Privacy Notice

How we use student and parent/carer information

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use student & parent/carer personal data.

We, Meadow High School are the ‘Data controller’ for the purposes of data protection law.

We have appointed Grow Education Partners Ltd as our data protection officer (DPO) and the responsible contact is David Coy (see ‘Contact us’ below).

In this privacy notices all references to ‘you / your’ include both the student and the student’s parents/carers, both individually and collectively, unless otherwise specified.

1. The personal data we collect and hold

Personal data that we may collect, use, store, and share (when appropriate) about students & parents/carers includes, but is not limited to:      

• Personal Information (such as name, date of birth, unique student number, parent’s/carer’s national insurance number)
• Contact details and preferences (such as telephone number, email address, postal address, for you and your emergency contacts)
• Assessment information (such as data scores, tracking, and internal/external testing)
• Protected characteristics, (such as ethnic background, religion or belief)
• Special educational needs information (such as EHCP’s, statements, applications for support, care or support plans)
• Exclusion information
• Relevant medical information (such as NHS information, health checks, physical and mental health care, immunisation status and allergies and medical conditions, including physical and mental health)
• Attendance information (such as sessions attended, number of absences and absence reasons)
• Safeguarding information
• Details of any support received, including care packages, plans and support providers.
• Photographs & Videos (such as for internal safeguarding & security purposes, school newsletters, media and promotional purposes).
• Closed-circuit television (CCTV) images including audio captured in school.
• Data about your use of the school’s information and communications systems
• Payment and banking details where required.

We may also hold data about students that we have received from other organisations, including other schools, local authorities and the Department for Education (“DfE”).

A full breakdown of the information we collect on students & parents/carers can be requested by contacting Meadow High School - meadow@meadowhighschool.org - 01895 443310

2. Why we collect and process this data.

The purpose of collecting and processing this data includes but is not limited to:

• Contacting you in relation to your child or to inform you about School events and updates
• Supporting student learning
• Monitoring and reporting on student progress
• Providing appropriate pastoral care
• Protecting student welfare and safeguarding
• Assessing the quality of our services
• Administering admissions waiting lists
• Carrying out research
• Complying with the law regarding data sharing
• Adhering to the statutory duties placed upon us by the Department for Education.

3. Our lawful basis for using this data.

This section contains information about the legal basis that we are relying on when handling your information.  These are defined under data protection legislation and for personally identifiably information are:

• You have given consent for one or more specific purposes
• Processing is necessary to comply with the school’s legal obligations
• Processing is necessary to protect your vital interests 
• Processing is necessary for tasks in the public interest or exercise of authority vested in the controller (the provision of education)
• Processing is necessary for the school’s legitimate interests or the legitimate interests of a third party.

When we process special category information, which is deemed to be more sensitive, the following lawful basis are used:

• You have given explicit consent
• It is necessary to fulfil the school’s obligations or your obligations
• It is necessary to protect your vital interests
•  Processing is carried out by a foundation or not-for-profit organisation (includes religious, political or philosophical organisations and trade unions)
• Reasons of public interest in the area of public health.

An example of how we use the information you provide is:

The submission of the school census returns, including a set of named student records, is a statutory requirement on schools under Section 537A of the Education Act 1996.

Putting the school census on a statutory basis:

•       means that schools do not need to obtain parental or student consent to the provision of information

•       ensures schools are protected from any legal challenge that they are breaching a duty of confidence to students

•       helps to ensure that returns are completed by schools.

Where we have obtained consent to use students’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent and explain how consent can be withdrawn.

4. Collecting this data.

While the majority of information we collect about students & parents/carers is mandatory, there is some information that can be provided voluntarily.

Whenever we seek to collect information from you or your child, we make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.

5. How we store this data.

We keep your information for as long as we need to in order to educate and look after our students.

The majority of this will be stored in the student file and this file will follow the student whenever they move schools and will be retained by the last school the student attends.

Where we are legally required or have a lawful basis to do so we will keep some information after your child has left the School. This will be retained in line with our Data Retention Schedule, a copy of which can be requested by contacting Meadow High School, meadow@meadowhighschool.org, 01895 443310.

