Ipswich School Privacy Notice

The Ipswich School Privacy Policy has been updated in line with the new GDPR regulations. You can read it here.

The full policy is also available below:

IPSWICH SCHOOL'S PRIVACY NOTICE 

Applicable to all members of the School community (past and present)

"Data Subjects" means any living individuals whose data the Data Controller processes.

"Processing" means any action in relation to that personal data, including filing and communication.

"Personal Data" includes everything from which a Data Subject can be identified. It ranges from simple contact details via personnel or pupil files to safeguarding information, and encompasses opinions, file notes or minutes, a record of anyone's intentions towards that person, and communications (such as emails) with or about them.

Some categories of Personal Data are "special category data" under the GDPR (broadly equivalent to "sensitive" personal data under the old law, but with criminal data treated separately). These comprise of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; data concerning health or data concerning a natural person’s sex life or sexual orientation; and biometric data. Extra safeguards are provided by law for processing of such data.

IPSWICH SCHOOL PRIVACY NOTICE

We, Ipswich School, are a data controller for the purposes of the Data Protection Act. We collect information from you and may receive information about you from your previous school, employer and other information.

WHAT THIS PRIVACY NOTICE IS FOR

This policy is intended to provide information about how the School will use (or "process") personal data about individuals including: its staff; its current, past and prospective pupils; and their parents, carers or guardians (referred to in this policy as "parents").

This information is provided because Data Protection Law gives individuals rights to understand how their data is used. Staff, parents and pupils are all encouraged to read this Privacy Notice and understand the School’s obligations to its entire community.

This Privacy Notice applies alongside any other information the School may provide about a particular use of personal data, for example when collecting data via an online or paper form.

This Privacy Notice also applies in addition to the School's other relevant terms and conditions and policies, including:

• any contract between the School and its staff or the parents of pupils;

• the School's policy on taking, storing and using images of children;

• the School’s CCTV;

• the School’s retention of records policy;

• the School's safeguarding, pastoral, or health and safety policies, including as to how concerns or incidents are recorded;

• the School's Acceptable Use and Online Safety Policy

Anyone who works for, or acts on behalf of, the School (including staff, volunteers, governors and service providers) should also be aware of and comply with this Privacy Notice, the School's data protection policy, which also provides further information about how personal data about those individuals will be used.

RESPONSIBILITY FOR DATA PROTECTION

The School has appointed a Health, Safety and Compliance Officer, who will deal with all your requests and enquiries concerning the School’s uses of your personal data and endeavour to ensure that all personal data is processed in compliance with this policy and Data Protection Act. This person can be contacted at gdpr@ipswich.school.

HOW AND WHY DOES THE SCHOOL COLLECT AND USE PERSONAL INFORMATION?

We set out below examples of the different ways in which we use personal information and where this personal information comes from. The School's primary reason for using your personal information is to provide educational services to your child.

- We obtain information about you from admissions forms and from your child's previous School. We may also get information from professionals such as doctors and from local authorities.

- We may have information about any family circumstances which might affect your child's welfare or happiness.

- We may need information about any court orders or criminal petitions which relate to you. This is so that we can safeguard the welfare and wellbeing of your child and the other pupils at the School. 

- We use CCTV to make sure the School site is safe. CCTV is not used in private areas such as toilets.  

- We may take photographs or videos of you at School events to use on social media and on the School website. This is to show prospective parents and pupils what we do here and to advertise the School. We may continue to use these photographs and videos after your child has left the School. 

- We may send you information to keep you up to date with what is happening at the School. For example, by sending you information about events and activities taking place (including fundraising events) and the School newsletter, i.e. The Occasional. 

- We may keep details of your address when your child leaves the School so we can send you information and find out how your child is progressing. We may also pass your details onto the alumni organisation, known as the Old Ipswichian Club. Further information on the alumni association can be found here: www.ipswich.school/old-ipswichians 

- We may use information about you if we need this for historical research purposes or for statistical purposes.

FINANCIAL INFORMATION

We will process financial information about you in relation to the payment of fees. In some cases we get information about you from third parties such as credit reference agencies or from your child's previous School(s).

We may hold information about bankruptcy petitions and statutory demands.

We may search the files of any licensed credit reference agency in order to verify your identity. This also allows us to assess your application for the award of a bursary or for credit in contemplation of an agreement for the deferment of fees. This record will be seen by other organisations which make searches about you.

Failure to supply information may result in a refusal of an award or credit.

SHARING PERSONAL INFORMATION WITH THIRD PARTIES

In accordance with our legal obligations, we may share information with local authorities, the Independent Schools Inspectorate and the Department for Education, for example, where we have any safeguarding concerns.

