Oak Hill First School

Privacy Notice

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. This privacy notice explains how we collect, store, and use personal data about our pupils. We, Oak Hill First School, are the “data controller” for the purposes of data protection law. Our data protection officer is Mr R Morley

  1. Pupil data

We collect and hold information relating to our pupils, and may also receive information about them from their previous school, local authority, or Department for Education (DfE). This personal data will include:

  • Contact details
  • National curriculum assessment results
  • Attendance information
  • Exclusion information
  • Personal characteristics (such as ethnic background)
  • Photographs
  • Special educational needs
  • Safeguarding information
  • Details of any support received
  • Medical information
  • Where they go after they leave us
  1. The lawful basis on which we use this information

  We use this personal data to:

  • Support our pupils’ learning
  • Monitor and report on their progress
  • Provide appropriate pastoral care
  • Protect pupil welfare
  • Carry out research

Most commonly, we process data abiding by Article 6 of the GDPR (2018):

  • When we need to comply with a legal obligation
  • When we need it to perform an official task in the public interest

Less commonly, we may also process pupils’ personal data in situations where:

  • We have obtained consent to use pupils’ personal data
  • We need to protect the individual’s vital interests (or someone else’s interests)

Where we have obtained consent to use pupils’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn. Please see 7. Requesting access to personal data for more information.

  1. Collecting pupil information

The majority of information we collect about pupils is mandatory. Where it’s mandatory, we will explain the possible consequences of not complying. Some information can be provided voluntarily, and you will be informed if we request data on a voluntary basis. Where consent is needed it will be acquired through opt-in forms. Please refer to 7. Requesting access to personal data if you wish to withdraw consent on voluntary data.

  1. Storing pupil data

  Different types of data are subject to different retention periods under our Data Retention Policy.

Type of dataRetention periodEnd of life action
Admission registers Date of last entry in the book (or file) + 6 years Retain in the school for 6 years from date of last entry. Transfer to Archives
Attendance registers Date of register + 3 years Shred/Delete
Pupil record cards Retain for the time which the pupil remains at the school Shred/Delete
Pupil files Retain for the time which the pupil remains at the school Shred/Delete
Special Educational Needs files, reviews, and Individual Education Plans DOB of the pupil + 25 years from the review Shred/Delete
Letters authorising absence Date of absence + 2 years Shred/Delete
Absence books Current year + 6 years Shred/Delete
SATS records Current year + 6 years Shred/Delete
Pupils’ work Current year + 1 year Review at end of year, otherwise Shred/Delete
Statement maintained under the Education Act 1996 – Section 324 DOB + 30 years Shred/Delete, unless legal action pending
Advice and information to parents regarding educational needs Closure + 12 years Shred/Delete, unless legal action pending
Accessibility strategy Closure + 12 years Shred/Delete, unless legal action pending
Children’s SEN files DOB of pupil + 25 years Shred/Delete, unless legal action pending
Parental permission for school trips  - where there has been no major incident Conclusion of trip Shred/Delete
Parental permission for school trips  - where there has been a major incident DOB of the pupil involved + 25 years Shred/Delete
Accident reports DOB of pupil + 25 years Shred/Delete
Incident reports Current year + 20 years Shred/Delete
  1. Who we share pupil information with

Department for Education and Local Authority We are required to share certain information about our pupils to our local authority (LA) and the Department for Education (DfE), under Section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013. For more information about our local authority please visit: www.worcestershire.gov.uk For more information on the data collection requirements placed on us by the Department for Education (for example; via the school census), please visit: www.gov.uk/education/data-collection-and-censuses-for-schools The DfE may share pupil personal data we supply to them with third parties. This will only take place where legislation allows it to do so. Please see 6. The National Pupil Database for further information. Other schools We will share data with schools that our pupils attend after leaving us. School services The school uses third parties and services to support administrative and educational matters:

  • Capita SIMS
    DOB, address, contact information, personal characteristics, SEND information, medical and dietary information, free school meal eligibility, social services links
  • Teachers2Parents
    Pupil Names, Parents Details
  • InVentry
    Pupil’s full names and year groups
  • ParentPay
  • Address, contact information
  • Tucassi
    Pupil Names
  • MyConcern
    Pupil’s full names and year groups
  • Evolve
    Pupil Names
  • 2Simple
    Pupil’s Names/DOB/Photographs
  • Depth of Learning
    Pupil names, SEN, Pupil Premium & Performance Data
  • Language Link
    Pupil Name
  • Phonics Play
    Pupil Name
  • Bright Minds
    Pupil Names, parents details, medical need SEN
  • Psychology 1st Ltd
    Pupil names, parents details, medical need, SEN & CP Status
  • Beacon Centre
    Pupil names, parents details, medical need, SEN, CP
  • EWO (Trinity High)
    Pupil names, SIMS File, Parents details.
  • Mercury/E5
    Staff Payroll/Supplier Contacts
  • HCSS
    Staff/School Budgetary Information
  • Google Mail
    Staff E Mail addresses
  • Squirrel Mail
    Staff E Mail addresses
  • IBS IT Services
    School IT infrastructure
  • Microsoft Active Directory
    Pupil File, File Storage Facility
  • Babcock (Traded Services)
    Pupil Names, parents details, medical need, SEN
  • Worcester Childrens Portal
    Staff E Mail Addresses
  • Egress
    Staff E Mail Addresses
  • Worcestershire County Council
    Census return
  • DfE
    Census return
  • Governor Hub
    Governor Details
  • Edubase
    Governor Details
  • Other Schools (transition/mid term transfers/admissions)
    Pupil Files
  • Tempest (photography)
    Photography, images
  • NHS, Karen Green (school nurse)
    DOB, address, contact information, medical and dietary information
  • Social Services/LADO
    Pupil Name, student record, CP Status These organisations are compliant with the GDPR (2018) in their processing and storage of data.     Other legal requirements Where it is legally required, or necessary, we may share personal information about pupils with:
  • The pupil’s family and representatives
  • Educators and examining bodies
  • Our regulator
  • Our auditors
  • Financial organisations
  • Survey and research organisations
  • Health authorities
  • Security organisations
  • Health and social welfare organisations
  • Professional advisors and consultants
  • Charities and voluntary organisations
  • Police forces, courts, and tribunals
  • Professional bodies

Personal data will only be shared where it complies with data protection law.

  1. The National Pupil Database

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities, and awarding bodies. We are required, by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013. For more information about the NPD, please visit: www.gov.uk/government/publications/national-pupil-database-user-guide-and-supp orting-information The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

  • Conducting research or analysis
  • Producing statistics
  • Providing information, advice, or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether the DfE releases this data to third parties are subject to a strict approval process and based on a detailed assessment of:

  • Who is requesting the data
  • The purpose for which it is required
  • The level and sensitivity of data requested
  • The arrangements in place to store and handle the data

To be granted access to pupil level data, requestors must comply with strict terms and conditions covering the confidentiality and handling of data, security arrangements, and retention and use of data. For more information about the Department’s data sharing process, please visit: www.gov.uk/data-protection-how-we-collect-and-share-research-data    For more information about which organisations the Department has provided pupil information (and for which project), please visit: www.gov.uk/government/publications/dfe-external-data-shares    To contact the Department for Education, please visit: www.gov.uk/contact-dfe 

  1. Requesting access to personal data

Under data protection law, parents and pupils have the right to request access to  information about them that we hold. This is known as a ​subject access request​.  To make a request for your personal information, or be given access to your child’s educational record, please contact the school in writing, either as:

  • An email to ​This email address is being protected from spambots. You need JavaScript enabled to view it.
  • A letter handed in to the school office
  • A completed subject access request form (available to download, or paper copy from the school office)

Requests should include: 

  • The subject’s name
  • A correspondence address
  • A contact number and email address
  • Details about the information being requested

You also have the right to: 

  • Withdraw previous voluntary consent
  • Object to processing of personal data that is likely to cause, or is causing, damage or distress
  • Prevent personal data being used to send direct marketing
  • Have inaccurate personal data rectified, blocked, erased, or destroyed
  • Claim compensation for damages caused by a breach of the data protection regulations 

The school will: 

  • Aim to complete your request within 30 working days of receipt
  • Inform you of an extension period if the request cannot be completed within 30 days

Please be aware that the school will be unable to fulfil requests sent during  statutory school holidays. They will be received once staff have returned to work.   

  1. Inquiries

If you have any questions about the information in this notice, please contact:

  • The school at ​This email address is being protected from spambots. You need JavaScript enabled to view it.
  • The Data Protection Officer: This email address is being protected from spambots. You need JavaScript enabled to view it.

If you have any concerns about the way we are collecting or using your personal data, please contact:

  • The Data Protection Officer: This email address is being protected from spambots. You need JavaScript enabled to view it.
  • The Information Commissioner’s Office at ​www.ico.org.uk/concerns