To protect your data, we have data protection policies and procedures in place, including strong organisational and technical measures, which are regularly reviewed.  Further information can be found in our Data Protection Policy or upon request.

6. Who we share this data with.

In order for us to legally, effectively and efficiently function we are required to share data with appropriate third parties, including but not limited to:

• Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and exclusions
• The Department for Education- to meet our legal obligations to share certain information.
• The student’s family and representatives- such as in the event of an emergency
• Educators and examining bodies- such as ensuring we adhere to examining regulations to guarantee the validity of examinations
• Ofsted- during the course of a school inspection
• Suppliers and service providers – to enable them to provide the service we have contracted them for
• Central and local government
• Our auditors- to ensure compliance with our legal obligations
• Health authorities (NHS) - to ensure the wellbeing of students
• Security organisations to create a secure workplace for all staff
• Health and social welfare organisations
• Professional advisers and consultants - for us to develop our services and best provide our public service
• Charities and voluntary organisations
• Police forces, courts, tribunals, security services - to create a secure workplace for all at the school. 
• Professional bodies
• Schools that the students attend after leaving us.

7. Transferring data internationally

We may send your information to other countries when:

• we or a company we work with store information on computer servers based overseas; or
• we communicate with you when you are overseas.

We conduct due diligence on the companies we share data with and note whether they process data in the UK, EEA (which means the European Union, Liechtenstein, Norway and Iceland) or outside of the EEA.

The UK and countries in the EEA are obliged to adhere to the requirements of the GDPR and have equivalent legislation which confer the same level of protection to your personal data.

For organisations who process data outside the UK and EEA we will assess the circumstances of how this occurs and ensure there is no undue risk.

Additionally, we will assess if there are adequate legal provisions in place to transfer data outside of the UK.

8. Why we share student data

We share students’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.

We are required to share information about our students with our local authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Students) (England) Regulations 2013. 

9. Data collection requirements:

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

10. [Secondary Schools / All Through Only] Youth support services Students aged 13+ [For use by educational settings with students aged 13+:]

Once our students reach the age of 13, we also pass student information to our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

• youth support services
• careers advisers

A parent or guardian can request that only their child’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the child / student once he/she reaches the age 16.

Students aged 16+ [For use by educational settings with students aged 16+:]

We will also share certain information about students aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

• post-16 education and training providers
• youth support services
• careers advisers

For more information about services for young people, please visit our local authority website.

If a student  is over 16, the child (or the parent(s)) can ask that no information beyond names, address and your date of birth be passed to the support service. Please see the contact us section below on how to opt-out of this arrangement. For more information about young peoples’ services, please go to the Directgov Young People page at https://www.gov.uk/topic/schools-colleges-childrens-services/support-for-children-young-people

11. The National Student Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about students in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our students to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Students) (England) Regulations 2013.

To find out more about the NPD, go to https://find-npd-data.education.gov.uk/

The department may share information about our students from the NPD with third parties who promote the education or well-being of children in England by:

• conducting research or analysis
• producing statistics
• providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data
• the purpose for which it is required
• the level and sensitivity of data requested: and
• the arrangements in place to store and handle the data

To be granted access to student information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided student information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-student-database-requests-received

To contact DfE: https://www.gov.uk/contact-dfe

12. Data Protection Rights

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them.

Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.

If you make a subject access request, and if we do hold information about you, we can:

• Give you a description of it
• Tell you why we are holding and processing it, and how long we will keep it for
• Explain where we got it from, if not from you
• Tell you who it has been, or will be, shared with
• Let you know whether any automated decision-making is being applied to the data, and any consequences of this
• NOT provide information where it compromises the privacy of others
• Give you a copy of the information in an intelligible form.

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

In most cases, we will respond to subject access requests within 1 month, as required under data protection legislation However, we are able to extend this period by up to 2 months for complex requests or exceptional circumstances.

