Privacy Notice

How we use personal information relating to our pupils

This Privacy Notice is to let you know how we as an educational setting look after personal information about our pupils. This includes the information you provide us as well as information we hold about our pupils relating to their education. This notice explains the reasons why we hold personal information, how we use this information, who we share it with and how we keep it secure. This notice meets with the requirements of the UK General Data Protection Regulations (UK GDPR).

A copy of this Privacy Notice is available on our website https://www.willownursery.co.uk/. Please refer to the website copy of this Privacy Notice for the latest version as it will be updated from time to time to reflect any changes in legislation and/or our circumstances.

If you have any questions or queries or would like to discuss anything in this Privacy Notice, please contact the school’s Data Protection Lead : Trina Evans School Manager 01582662600

How we collect pupil information

Pupil data is essential for our school’s operational use. We obtain pupil information for the start of each academic year through our ‘new pupil’ registration forms. We also collect any changes to pupil information through update forms during the academic year as part of our data administration process to keep the information we hold as up-to-date as possible. We also collect information through secure common file transfers (CTFs) which contain relevant information (e.g. name, date of birth, attendance details) about our new pupils from their previous schools.
Whilst the majority of pupil information you provide us is mandatory, some of it is requested on a voluntary basis. In order to comply with the data protection legislation, we will inform you at the point of collection whether you are required to provide certain pupil information to us or you have a choice in this.

We collect and hold pupil information that includes:

Personal information (identifiers) about the pupils that come to our school such as name, unique pupil number and address, date of birth
Characteristics such as home language, meal arrangements and eligibility
Special educational needs (including needs and ranking)
Information that is categorised as special data such as gender, ethnicity, religion and medical information
Contact information such as parental and other contact names and telephone numbers
Safeguarding information such as court orders, professional involvement and contact with non-resident parents
Medical information such as GP surgery details, child health, allergies, medication and dietary requirements
Sibling information
History of previous schools or nurseries attended
Information about your child’s country of birth and nationality

In addition to the information we collect from parents/carers, we also record and hold the following information:

Attendance information such as sessions attended, number of absences and absence reasons and any previous schools attended
Assessment information recorded at various assessment capture points during the academic year as well as end of year attainment information such as Phonics outcomes and end of Key Stage results as well as Early Years Foundation Stage outcomes and Reception Baseline Assessments
Behavioural information and where relevant, lunch time or other suspensions and permanent exclusions and any relevant alternative provision put in place
Information about your child’s proficiency in speaking the English language

Why we collect and use this information

We use the pupil information to:

support pupil learning
keep children safe whilst in our care (safeguarding)
record attendance
monitor and report on pupil attainment and progress
provide appropriate pastoral care
assess the quality of our services
comply with the law regarding data returns and sharing
provide any additional support
analyse the make-up of our cohorts of children to determine changes in nationality over time
identify support needed to help children develop English speaking skills

We use parent/carer contact information to:

email parent/carers for purpose of notification of school events, share pupil school work and various reports relating to the pupil’s life at the school
telephone parents/carers in cases of emergency or other matters relating to the safety of the child

The lawful basis on which we hold and use this information

We collect and use pupil information under the legal basis of public interest as an educational setting/school with the delegated task of educating and safeguarding the children in our care and under a legal obligation which necessitates our school making statutory data returns to the Department for Education (DfE) and our Local Authority in accordance with items c) and e) as described in Article 6, UK GDPR:

c) processing is necessary for compliance with a legal obligation to which the controller is subject;
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

The data we collect relating to medical health information is necessary to protect the vital interests of the child so that we can ensure a child’s medical needs are properly addressed and catered for.

We also acknowledge that some of the data items collected are deemed as Special Category Personal Data and that item g) processing is necessary for reasons of substantial public interest as described in Article 9, UK GDPR, is the condition under which our school collects and processes the following:

ethnic origin data (as part of school census)
religious belief (as part of holiday planning and/or where formal links with faith-based organisations)
health (i.e. medical data which may include allergies or other medical conditions and associated medical procedure)
biometric data for identification (where IT, security or catering system requires it)

We also apply similar processing safeguards to other data we hold which, although not specifically identified under GDPR, we treat as sensitive:

photographs
family situation (including social services or local authority involvement)
safeguarding information
learning information (such as behaviour and special education needs)
financial and funding information (including pupil premium).

As a Parent/carer, you cannot decline a data collection but you have right to decline providing information for self-declared data items by selecting the ‘Refused’ option e.g. ethnicity.

Legislation

Our school is obliged to make statutory pupil census returns and hold attendance information under the following legislation:
Education Acts 1996 and 2002
Education (Information about Pupils)(England) Regulations 2013

School Attendance (Pupil Registration) (England) Regulations 2024

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

Data collected under consent

Whilst the majority of pupil information you provide to us is mandatory (under the lawful basis described above), there may be some additional information we may ask for on a voluntary basis to support an educational or safeguarding function or where a data item collected is to be used for an additional purpose that extends beyond the lawful bases of legal obligation or public interest; (for example, photographs for our school’s website or sharing a contact email address with a third-party software the school has a contract with).

