Oak Hill First School
Privacy Notice
Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. This privacy notice explains how we collect, store, and use personal data about our pupils. We, Oak Hill First School, are the “data controller” for the purposes of data protection law. Our data protection officer is Mr R Morley
- Pupil data
We collect and hold information relating to our pupils, and may also receive information about them from their previous school, local authority, or Department for Education (DfE). This personal data will include:
- Contact details
- National curriculum assessment results
- Attendance information
- Exclusion information
- Personal characteristics (such as ethnic background)
- Photographs
- Special educational needs
- Safeguarding information
- Details of any support received
- Medical information
- Where they go after they leave us
- The lawful basis on which we use this information
We use this personal data to:
- Support our pupils’ learning
- Monitor and report on their progress
- Provide appropriate pastoral care
- Protect pupil welfare
- Carry out research
Most commonly, we process data abiding by Article 6 of the GDPR (2018):
- When we need to comply with a legal obligation
- When we need it to perform an official task in the public interest
Less commonly, we may also process pupils’ personal data in situations where:
- We have obtained consent to use pupils’ personal data
- We need to protect the individual’s vital interests (or someone else’s interests)
Where we have obtained consent to use pupils’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn. Please see 7. Requesting access to personal data for more information.
- Collecting pupil information
The majority of information we collect about pupils is mandatory. Where it’s mandatory, we will explain the possible consequences of not complying. Some information can be provided voluntarily, and you will be informed if we request data on a voluntary basis. Where consent is needed it will be acquired through opt-in forms. Please refer to 7. Requesting access to personal data if you wish to withdraw consent on voluntary data.
- Storing pupil data
Different types of data are subject to different retention periods under our Data Retention Policy.
| Type of data | Retention period | End of life action |
|---|---|---|
| Admission registers | Date of last entry in the book (or file) + 6 years | Retain in the school for 6 years from date of last entry. Transfer to Archives |
| Attendance registers | Date of register + 3 years | Shred/Delete |
| Pupil record cards | Retain for the time which the pupil remains at the school | Shred/Delete |
| Pupil files | Retain for the time which the pupil remains at the school | Shred/Delete |
| Special Educational Needs files, reviews, and Individual Education Plans | DOB of the pupil + 25 years from the review | Shred/Delete |
| Letters authorising absence | Date of absence + 2 years | Shred/Delete |
| Absence books | Current year + 6 years | Shred/Delete |
| SATS records | Current year + 6 years | Shred/Delete |
| Pupils’ work | Current year + 1 year | Review at end of year, otherwise Shred/Delete |
| Statement maintained under the Education Act 1996 – Section 324 | DOB + 30 years | Shred/Delete, unless legal action pending |
| Advice and information to parents regarding educational needs | Closure + 12 years | Shred/Delete, unless legal action pending |
| Accessibility strategy | Closure + 12 years | Shred/Delete, unless legal action pending |
| Children’s SEN files | DOB of pupil + 25 years | Shred/Delete, unless legal action pending |
| Parental permission for school trips - where there has been no major incident | Conclusion of trip | Shred/Delete |
| Parental permission for school trips - where there has been a major incident | DOB of the pupil involved + 25 years | Shred/Delete |
| Accident reports | DOB of pupil + 25 years | Shred/Delete |
| Incident reports | Current year + 20 years | Shred/Delete |
- Who we share pupil information with
Department for Education and Local Authority We are required to share certain information about our pupils to our local authority (LA) and the Department for Education (DfE), under Section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013. For more information about our local authority please visit: www.worcestershire.gov.uk For more information on the data collection requirements placed on us by the Department for Education (for example; via the school census), please visit: www.gov.uk/education/data-collection-and-censuses-for-schools The DfE may share pupil personal data we supply to them with third parties. This will only take place where legislation allows it to do so. Please see 6. The National Pupil Database for further information. Other schools We will share data with schools that our pupils attend after leaving us. School services The school uses third parties and services to support administrative and educational matters:
- Capita SIMS
DOB, address, contact information, personal characteristics, SEND information, medical and dietary information, free school meal eligibility, social services links
- Teachers2Parents
Pupil Names, Parents Details
- InVentry
Pupil’s full names and year groups
- ParentPay
- Address, contact information
- Tucassi
Pupil Names
- MyConcern
Pupil’s full names and year groups
- Evolve
Pupil Names
- 2Simple
Pupil’s Names/DOB/Photographs
- Depth of Learning
Pupil names, SEN, Pupil Premium & Performance Data
- Language Link
Pupil Name
- Phonics Play
Pupil Name
- Bright Minds
Pupil Names, parents details, medical need SEN
- Psychology 1st Ltd
Pupil names, parents details, medical need, SEN & CP Status
- Beacon Centre
Pupil names, parents details, medical need, SEN, CP
- EWO (Trinity High)
Pupil names, SIMS File, Parents details.