Your other rights regarding your data:

You may:

• Withdraw your consent to processing at any time (this only relates to data for which the school relies on consent as a lawful basis for processing)
• Ask us to rectify, erase or restrict processing of your personal data, or object to the processing of it in certain circumstances and where sufficient supporting evidence is supplied
• Prevent the use of your personal data for direct marketing
• Challenge processing which has been justified on the basis of public interest, official authority or legitimate interests
• Request a copy of agreements under which your personal data is transferred outside of United Kingdom
• Object to decisions based solely on automated decision making or profiling (decisions taken with no human involvement, that might negatively affect you)
• Request a cease to any processing that is likely to cause damage or distress
• Be notified of a data breach in certain circumstances
• Refer a complaint to the ICO
• Ask for your personal data to be transferred to a third party in a structured, commonly used and machine-readable format (in certain circumstances).

The School will comply with the Data Protection legislation in regard to dealing with all data requests submitted in any format, although individuals are asked to preferably submit their request in written format to assist with comprehension.

Requests should include:

• Name of individual
• Correspondence address
• Contact number and email address
• Details of the request

Parents/carers also have a legal right to access to their child’s educational record. [1] 

If you would like to exercise any of the rights or requests listed above, please contact Meadow High School:

• Email: meadow@meadowhighschool.org
• Phone: 01895 443310
• Post:Meadow High School, Royal Lane, Hillingdon, Middlesex, UB8 3QU

We reserve the to verify the requesters’ identity by asking for Photo ID. If this proves insufficient, then further ID may be required.

13. Data Protection Breaches

If you suspect that your or someone else’s data has been subject to unauthorised or unlawful processing, accidental loss, destruction or damage, we ask that you please Jack Barnes - Facilities manager/data protection lead and advise us without undue delay.

14. Complaints.

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our independent data protection officer, David Coy (contactable on david.coy@london.anglican.org, 020 3837 5145).

Alternatively, you can refer a complaint to the Information Commissioner’s Office:

• Report a concern online at https://ico.org.uk/concerns/
• Call 0303 123 1113
• Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

15. Contact us.

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact either our School Data Protection Lead, Jack Barnes at Meadow High School or our independent Data Protection Officer, David Coy (contactable on david.coy@london.anglican.org, 02038375145).

Privacy Notice-School Workforce

How we use the School Workforce’s information

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about individuals we employ, or otherwise engage, to work at our school.

Meadow High School, are the ‘Data controller’ for the purposes of data protection law.

We have appointed Grow Education Partners Ltd as our data protection officer (DPO) and the responsible contact is David Coy (see ‘Contact us’ below).

1. The personal data we collect and hold.

Personal data that we may collect, use, store, and share (when appropriate) about those we employ or otherwise engage to work at our school includes, but is not restricted to:   

• Personal Information (such as name, date of birth, national insurance number, next of kin, dependents, marital status)
• Contact details (such as telephone number, email address, postal address, for you and your emergency contacts)
• Protected characteristics (such as trade union membership, nationality, language, ethnic origin, sexual orientation, religion or belief, where this has been provided)
• Relevant medical information (such as physical or mental health conditions, including for any disabilities for which the organisation needs to make any reasonable adjustments to fulfil its duty of care)
• Information about your remuneration (such as salary, annual leave, pension, bank details, payroll records, tax status and benefits information)
• Information from pre-employment background checks (such as criminal record, online search)
• Recruitment information, (such as copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)
• Qualifications and employment records (such as work history, job titles, working hours, training records and professional memberships)
• Assessments of your performance (such as appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence)
• Outcomes of any disciplinary and/or grievance procedures, including any warnings issued to you and related correspondence
• Details of periods of absence (such as holiday, sickness, family leave, sabbatical, including the reasons for the leave)
• Photographs & Video (for internal safeguarding & security purposes, school newsletters, media, and promotional purposes)
• Closed-circuit television (CCTV) footage including audio
• Data about your use of the school’s information and communications system.

We may also hold personal data about you from third parties, such as references supplied by former employers, information provided during the completion of our pre-employment checks, and from the Disclosure & Barring Service, in order to comply with our legal obligations and statutory guidance.