Any voluntary Information asked for will be carefully considered and processed in accordance with items a) and b) as described in Article 6, UK GDPR:

a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

For all voluntary data or changes to purpose, we will ask you for your explicit consent. As a parent/carer you can change your decision to grant or withdraw consent at any time for any of the data items collected under consent. If you are unhappy with our use of your personal data, please let us know by contacting our Data Protection Lead at Trina Evans School Manager office@willownursery.co.uk

Who we share pupil information with

We routinely share pupil information with:

the school that a pupil attends after leaving us
our local authority
the Department for Education (DfE)
the Standards Testing Agency

The majority of our pupil information is processed in our main Management Information System (MIS).

We actively ensure that all of the third-party software organisations we share data with comply with the UK GDPR through their Privacy Notices and/or Data Sharing Agreements that they share with us.

Why we share pupil information with external parties

We do not share information about our pupils with anyone without consent unless the legal basis for holding and sharing the data allow us to do so.

We share pupil data with the Department for Education (DfE) and the Local Authority on a statutory basis through data collections such as the school census under the following statutes:

Section 573A & s29(3) of the Education Act 1996
Education (School Performance Information) (England) Regulations 2007
Regulations 5 & 8 School Information (England) Regulations 2008
School Attendance (Pupil Registration) (England) Regulations 2024

Further information about the data collection requirements placed on our school by the DfE through the school census can be found at https://www.gov.uk/education/data-collection-and-censuses-for-schools

The data shared with the DfE and the local Authority is for the purpose of:

determining school funding which is calculated based upon the numbers of children and their characteristics in our school
informing the monitoring of ‘short term’ education policy such as Pupil Progress measures
supporting the ‘longer term’ research and monitoring of educational policy

All data transferred to the DfE is managed securely and is held by the DfE under a combination of hardware and software controls which meet the current government security policy framework.

For privacy information on the data the DfE collects and uses, please see: https://www.gov.uk/government/publications/privacy-information-early-years-foundation-stage-to-key-stage-3

and

https://www.gov.uk/government/publications/privacy-information-key-stage-4-and-5-and-adult-education

Most of the pupil data we share with the DfE is held within their National Pupil Database (NPD). Please refer to the Department of Education (DfE) section at the end of this Privacy Notice.

Our Local Authority’s Privacy Notice relating to early years pupil information can be found at http://www.centralbedfordshire.gov.uk/school/professionals/two-year-old-funding/privacy.aspx and Data Sharing Agreement with schools can be found at
https://www.centralbedfordshire.gov.uk/info/102/performance_hub/574/data_and_information

How we keep personal data secure

We fully adhere to our Data Protection policies which outline our procedures and processes for accessing, handling and storing data safely in accordance with all the GDPR principles. These policies are regularly reviewed and ratified by our governors. The following processes ensure that we comply with data protection legislation in how we manage the protection of personal data:

Our networks, file systems and server operating systems are secured through firewalls and spyware/ virus detection programs on our servers to prevent unauthorised access to our data
Data held in a physical location within the school is held securely and only accessible by staff with appropriate authorisation
Access to data on systems is through individual passwords which are carefully managed and monitored
Any data that is removed from the school is minimised and encrypted
Older data is safely removed from computers and other devices
Data shared with the DfE and the Local Authority is shared through secure file transfer systems. Any data shared with other legitimate third parties where there is a legal basis for sharing will only be shared through secure methods.
Data shared with third party software suppliers is controlled by the school. We will only deal with suppliers who can demonstrate that they comply with the requirements of data protection legislation and not use personal data for any other purpose than the purpose for fulfilling the functions we have contracted with them (e.g. assessment, school meals).
We ensure all staff receive regular training on data protection

We also adhere to our Data Breach Procedures Policy in the event of a data breach. These procedures explain how our school responds to occurrences of known or reported data breaches. A copy of this policy is available on our school website at https://www.willownursery.co.uk/.

Requesting access to your personal data

Under the UK-GDPR data protection regulations, you as the parent/carer and pupils (from age 13) have the following rights:

Right to be informed about the collection and use of your personal data
Right to access to your child’s or your personal information – ask for copies of your personal information we hold by following the Subject Access Request process (see below)
Right to have inaccurate or incomplete personal data rectified, blocked, erased or destroyed in certain circumstances
Right to object to processing of personal data (or stop using your information) in certain circumstances
Right to restrict processing for the purpose of direct marketing
Right to data portability or sharing with other parties
Right to object to decisions being taken by automated means
Right to claim compensation for damages caused by a breach of the Data Protection regulations
Right to complain to the Information Commissioner if you feel we have not used your information in the right way (see Reporting concerns about our data protection processes below)

It should be noted that some of these rights will not apply in circumstances where allowing them would significantly reduce or prevent our ability to perform our duties as a school and safeguard the children in our care. There are legitimate reasons why we may refuse your information rights request depending on the reasons why we are processing it (e.g. right to erasure does not apply when the lawful basis for processing relates to a legal obligation and/or public task).

