Privacy Policy

Why we collect and use this information

Heart of Mercia Multi Academy Trust are the ‘data controller’ for the purposes of data protection law.
We collect and use personal data in order to meet legal requirements and legitimate interests set out in the GDPR and UK law, including those in relation to the following:

• Article 6 and Article 9 of the GDPR
• Education Act 1996
• Regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.

In accordance with the above, the personal data of pupils and their families is collected and used for the following reasons:

• to support pupil learning
• to monitor and report on pupil progress
• to provide appropriate pastoral care
• to assess the quality of our services
• to comply with the law regarding data sharing
• to safeguard students
• support a Young Person in their transition to a Post-16 Provider of Education or Training.

The categories of pupil information that we collect, hold and share include:

• Personal identifiers (such as name, unique pupil number and contact details)
• Characteristics (such as ethnicity, language and free school meal eligibility)
• Attendance information (such as sessions attended, number of absences and absence reasons)
• Assessment information
• Relevant medical information
• Special Educational Needs and Disability
• Behaviour and exclusions
• Education/school history
• Safeguarding information
• Details of any support received, including care packages, plans and support providers
• Photographs
• CCTV images captured in school

Collecting pupil information

Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.

Storing pupil information

Personal data relating to pupils at The Chantry School and their families, is stored in line with the Trust’s GDPR Data Protection Policy, which can be viewed on our school website.
Who we share pupil information with

We routinely share pupil information with:

• schools that the pupil’s attend after leaving us
• our local authority
• the Department for Education (DfE)

In accordance with Data Protection Law, The Trust / Chantry School enlists the support of companies to act as data processors. This information is processed on our behalf to enable us to support your needs more effectively. These companies enable us to provide services to our pupils, parents and staff to support the efficient functioning of the school. Such companies include, Arbor, Sisra and Cunninghams (Cashless catering system). This list is not an exhaustive list of all data processors used by The Chantry School. Decisions on whether to release this data are subject to a robust approval process and contractual assurances that personal data will be kept securely and only in accordance with the school’s specific directions.

Why we share pupil information

We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so. We are required by law to provide information about pupils to the Department for Education as part of statutory data collections such as the school census. This data sharing underpins school funding and educational attainment policy and monitoring. We are required by law to share information about our pupils with the (DfE) under regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.

The National Pupil Database (NPD)

Some of this information is then stored in the National Pupil Database (NPD), which is owned and managed by the Department and provides evidence on school performance to inform research.

The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.
The Department for Education may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information
For more information about the Department’s NPD data sharing process, please visit:
https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information on which third party organisations (and for which project) pupil level data has been provided to, please visit: https://www.gov.uk/government/publications/dfe-external-data-shares

If you need more information about how our local authority collect and use your information, please visit:
Our local authority at https://www.worcestershire.gov.uk/ and search for privacy notice.

Youth support services

Once our pupils reach the age of 13, the law requires us to pass on certain information to our local authority and/or the youth support services provider as they have legal responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This information enables them to provide youth support services, post-16 education and training services, and careers advisers.

We provide them with these pupils’ names and addresses, dates of birth, name(s)/address(es) of their parent(s)/carer and any other information relevant to their role. We may also share certain personal data relating to children aged 16 and over with post-16 education and training providers in order to secure appropriate services for them
However, a parent/carer can ask that no information beyond names, addresses and date of birth be passed to the youth support service by informing Mrs L Webster. This right is transferred to the child once he/she reaches age 16. For more information about services for young people, please go to our local authority website https://www.worcestershire.gov.uk/.

For more information about young people’s services, please go to the National Careers Service page at https://nationalcareersservice.direct.gov.uk/aboutus/Pages/default.aspx

Parents and pupils’ rights regarding personal data

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold.

Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.
Parents also have the right to make a subject access request with respect to any personal data the school holds about them.

If you would like to make a request please visit the Trust website: https://heartofmercia.org.uk/about-us/dataprotection/