A full breakdown of the information we collect on the School Workforce can be requested by contacting Meadow High School - meadow@meadowhighschool.org - 01895 443310

2. Why we collect and use this data.

The purpose of collecting and processing includes but is not limited to:

 

• Running the school in an effective and efficient manner
• Enabling you to be paid and other benefits to be provided
• Facilitating safeguarding as part of our safeguarding obligations towards pupils
• Fulfilling our legal obligations in recruiting individuals to the school workforce
• Supporting effective performance management and appraisal
• Supporting effective management of the school workforce, along with the implementation of school policies and procedures
• Providing feedback to your training centre and awarding body
• Informing our recruitment and retention policies
• Allowing better financial modelling, administration and planning
• Providing references where requested
• Equalities monitoring and reporting
• Responding to any school workforce issues
• Improving the management of workforce data across the sector
• Supporting the work of the School Teachers’ Review Body
• Assessing the quality of our services
• Complying with the law regarding data sharing.

 

3.  The lawful basis for using this data

This section contains information about the legal basis that we are relying on when handling your information. These are defined under data protection legislation and for personally identifiable information are:

• To fulfil a contract with you
• You have given consent for one or more specific purposes
• Processing is necessary to comply with the school’s legal obligations
• Processing is necessary to protect your vital interests 
• Processing is necessary for tasks in the public interest or exercise of authority vested in the controller (the provision of education)
• Processing is necessary for the school’s legitimate interests or the legitimate interests of a third party.

When we process special category information, which is deemed to be more sensitive, the following lawful basis are used:

• You have given explicit consent
• Employment, social security and social protection
• It is necessary to fulfil the school’s obligations or your obligations
• It is necessary to protect your vital interests
• Processing is carried out by a foundation or not-for-profit organisation (includes religious, political or philosophical organisations and trade unions)
• Reasons of public interest in the area of public health.

Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent and explain how you can withdraw consent if you wish to do so.

4. Collecting this data.

While the majority of information we collect from you is mandatory, there is some information that you can choose whether or not to provide to us.

Whenever we seek to collect information from you, we make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.

5. How we store this data.

We collect, store and process data for each member of the school workforce.  The information is contained in a virtual and/or physical file which is kept secure and only used for purposes directly relevant to your employment.

Once your employment with us has ended, we will retain this file and delete the information in it in accordance with our retention policy, a copy of which can be requested from Meadow High School - meadow@meadowhighschool.org - 01895 443310

6. Who we share data with.

In order for us to legally, effectively and efficiently function we are required to share data with appropriate third parties, including but not limited to:

• Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and information about headteacher performance and staff dismissals

• The Department for Education- to meet our legal obligations to share certain information.
• Educators and examining bodies-such as ensuring we adhere to examining regulations to guarantee the validity of examinations
• Training centres and awarding bodies-in order to provide information and feedback on your performance.
• Your families and representatives- such as in the event of an emergency
• Financial organisations e.g., Pension Scheme, HMRC
• Ofsted-during the course of a school inspection
• Suppliers and service providers – to enable them to provide the service we have contracted them for such as HR, payroll, IT.
• Central and local government- such as workforce analysis 
• Our auditors - to ensure compliance with our legal obligations
• Health authorities (NHS) and Occupational Health and employee support schemes to ensure the wellbeing of our staff body
• Health and social welfare organisations
• Professional advisers and consultants- for us to develop our services and best provide our public service
• Trade Unions and Professional Associations - to enable them to provide the service their members require
• Charities and voluntary organisations
• Police forces, courts, tribunals, Security organisations- to create a secure workplace for all staff
• Professional bodies
• Employment & recruitment agencies and future employers - to support reference requests.

 

7. Transferring Data Internationally

We may send your information to other countries when:

• we or a company we work with store information on computer servers based overseas; or
• we communicate with you when you are overseas.

We conduct due diligence on the companies we share data with and note whether they process data in the UK, EEA (which means the European Union, Liechtenstein, Norway and Iceland) or outside of the EEA.

