency contact numbers
Salary, annual leave, pension and benefits information
Bank account details, payroll records, National Insurance number and tax status information
Recruitment information, including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process
Qualifications and employment records, including work history, job titles, working hours, training records and professional memberships
Performance information
Outcomes of any disciplinary and/or grievance procedures
Information relating to health and safety (including accident and incident details)
Absence data
Copy of driving licence
Information about your use of our information and communication systems, equipment and facilities (e.g. school computers)

We may also collect, use, store and share (when appropriate) information about you that falls into ‘special categories’ of more sensitive personal data. This includes, but is not restricted to:

Information about any health conditions you have that we need to be aware of
Photographs and CCTV images captured in school/on site
Information about trade union membership
Biometric data (for catering payment systems)

We may also collect, use, store and share (when appropriate) information about criminal convictions and offences.

We may also hold data about you that we have received from other organisations, including other schools and social services, and the Disclosure and Barring Service in respect of criminal offence data.

3. Why we use this data

We collect and use the data listed above to:

Enable you to be paid
Check you are legally entitled to work in the UK
Determine the terms on which you work for us
Facilitate safe recruitment, as part of our safeguarding obligations towards pupils
Support effective performance management
Inform our recruitment and retention policies
Allow better financial modelling and planning
Enable equalities monitoring
Improve the management of workforce data across the sector
Support the work of the School Teachers’ Review Body
Make sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely
Ascertaining your fitness to work
Managing sickness absence
enable you to take part in appropriate training and professional development

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

3.1 Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information by email or text promoting school events, campaigns, charitable causes or services that may be of interest to you.

3.2 Use of your personal data for filtering and monitoring purposes

While you’re in any of our trust’s schools, we may monitor your use of our information and communication systems, equipment and facilities (e.g. school computers). We do this so that we can:

Comply with health and safety and other legal obligations
Comply with our policies (e.g. child protection policy, IT acceptable use policy) and our legal obligations
Keep our network(s) and devices safe from unauthorised access, and prevent malicious software from harming our network(s)
Protect your welfare

4. Our lawful basis for using this data

Under Article 6 of the UK General Data Protection Regulation (UK GDPR) our lawful bases for processing your personal data for the purposes listed in section 3 above are as follows:

For the purposes of assessment records, meetings with parents/carers, in accordance with the ‘public task’ basis – we need to process data to fulfil our statutory function as a trust
For the purposes of safeguarding, salary information for tax purposes, in accordance with the ‘legal obligation’ basis – we need to process data to meet our responsibilities under law
For the purposes of facilitating payment for school meals, in accordance with the ‘consent’ basis – we will obtain consent from you to use your personal data
For the purposes of medical emergencies, in accordance with the ‘vital interests’ basis – we will use this personal data in a life-or-death situation
For the purposes of employment and annual leave records, in accordance with the ‘contract’ basis – we need to process personal data to fulfil a contract with you or to help you enter into a contract with us
For the purposes of CCTV, making sure our information and communication systems, equipment and facilities (e.g. school computers) are used appropriately, legally and safely, in accordance with the ‘legitimate interests’ basis – where there’s a minimal privacy impact and we have a compelling reason

4.1 Our basis for using special category data

For ‘special category’ data, we only collect and use it when we have both a lawful basis, as set out above, and one of the following conditions for processing as set out in Article 9 of UK data protection law:

We have obtained your explicit consent to use your personal data in a certain way
We need to perform or exercise an obligation or right in relation to employment, social security or social protection law
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for the establishment, exercise or defence of legal claims
We need to process it for reasons of substantial public interest as defined in legislation
We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law
We need to process it for public health reasons, and the processing is done by, or under the direction of, a health professional or by any other person obliged to confidentiality under law
We need to process it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the processing is in the public interest

For criminal offence data, we will only collect and use it when we have both a lawful basis, as set out above, and a condition for processing as set out in UK data protection law. Conditions include:

We have obtained your consent to use it in a specific way
We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent
The data concerned has already been made manifestly public by you
We need to process it for, or in connection with, legal proceedings, to obtain legal advice, or for the establishment, exercise or defence of legal rights
We need to process it for reasons of substantial public interest as defined in legislation

5. Collecting this data

While the majority of information we collect about you is mandatory, there is some information that can be provided voluntarily.

