Privacy Notice

The Upper Wharfedale

Primary Federation Privacy Policy 

Privacy Notice

Under data protection law, individuals have the right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘information notices’) to individuals.

In line with Government guidelines, we may need to keep records of staff and pupils who have tested positive for COVID-19. This information is stored securely and is not shared with any parties to whom it does not concern.

Introduction

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) set out the law relating to data protection. This privacy policy explains how The Upper Wharfedale Primary Federation handles your personal data in accordance with that legislation.

Under the GDPR and DPA, any organisation that determines how and why data is used is known as a data controller.
We, The Upper Wharfedale Primary Federation (comprising Burnsall, Cracoe and Rylstone CE, Grassington CE, and Kettlewell Primary Schools), are a data controller for the purposes of data protection law.

This Privacy Policy explains:

  • The personal data we hold
  • Why we use this data
  • Special category data
  • Our legal basis for using this data
  • Collecting this personal data
  • How long we store this data
  • Data sharing – who we share data with and why
  • Transferring data internationally
  • Parents’ and pupils’ rights regarding personal data
  • Other individual rights
  • Telephone call recording
  • Complaints
  • Data Protection Officer details
  • How government uses your data

The Personal Data We Hold

We may collect, use, store, and share (where appropriate) the following personal data about pupils:

  • Name, address, and date of birth
  • Contact details, preferences, and identification documents
  • Emergency contact information
  • Characteristics such as ethnic background, religious beliefs, eligibility for free school meals, or special educational needs
  • Details of any medical conditions, including physical or mental health
  • Results of internal assessments and externally set tests
  • Pupil and curricular records
  • Exclusion and behaviour information
  • Attendance information
  • Safeguarding information
  • Details of any support received, including care packages or support providers
  • Photographs and CCTV images
  • Recordings of telephone calls (where applicable)

We may also hold data received from other organisations such as previous schools, local authorities, and the Department for Education (DfE).

Why We Use This Data

We use pupil data to:

  • Support learning and development
  • Monitor and report on progress and attainment
  • Provide appropriate pastoral care
  • Protect pupil welfare and safety
  • Assess the quality of our services
  • Administer admissions and waiting lists
  • Conduct research and statistical analysis
  • Comply with legal obligations, including data returns to the DfE
  • Communicate effectively with parents and guardians

Personal information is used initially to create a pupil record and subsequently to manage attendance, progress tracking, and learning support.

Some personal information may be entered into secure school communication platforms to enable contact about your child and school events. Consent is sought separately for this.

Certain educational applications used by pupils may involve limited data entry (e.g., name, class). A Data Protection Impact Assessment (DPIA) is completed before introducing new software, and pupils are supervised in line with the school’s ICT Acceptable Use Policy. Parental consent will be obtained where required.

Special Category Data

The Federation processes some personal data that is classed as Special Category Data under the GDPR. This includes data on:

  • Race or ethnic origin
  • Religion or belief
  • Health and medical information

We process this data under lawful bases set out in Article 6 and Article 9 of the UK GDPR. Specifically:

  • Article 6(1)(c) – processing is necessary for compliance with a legal obligation (safeguarding, health and safety)
  • Article 9(2)(b) – processing is necessary for carrying out obligations in the field of education and safeguarding

In cases where such data is optional (for example, ethnicity or religion), consent will be sought under Article 9(2)(a).

Extra care is taken when processing or sharing special category data, and unless legally restricted, you will always be informed before your data is shared externall

Our Legal Basis for Using This Data

We only collect and use pupils’ personal data when the law allows us to. Most commonly, we process it where:

  • We need to comply with a legal obligation
  • We need it to perform an official task in the public interest
  • We have obtained your consent

Where consent has been given, it can be withdrawn at any time by contacting FBM@UWPF.n-yorks.sch.uk.

This legal basis is set out in Article 6 and Article 9 of the UK GDPR.