The UK and countries in the EEA are obliged to adhere to the requirements of the GDPR and have equivalent legislation which confer the same level of protection to your personal data.

For organisations who process data outside the UK and EEA we will assess the circumstances of how this occurs and ensure there is no undue risk.

Additionally, we will assess if there are adequate legal provisions in place to transfer data outside of the UK.

 

8. Why we share your information.

In order to successfully perform our key functions, we need to share personal data with organisations

For example, we are required to share information about our workforce members with our local authority (LA) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments

We share personal data with the Department for Education (DfE) on a statutory basis. This data sharing underpins workforce policy monitoring, evaluation, and links to school funding / expenditure and the assessment educational attainment.  We are required to share information about our school employees with our local authority (LA) and the Department for Education (DfE) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.

 

9. Data collection requirements.

The DfE collects and processes personal data relating to those employed by schools (including Multi Academy Trusts) and local authorities that work in state funded schools (including all maintained schools, all academies and free schools and all special schools including Pupil Referral Units and Alternative Provision). All state funded schools are required to make a census submission because it is a statutory return under sections 113 and 114 of the Education Act 2005

To find out more about the data collection requirements placed on us by the Department for Education including the data that we share with them, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

The department may share information about school employees with third parties who promote the education or well-being of children or the effective deployment of school staff in England by:

• conducting research or analysis
• producing statistics
• providing information, advice or guidance.

The department has robust processes in place to ensure that the confidentiality of personal data is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether DfE releases personal data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data
• the purpose for which it is required
• the level and sensitivity of data requested; and
• the arrangements in place to securely store and handle the data.

To be granted access to school workforce information, organisations must comply with its strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

To contact the department: https://www.gov.uk/contact-dfe

 

10.  Data Protection Rights

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them.

If you make a subject access request, and if we do hold information about you, we will:

• Give you a description of it
• Tell you why we are holding and processing it, and how long we will keep it for
• Explain where we got it from, if not from you
• Tell you who it has been, or will be, shared with
• Let you know whether any automated decision-making is being applied to the data, and any consequences of this
• NOT provide information where it compromises the privacy of others
• Give you a copy of the information in an intelligible form.

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

In most cases, we will respond to subject access requests within 1 month, as required under data protection legislation However, we are able to extend this period by up to 2 months for complex requests or exceptional circumstances.

Your other rights regarding your data:

You may:

• Withdraw your consent to processing at any time (This only relates to data for which the school relies on consent as a lawful basis for processing)
• Ask us to rectify, erase or restrict processing of your personal data, or object to the processing of it in certain circumstances and where sufficient supporting evidence is supplied
• Prevent the use of your personal data for direct marketing
• Challenge processing which has been justified on the basis of public interest, official authority or legitimate interests.
• Request a copy of agreements under which your personal data is transferred outside of the United Kingdom
• Object to decisions based solely on automated decision making or profiling (decisions taken with no human involvement, that might negatively affect you)
• Request a cease to any processing that is likely to cause damage or distress
• Be notified of a data breach in certain circumstances
• Refer a complaint to the ICO
• Ask for your personal data to be transferred to a third party in a structured, commonly used and machine-readable format (in certain circumstances)

The School will comply with the Data Protection legislation in regard to dealing with all data requests submitted in any format, but individuals are asked to preferably submit their request in written format to assist with comprehension.

If you would like to exercise any of the rights or requests listed above, please contact Meadow High School:

Email: meadow@meadowhighschool.org

Phone: 01895 443310

Post: Meadow High School, Royal Lane, Hillingdon, Middlesex, UB8 3QU

We reserve the to verify the requester’s identity by asking for Photo ID. If this proves insufficient, then further ID may be required.

 

11. Data Protection Breaches

If you suspect that your or someone else’s data has been subject to unauthorised or unlawful processing, accidental loss, destruction or damage, we ask that you please contact Jack Barnes - Facilities manager/data protection lead at Meadow High School and advise us without undue delay.

 

12. Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our independent data protection officer, David Coy (contactable on david.coy@london.anglican.org, 07903 506531).