Subject Access Request (SAR) – You do have the right to request access to personal information about you and/or your child that we hold. To request access to your personal information or to your child’s educational record, you can make a Subject Access Request (SAR). For further information about this contact Trina Evans School Manager 01582662600

Our school will follow procedures outlined in our Subject Access Request Policy available from our website https://www.willownursery.co.uk/ which follows the guidelines promoted by the data protection regulations.

Please note that whilst we aim to respond to requests within the required time period of one month, we may not be able to honour this time period if we receive requests during school holidays as our school email is <not monitored/infrequently monitored>. We will contact you to acknowledge receipt of your request at our first opportunity and will agree a date with you by which time we can provide the information requested.
Additionally, if the nature of the request is complex, we will aim to reach a mutually agreed alternative time period.

How long we keep personal information
We hold pupil data for the period determined appropriate for the different types of data we hold.
We will keep information for the minimum period necessary in accordance with DfE’s data retention recommendations which take into account legal and safeguarding considerations linked to the types of data held. Our Data Retention Schedule can be found on our website at https://www.willownursery.co.uk/

All information is held securely and will be destroyed as appropriate under secure and confidential conditions.

Let us know of any changes to personal information and emergency contact information

As a matter of course, we will contact you at least once a year to ensure that all the personal information and emergency contact details we have for your child is accurate and up-to-date. We would encourage you very strongly to ensure that any changes to phone numbers in particular are notified to our school office as soon as possible.

Reporting concerns about our data protection processes
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance by contacting Trina Evans School Manager 01582662600. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

Keeping you informed through this Privacy Notice

We aim to keep you informed of any changes to our data collections and data protection obligations through this Privacy Notice – the latest copy will be available on our website at https://www.willownursery.co.uk/

Department for Education (DfE)

How Government uses your data

The pupil data that we lawfully share with the Department for Education (DfE) through data collections:

underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school.
informs ‘short term’ education policy monitoring and school accountability and intervention (for example, school GCSE results or Pupil Progress measures).
supports ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school)

Data collection requirements

To find out more about the data collection requirements placed on us by the Department for Education (DfE) (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools

The National Pupil Database (NPD)
The NPD is owned and managed by the Department for Education (DfE) and contains information about pupils in schools in England. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

The data in the NPD is provided as part of the operation of the education system and is used for research and statistical purposes to improve, and promote, the education and well-being of children in England.

The evidence and data provide DfE, education providers, Parliament and the wider public with a clear picture of how the education and children’s services sectors are working in order to better target, and evaluate, policy interventions to help ensure all children are kept safe from harm and receive the best possible education.

To find out more about the NPD, go to: https://www.gov.uk/government/publications/national-pupil-database-npd-privacy-notice/national-pupil-database-npd-privacy-notice

Sharing data by the DfE
DfE will only share pupils’ personal data where it is lawful, secure and ethical to do so. Where these conditions are met, the law allows the Department for Education (DfE) to share pupils’ personal data with certain third parties, including:

schools and local authorities
researchers
organisations connected with promoting the education or wellbeing of children in England
other government departments and agencies
organisations fighting or identifying crime

For more information about the Department for Education’s (DfE) NPD data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

Organisations fighting or identifying crime may use their legal powers to contact the Department for Education (DfE) to request access to individual level information relevant to detecting that crime.

For information about which organisations the Department for Education (DfE) has provided pupil information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the Police please visit the following website: https://www.gov.uk/government/publications/dfe-external-data-shares

How to find out what personal information the Department for Education (DfE) holds about you
Under the terms of the UK GDPR, you are entitled to ask the Department for Education (DfE):

if they are processing your personal data
for a description of the data they hold about you
the reasons they’re holding it and any recipient it may be disclosed to
for a copy of your personal data and any details of its source

If you want to see the personal data held about you by the Department for Education (DfE), you should make a ‘subject access request’. Further information on how to do this can be found within the Department for Education’s (DfE) personal information charter that is published at the address below:

https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter

https://www.gov.uk/government/publications/requesting-your-personal-information/requesting-your-personal-information#your-rights

To contact the Department for Education (DfE): https://www.gov.uk/contact-dfe

Important GDPR Definitions

Processing is any operation (including collection, recording, organising, storing, altering, using, and transmitting) performed on Personal Data.
Personal Data is any information relating to a natural person (called a Data Subject) who can be (directly or indirectly) identified using that information.
A Data Controller is a person, authority, agency or other body which determines the purposes and the means of Processing.
A Data Processor is a person, authority, agency or other body which undertakes Processing on behalf of a Data Controller.