- Mercury/E5
Staff Payroll/Supplier Contacts
- HCSS
Staff/School Budgetary Information
- Google Mail
Staff E Mail addresses
- Squirrel Mail
Staff E Mail addresses
- IBS IT Services
School IT infrastructure
- Microsoft Active Directory
Pupil File, File Storage Facility
- Babcock (Traded Services)
Pupil Names, parents details, medical need, SEN
- Worcester Childrens Portal
Staff E Mail Addresses
- Egress
Staff E Mail Addresses
- Worcestershire County Council
Census return
- DfE
Census return
- Governor Hub
Governor Details
- Edubase
Governor Details
- Other Schools (transition/mid term transfers/admissions)
Pupil Files
- Tempest (photography)
Photography, images
- NHS, Karen Green (school nurse)
DOB, address, contact information, medical and dietary information
- Social Services/LADO
Pupil Name, student record, CP Status These organisations are compliant with the GDPR (2018) in their processing and storage of data. Other legal requirements Where it is legally required, or necessary, we may share personal information about pupils with:
- The pupil’s family and representatives
- Educators and examining bodies
- Our regulator
- Our auditors
- Financial organisations
- Survey and research organisations
- Health authorities
- Security organisations
- Health and social welfare organisations
- Professional advisors and consultants
- Charities and voluntary organisations
- Police forces, courts, and tribunals
- Professional bodies
Personal data will only be shared where it complies with data protection law.
- The National Pupil Database
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities, and awarding bodies. We are required, by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013. For more information about the NPD, please visit: www.gov.uk/government/publications/national-pupil-database-user-guide-and-supp orting-information The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
- Conducting research or analysis
- Producing statistics
- Providing information, advice, or guidance
The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether the DfE releases this data to third parties are subject to a strict approval process and based on a detailed assessment of:
- Who is requesting the data
- The purpose for which it is required
- The level and sensitivity of data requested
- The arrangements in place to store and handle the data
To be granted access to pupil level data, requestors must comply with strict terms and conditions covering the confidentiality and handling of data, security arrangements, and retention and use of data. For more information about the Department’s data sharing process, please visit: www.gov.uk/data-protection-how-we-collect-and-share-research-data For more information about which organisations the Department has provided pupil information (and for which project), please visit: www.gov.uk/government/publications/dfe-external-data-shares To contact the Department for Education, please visit: www.gov.uk/contact-dfe
- Requesting access to personal data
Under data protection law, parents and pupils have the right to request access to information about them that we hold. This is known as a subject access request. To make a request for your personal information, or be given access to your child’s educational record, please contact the school in writing, either as:
- An email to This email address is being protected from spambots. You need JavaScript enabled to view it.
- A letter handed in to the school office
- A completed subject access request form (available to download, or paper copy from the school office)
Requests should include:
- The subject’s name
- A correspondence address
- A contact number and email address
- Details about the information being requested
You also have the right to:
- Withdraw previous voluntary consent
- Object to processing of personal data that is likely to cause, or is causing, damage or distress
- Prevent personal data being used to send direct marketing
- Have inaccurate personal data rectified, blocked, erased, or destroyed
- Claim compensation for damages caused by a breach of the data protection regulations
The school will:
- Aim to complete your request within 30 working days of receipt
- Inform you of an extension period if the request cannot be completed within 30 days
Please be aware that the school will be unable to fulfil requests sent during statutory school holidays. They will be received once staff have returned to work.
- Inquiries
If you have any questions about the information in this notice, please contact:
- The school at This email address is being protected from spambots. You need JavaScript enabled to view it.
- The Data Protection Officer: This email address is being protected from spambots. You need JavaScript enabled to view it.
If you have any concerns about the way we are collecting or using your personal data, please contact:
- The Data Protection Officer: This email address is being protected from spambots. You need JavaScript enabled to view it.
- The Information Commissioner’s Office at www.ico.org.uk/concerns