Alternatively, you can refer a complaint to the Information Commissioner’s Office:

• Report a concern online at https://ico.org.uk/concerns/
• Call 0303 123 1113
• Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
•  

13. Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact either our School Data Protection Lead, Jack Barnes at Meadow High School or our independent Data Protection Officer, David Coy (contactable on david.coy@london.anglican.org, 07903 506531).

Privacy Notice-Governors & Volunteers

How we use Governors’ and other Volunteers’ Information

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about individuals working with the school in a voluntary capacity, including Governors.

Meadow High School  are the ‘Data controller’ for the purposes of data protection law.

We have appointed Grow Education Partners Ltd as our data protection officer (DPO) and the responsible contact is David Coy (see ‘Contact us’ below).

1. The personal data we collect and hold

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not limited to:

• Personal information (such as name, date of birth, next of kin, dependents, marital status)
• Contact details (such as telephone number, email address, postal address, for you and your emergency contacts)
• Protected characteristics (such as trade union membership, nationality, language, ethnic origin, sexual orientation, health and religion or belief, where this has been provided)
• Relevant medical information (such as physical or mental health conditions, including for any disabilities which the organisation needs to make any reasonable adjustments to fulfil its duty of care)
• Qualifications, and employment records (such as work history, job titles, references, training records and professional memberships)
• Outcomes of any disciplinary and/or grievance procedures, including any warning issues to you and related correspondence
• Governor performance information (Such as meeting attendance, visits, roles, and leadership responsibilities)
• Information about business and pecuniary interests
• Information from background checks (such as criminal record, online search)
• Closed-circuit television (CCTV) footage including audio
• Data about your use of the school’s information and communications system
• Photographs & Video (for internal safeguarding & security purposes, school newsletters, media, and promotional purposes)

• Payment and banking details where required (e.g., for expense claims).

We may also hold personal data about you from third parties, such as information supplied by the appointing body and from the Disclosure & Barring Service, in order to comply with our legal obligations and statutory guidance.

A full breakdown of the information we collect on Governors & Volunteers can be requested by contacting Meadow High School, meadow@meadowhighschool.org

 

2. Why we collect and use this data.

The reasons we collect and process this data includes but is not limited to:

• Establish and maintain effective governance
• Meet statutory obligations for publishing and sharing voluntary individuals’ details
• Facilitate safeguarding as part of our safeguarding obligations towards pupils
• Fulfil our legal obligations in appointing voluntary individuals
• Support development
• Equalities monitoring and reporting
• Ensure that appropriate access arrangements can be provided for volunteers who require them
• To comply with the law regarding data sharing
• Respond to any school workforce issues

• Undertake statutory reporting the Department for Education.

 

3. Our lawful basis for using this data

This section contains information about the legal basis that we are relying on when handling your information. These are defined under data protection legislation and for personally identifiable information are:

• Processing is necessary to fulfil a contract with you
• You have given consent for one or more specific purposes
• Processing is necessary to comply with the school’s legal obligations
• Processing is necessary to protect your vital interests
• Processing is necessary for tasks in the public interest or exercise of authority vested in the controller (the provision of education).
• Processing is necessary for the school’s legitimate interests or the legitimate interests of a third party.

 

When we process special category information, which is deemed to be more sensitive, the following lawful basis are used:

• You have given explicit consent
• Employment, social security, and social protection
• It is necessary to fulfil the school’s obligations or your obligations
• It is necessary to protect your vital interests
• Processing is carried out by a foundation or not-for-profit organisation (includes religious, political, or philosophical organisations and trade unions)
• Reasons of public interest around public health.

 

Where we have obtained consent to use personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent and explain how consent can be withdrawn.

4. Collecting this data

While the majority of the information we collect from you is mandatory, there is some information that you can choose whether or not to provide to us.

Whenever we seek to collect information from you, we make it clear whether you must provide this information (and if so, what the possible consequences are of not complying), or whether you have a choice.

5. How we store this data

Personal data is stored in accordance with our Data Retention policy.