On occasion, we may need to share information with the police.

We may also need to share information with our legal advisers for the purpose of obtaining legal advice. Occasionally we may use consultants, experts and other advisors to assist the School in fulfilling its obligations and to help run the School properly. We might need to share your information with them if this is relevant to their work.

If your child is not of British nationality we have to make sure that your child has the right to study in the UK. We might have to provide information about you to UK Visas and Immigration to comply with our duties as a Tier 4 sponsor.

We may share some information with our insurance company, for example, where there is a serious incident at the School.

If you have unpaid fees while your child is at the School we may share information about this with other Schools or educational establishments to which you intend to send your child.

If your child leaves us to attend another School we may need to provide that School with information about you. For example, details of family circumstances for safeguarding reasons.

We may share information about you with others in your family, such as another parent or stepparent. For example, where this is part of our obligation to take care of your child, as part of our wider legal and regulatory obligations, or in connection with School fees.

OUR LEGAL GROUNDS FOR USING YOUR INFORMATION

This section contains information about the legal basis that we are relying on when handling your information.

Legitimate interests

This means that the processing is necessary for legitimate interests except where the processing is unfair to you. The School relies on legitimate interests for most of the ways in which it uses your information.

Specifically, the School has a legitimate interest in:

- Providing educational services to your child;  

- Safeguarding and promoting the welfare of your child (and other children);  

- Promoting the objects and interests of the School. This includes fundraising. It also includes making sure that we are able to enforce our rights against you, for example, so that we can contact you if unpaid School fees are due; 

- Facilitating the efficient operation of the School; and  

- Ensuring that all relevant legal obligations of the School are complied with.

In addition your personal information may be processed for the legitimate interests of others. For example another School will have a legitimate interest in knowing if you have not paid School fees that are due to us. If you object to us using your information where we are relying on our legitimate interests as explained above please email gdpr@ipswich.school

Necessary for a contract

We will need to use your information in order to perform our obligations under our contract with you. For example, we need your name and contact details so that we can update you on your child's progress and so that we can contact you if there is a concern.

Legal obligation

Where the School needs to use your information in order to comply with a legal obligation, for example to report a concern to Children's Services. We may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so.

Vital interests

For example, to prevent someone from being seriously harmed or killed.

Public interest

The School considers that it is acting in the public interest when providing education.

The School must also comply with an additional condition where it processes special categories of personal information. These special categories are as follows:

- personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership,  

- Genetic information, biometric information, health information, and information about sex life or orientation.

Medical purposes

This includes medical treatment and the management of healthcare services.

We may ask for your consent to use your information in certain ways. If we ask for your consent to use your personal information you can withdraw this consent at any time.

Any use of your information before you withdraw your consent remains valid. Please email gdpr@ipswich.school if you would like to withdraw any consent given.

SENDING INFORMATION TO OTHER COUNTRIES

We may send your information to other countries where:

- We communicate with you or your child when you are overseas (for example, during School holidays, or if you live in a different country). 

- The European Commission has produced a list of countries which have adequate data protection rules. The list can be found here: http://ec.europa.eu/justice/data-protection/internationaltransfers/adequacy/index_en.htm 

- If the country that we are sending your information to is not on the list or, is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland) then it might not have the same level of protection for personal information as there is the UK.

HOW LONG WE KEEP PERSONAL DATA

The School will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason. Typically, the legal recommendation for how long to keep ordinary staff and pupil personnel files is up to 7 years following departure from the School.

However, incident reports and safeguarding files will need to be kept much longer, in accordance with specific legal requirements.

If you have any specific queries about how our retention policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact gdpr@ipswich.school.

However, please bear in mind that the School will often have lawful and necessary reasons to hold on to some personal data even following such request.

A limited and reasonable amount of information will be kept for archiving purposes, for example; and even where you have requested we no longer keep in touch with you, we will need to keep a record of the fact in order to fulfil your wishes (called a "suppression record").

KEEPING IN TOUCH AND SUPPORTING THE SCHOOL

The School will use the contact details of parents, alumni and other members of the School community to keep them updated about the activities of the School, or alumni and parent events of interest, including by sending updates and newsletters, by email and by post.

The School has a legitimate interest to also:

- Share personal data about parents and/or alumni, as appropriate, with organisations set up to help establish and maintain relationships with the School community, such as the FOIS, ISSC, ISE; 

- Contact parents and/or alumni by post and email in order to promote and raise funds for the School and, where appropriate, other worthy causes;

Should you wish to limit or object to any such use, or would like further information about them, please contact gdpr@ipswich.school.