Collecting This Information

We collect pupil information via:

  • Admission and registration forms
  • Secure electronic transfer (Common Transfer File) from previous schools
  • CPOMS record transfers from other schools

Pupil data is essential for the Federation’s operational use. Some information is mandatory under law; other details are voluntary. At the point of collection, you will be informed whether providing information is optional or required.

The Federation does not use cookies to track users on its website.

How Long We Store This Data

We retain personal data only for as long as necessary, in accordance with legal requirements.  The Federation’s Records Management and Retention Policy outlines retention periods, storage methods, and secure disposal processes once data is no longer required.

Data Sharing – Who We Share Personal Data With and Why

We do not share information about pupils with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary to meet our statutory duties, we may share information with:

  • Our local authority – for safeguarding, admissions, and pupil tracking
  • The Department for Education (DfE) – for statutory census and funding data
  • Parents and legal guardians – to report on progress, attendance, and behaviour
  • Educators and examining bodies – for assessment and qualifications
  • Ofsted – for inspection and performance analysis
  • Suppliers and service providers – e.g. secure online learning platforms, payment systems
  • Health authorities and school nurses – for statutory health screening and medical support
  • Children’s Social Care – where safeguarding requires it
  • Police, courts, and tribunals – where legally mandated
  • Professional advisers and consultants – such as external moderators or auditors

All data transfers are conducted securely via encrypted electronic means.

Transferring Data Internationally

Most personal data is stored within the UK.
If data is transferred outside the UK or European Economic Area (EEA), it will only be done so where adequate protection is ensured through recognised legal mechanisms (e.g., UK adequacy decisions or standard contractual clauses).

Parents’ and Pupils’ Rights Regarding Personal Data

You have the right to make a Subject Access Request (SAR) to obtain a copy of your personal data held by the school.

Parents/carers can request access to their child’s data where the child is not considered mature enough (usually under age 12) to exercise their own rights.

If we hold information about you or your child, we will:

  • Describe what data we hold and why
  • Explain how long it will be retained
  • Provide details of data sources
  • Confirm with whom it has been shared
  • Provide a copy in an intelligible format

Requests should be made by contacting fbm.uwpf.n-yorks.sch.uk.

Other Rights

Under data protection law, individuals also have the right to:

  • Object to the processing of personal data
  • Prevent direct marketing
  • Challenge automated decision-making
  • Request correction, restriction, or deletion of personal data
  • Claim compensation for damages caused by a data breach

To exercise any of these rights, please contact the Federation Business Manager.

Complaints

We take complaints about the collection and use of personal information seriously.
If you have concerns about the way we handle data, please raise them with us first via fbm.uwpf.n-yorks.sch.uk.

If unresolved, you can contact the Information Commissioner’s Office (ICO):

  • Online: https://ico.org.uk/concerns/
  • Telephone: 0303 123 1113
  • Write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Data Protection Officer

Our appointed Data Protection Officer is provided through Veritau Ltd.

Contact Details:
Email: schoolsDPO@veritau.co.uk
Telephone: 01904 554025
Address: Veritau Ltd,

County Hall,

Racecourse Lane,

Northallerton, DL7 8AL

How Government Uses Your Data

The pupil data that we lawfully share with the Department for Education:

  • Underpins school funding calculations
  • Informs educational policy and school performance monitoring
  • Supports long-term research into educational outcomes

National Pupil Database (NPD)

The DfE stores pupil data securely in the NPD, which supports research and statistical analysis to improve education across England.
For more information, visit:
National Pupil Database Information

 

Data Collection Requirements

Information about statutory school data collections can be found at:
DfE Data Collections and Censuses

 

Contacting the DfE

To contact the Department for Education regarding personal data, visit:
https://www.gov.uk/contact-dfe

 

This notice is based on the Department for Education’s model privacy notice for pupils, adapted for The Upper Wharfedale Primary Federation to reflect our policies and procedures.