We retain personal information about all volunteers. This information is kept secure and is only used for purposes directly relevant to your work with the school.

When your relationship with the school has ended, we will retain and dispose of your personal information in accordance with our Data Retention Schedule. A copy of this can be obtained by contacting Meadow High School, meadow@meadowhighschool.org.

 

6. Who we share data with.

In order for us to legally, effectively and efficiently function we are required to share data   with appropriate third parties, including but not limited to:

• The Department for Education- to meet our legal obligations to share certain information.
• Our local authority – to meet our legal obligations to share certain information with it, such as details of governors
• Suppliers and service providers – to enable them to provide the service we have contracted them for, such as governor support and IT services
• Training centres and awarding bodies-in order to share information and feedback on your performance.
• Your families and representatives- such as in the event of an emergency
• Our auditors to ensure compliance with our legal obligations
• Trade Unions and Professional Associations - to enable them to provide the service their members require
• Professional advisers and consultants - for us to develop our services and best provide our public service
• Employment & recruitment agencies and future employers - to support reference requests
• Police forces, courts, tribunals, security organisations- to create a secure workplace for all at the school. 
• Charities and voluntary organisations.

 

7. Transferring data internationally

We may send your information to other countries when:

• we or a company we work with store information on computer servers based overseas; or
• we communicate with you when you are overseas.

We conduct due diligence on the companies we share data with and note whether they process data in the UK, EEA (which means the European Union, Liechtenstein, Norway and Iceland) or outside of the EEA.

The UK and countries in the EEA are obliged to adhere to the requirements of the GDPR and have equivalent legislation which confer the same level of protection to your personal data.

For organisations who process data outside the UK and EEA we will assess the circumstances of how this occurs and ensure there is no undue risk.

Additionally, we will assess if there are adequate legal provisions in place to transfer data outside of the UK.

8. Why we share your information

In order to successfully perform our key functions, we need to share personal data with organisations for example we share personal data with the Department for Education (DfE) on a statutory basis. Under s.538 of the Education Act 1996, and the Academies Financial Handbook, the Secretary of State requires boards to provide certain details they hold about people involved in governance, as volunteered by individuals,  and the information kept up to date.

To find out more about the data collection requirements placed on us by the Department for Education including the data that we share with them, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

 

For more information about the department’s data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

 

To contact the department: https://www.gov.uk/contact-dfe

 

Data Protection Rights

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them.

If you make a subject access request, and if we do hold information about you, we can:

• Give you a description of it
• Tell you why we are holding and processing it, and how long we will keep it for
• Explain where we got it from, if not from you
• Tell you who it has been, or will be, shared with
• Let you know whether any automated decision-making is being applied to the data, and any consequences of this
• NOT provide information where it compromises the privacy of others
• Give you a copy of the information in an intelligible form.

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

In most cases, we will respond to subject access requests within 1 month, as required under data protection legislation However, we are able to extend this period by up to 2 months for complex requests or exceptional circumstances.

 

Your Other Rights regarding your Data

You may:

 

• Withdraw your consent to processing at any time (this only relates to data for which the school relies on consent as a lawful basis for processing)
• Ask us to rectify, erase or restrict processing of your personal data, or object to the processing of it in certain circumstances and where sufficient supporting evidence is supplied
• Prevent the use of your personal data for direct marketing
• Challenge processing which has been justified on the basis of public interest, official authority or legitimate interests.
• Request a copy of agreements under which your personal data is transferred outside of the United Kingdom.
• Object to decisions based solely on automated decision making or profiling (decisions taken with no human involvement, that might negatively affect you)
• Request a cease to any processing that is likely to cause damage or distress
• Be notified of a data breach in certain circumstances
• Refer a complaint to the ICO
• Ask for your personal data to be transferred to a third party in a structured, commonly used and machine-readable format (in certain circumstances)

 

The School will comply with the Data Protection legislation in regard to dealing with all data requests submitted in any format, although individuals are asked to preferably submit their request in written format to assist with comprehension.