You always have the right to withdraw consent, where given, or otherwise object to direct marketing or fundraising. However, the School is nonetheless likely to retain some of your details (not least to ensure that no more communications are sent to that particular address, email or telephone number).

YOUR RIGHTS

Rights of access, Individuals have various rights under Data Protection Law to access and understand personal data about them held by the School, and in some cases ask for it to be erased or amended or have it transferred to others, or for the School to stop processing it – but subject to certain exemptions and limitations.

Any individual wishing to access or amend their personal data, or wishing it to be transferred to another person or organisation, or who has some other objection to how their personal data is used, should put their request in writing to gdpr@ipswich.school.

The School will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time-limits (which is 30 calendar days in the case of requests for access to information).

The School will be better able to respond quickly to smaller, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, the School may ask you to reconsider.

Requests that cannot be fulfilled

You should be aware that the right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information which identifies other individuals (and parents need to be aware this may include their own children, in certain limited situations, or information which is subject to legal privilege (for example legal advice given to or sought by the School, or documents prepared in connection with a legal action).

The School is also not required to disclose any pupil examination scripts (or other information consisting solely of pupil test answers), provide examination or other test marks ahead of any ordinary publication, nor share any confidential reference given by the School itself for the purposes of the education, training or employment of any individual.

You may have heard of the "right to be forgotten". However, we will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing your (or your child's) personal data: for example, a legal requirement, or where it falls within a legitimate interest identified in this Privacy Notice. All such requests will be considered on their own merits.

Pupil requests

Pupils can make subject access requests for their own personal data, provided that, in the reasonable opinion of the School, they have sufficient maturity to understand the request they are making. A pupil of any age may ask a parent or other representative to make a subject access request on his/her behalf.

Parental requests

It should be clearly understood that the rules on subject access are not the sole basis on which information requests are handled. Parents may not have a statutory right to information, but they and others will often have a legitimate interest or expectation in receiving certain information about pupils without their consent. The School may consider there are lawful grounds for sharing with or without reference to that pupil.

Parents will in general receive educational and pastoral updates about their children, in accordance with the Parent Contract. Where parents are separated, the School will, in most cases, aim to provide the same information to each person with parental responsibility, but may need to factor in all the circumstances including the express wishes of the child.

Consent

Where the School is relying on consent as a means to process personal data, any person may withdraw this consent at any time (subject to similar age considerations as above).

Examples where we do rely on consent are for example:

- Use of images;  

- Consent for pupil being driven in a School vehicle;  

- Consent to reimburse the School for any medical expenses;

Please note this list is not exhaustive.

Please be aware however that the School may not be relying on consent but have another lawful reason to process the personal data in question even without your consent.

That reason will usually have been asserted under this Privacy Notice, or may otherwise exist under some form of contract or agreement with the individual (e.g. an employment or parent contract, or because a purchase of goods, services or membership of an organisation such as an alumni or parents' association has been requested).

Whose rights?

The rights under Data Protection Law belong to the individual to whom the data relates. However, the School will often rely on parental authority or notice for the necessary ways it processes personal data relating to pupils – for example, under the parent contract, or via a form. Parents and pupils should be aware that this is not necessarily the same as the School relying on strict consent. Where consent is required, it may in some cases be necessary or appropriate – given the nature of the processing in question, and the pupil's age and understanding – to seek the pupil's consent.

In general, the School will assume that pupils’ consent is not required for ordinary disclosure of their personal data to their parents, e.g. for the purposes of keeping parents informed about the pupil's activities, progress and behaviour, and in the interests of the pupil's welfare. That is unless, in the School's opinion, there is a good reason to do otherwise.

Pupils are required to respect the personal data and privacy of others, and to comply with the School's acceptable use policy and the School rules.

DATA ACCURACY AND SECURITY

The School will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must please notify the gdpr@ipswich.school of any significant changes to important information, such as contact details, medical details, held about them.

An individual has the right to request that any out-of-date, irrelevant or inaccurate or information about them is erased or corrected (subject to certain exemptions and limitations under Data Protection Act).

The School will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to School systems. All staff and governors will be made aware of this policy and their duties under Data Protection Law and receive relevant training.

THIS POLICY

The School will update this Privacy Notice as required. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.

QUERIES AND COMPLAINTS

Any comments or queries on this policy should be directed to gdpr@ipswich.school.

If an individual believes that the School has not complied with this policy or acted otherwise than in accordance with Data Protection Law, they should utilise the School complaints / grievance procedure and should also notify the Headmaster.

You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with the School before involving the regulator: https://ico.org.uk

25 May 2018