Most of the data we hold about you will come from you, but we may also hold data about you from:

Local authorities
Government departments or agencies
Police forces, courts or tribunals
The Department for Education

6. How we store this data

We keep personal information about you while you work in our trust. We may also keep it beyond your employment in our trust if this is necessary to comply with our legal requirements or to meet our regulatory requirements. Our records management policy sets out how long we keep information about staff and is available on request.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We will dispose of your personal data securely when we no longer have a legal requirement to retain it.

7. Who we share data with

We do not share information about you with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with UK data protection law), we may share personal information about you with:

Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns
Government departments or agencies
The Department for Education
Our regulator, Ofsted
Suppliers and service providers
Financial organisations
Our auditors
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts or tribunals

7.1 Transferring data internationally

Where we transfer your personal data to a third-party country or territory, we will do so in accordance with UK data protection law.

In cases where we have to set up safeguarding arrangements to complete this transfer, you can get a copy of these arrangements by contacting us.

8. Your rights

8.1 How to access personal information that we hold about you

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you.

If you make a subject access request, and if we do hold information about you, we will:

Give you a description of it
Tell you why we are holding it, how we are processing it, and how long we will keep it for
Explain where we got it from, if not from you
Tell you who it has been, or will be, shared with
Let you know whether any automated decision-making is being applied to the data, and any consequences of this
Give you a copy of the information in an intelligible form

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact us (see ‘Contact us’ below).

8.2 Your other rights regarding your data

Under data protection law, you have certain rights regarding how your personal data is used and kept safe. For example, you have the right to:

Object to our use of your personal data where it is likely to cause, or is causing damage or distress
Prevent your data being used to send direct marketing
Object to and challenge the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than by a person)
In certain circumstances, have inaccurate personal data corrected
In certain circumstances, have the personal data we hold about you deleted or destroyed, or restrict its processing
Withdraw your consent, where you previously provided it for the collection, processing and transfer of your personal data for a specific purpose
In certain circumstances, be notified of a data breach
Make a complaint to the Information Commissioner’s Office if you feel we have not used your information in the right way
Claim compensation for damages caused by a breach of the data protection regulations

We may refuse your information rights request for legitimate reasons, which depend on why we’re processing it. Some rights may not apply in these circumstances:

Your right to have all personal data deleted or destroyed doesn’t apply when the lawful basis for processing is legal obligation or public task
Your right to receive a copy of your personal data, or have your personal data transmitted to another controller, does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
Right to object to use of your private data doesn’t apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent

See information on types of lawful basis in section 4 of this privacy notice.

To exercise any of these rights, please contact us (see ‘Contact us’ below).

9. Complaints

We take any complaints about our collection and use of personal information very seriously.

You can make a complaint to us at any time by contacting Stephanie Smith, our Data Protection Officer by email to dpo@cromptonhouse.org

Alternatively, you can make a complaint at any time to the Information Commissioner’s Office:

Report a concern online at https://ico.org.uk/make-a-complaint/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Contact us

Contact

If you would like to discuss anything about this Privacy Notice, please contact the school’s Data Protection Officer on 01706 847451 or dpo@cromptonhouse.org

Cookie	Duration	Description
cookielawinfo-checkbox-advertisement	1 year	Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category .
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
elementor	never	This cookie is used by the website's WordPress theme. It allows the website owner to implement or change the website's content in real-time.
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Cookie	Duration	Description
_ga	2 years	The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors.
_gat_gtag_UA_179223744_1	1 minute	This cookie is set by Google and is used to distinguish users.
_gid	1 day	Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously.
CONSENT	16 years 3 months 24 days 11 hours 13 minutes	These cookies are set via embedded youtube-videos. They register anonymous statistical data on for example how many times the video is displayed and what settings are used for playback.No sensitive data is collected unless you log in to your google account, in that case your choices are linked with your account, for example if you click “like” on a video.

Cookie	Duration	Description
IDE	1 year 24 days	Google DoubleClick IDE cookies are used to store information about how the user uses the website to present them with relevant ads and according to the user profile.
test_cookie	15 minutes	The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies.
VISITOR_INFO1_LIVE	5 months 27 days	A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface.
YSC	session	YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages.
yt-remote-connected-devices	never	These cookies are set via embedded youtube-videos.
yt-remote-device-id	never	These cookies are set via embedded youtube-videos.
yt.innertube::nextId	never	These cookies are set via embedded youtube-videos.
yt.innertube::requests	never	These cookies are set via embedded youtube-videos.

Cookie	Duration	Description
_gat_stryver	1 minute	No description
MSP_ID	session	No description
MSP_TOKEN	session	No description
new_install_prompt_seen	1 month	No description