Requests should include:

• Name of individual
• Correspondence address
• Contact number and email address
• Details of the request

If you would like to exercise any of the rights or requests listed above, please contact Meadow High School:

• Email: meadow@meadowhighschool.org
• Phone: 01895 443310
• Post: Meadow High School, Royal Lane, Hillingdon, Middlesex, UB8 3QU

We reserve the to verify the requesters’ identity by asking for Photo ID. If this proves insufficient, then further ID may be required

 

10. Data Protection Breaches

If you suspect that your or someone else’s data has been subject to unauthorised or unlawful processing, accidental loss, destruction or damage, we ask that you please Jack Barnes - Facilities manager/data protection lead. at Meadow High School and advise us without undue delay.

11. Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our independent data protection officer David Coy (contactable on david.coy@london.anglican.org, 020 3837 5145).

Alternatively, you can refer a complaint to the Information Commissioner’s Office:

• Report a concern online at https://ico.org.uk/concerns/
• Call 0303 123 1113
• Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

 

12. Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact either our School Data Protection Lead, Jack Barnes at Meadow High School or our independent Data Protection Officer David Coy (contactable on david.coy@london.anglican.org, 02038375145).

Meadow High School

Privacy Notice

How we use Job Applicants’ Information

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about individuals applying for roles at our school.

Meadow High School  is the ‘Data controller’ for the purposes of data protection law.

We have appointed Grow Education Partners Ltd as our data protection officer (DPO) and the responsible contact is David Coy (see ‘Contact us’ below).

Successful candidates will also need to refer to our privacy notice for the school workforce for information about how their personal data is collected, stored and used once they join the school.

1. The personal data we collect and hold

Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not limited to:

• Personal information (such as name, date of birth, national insurance number)
• Contact details and preferences (such as telephone number, email address, postal address)
• Copies of right to work documentation
• References
• Evidence of qualifications
• Employment records (such as work history, job titles, training records and professional memberships)
• Information from pre-employment background checks (such as criminal record, online search)
• Closed- circuit television (CCTV) Images and audio
• Protected characteristics (such as race, ethnicity, religious beliefs, sexual orientation)
• Relevant medical information (such as disability and access requirements).

We may also hold personal data about you from third parties, such as references supplied by former employers or service users, information provided during the completion of our pre-employment checks, and from the Disclosure & Barring Service, in order to comply with our legal obligations and statutory guidance.

A full breakdown of the information we collect on Job Applicants can be requested by contacting meadow@meadowhighschool.org

2. Why we collect and process this data

The purpose of collecting and processing this data includes but is not limited to:

• Staff recruitment and ensuring we have all the necessary information to enter into a contract with you
• Fulfilling our legal obligations, for example to check a successful applicant’s eligibility to work in the UK before employment starts
• Enabling us to establish relevant experience and qualifications
• Facilitating safer recruitment, as part of our safeguarding obligations towards pupils
• Enabling equalities monitoring
• Ensuring that appropriate access arrangements can be provided for candidates that require them.

3. Our lawful basis for using this data

This section contains information about the legal basis that we are relying on when handling your information. These are defined under data protection legislation and for personally identifiable information are:

• You have given consent for one or more specific purposes
• Processing is necessary to fulfil a contract or to take specific steps before entering into a contract
• Processing is necessary to comply with the school’s legal obligations
• Processing is necessary to protect your vital interests
• Processing is necessary for tasks in the public interest or exercise of authority vested in the controller (the provision of education).

When we process special category information, which is deemed to be more sensitive, the following lawful basis are used:

• You have given explicit consent
• It is necessary to fulfil the school’s obligations or your obligations
• It is necessary to protect your vital interests
• Processing is carried out by a foundation or not-for-profit organisation (includes religious, political or philosophical organisations and trade unions)
• Reasons of public interest in the area of public health.

Where we have obtained consent to use personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent and explain how consent can be withdrawn.

 

4. Collecting this data.

While the majority of information we collect about you is mandatory, some information can be provided voluntarily.

Whenever we seek to collect information from you, we make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.

 

5.  How we store this data

Personal data we collect as part of the job application process is stored in line with our Data Protection Policy.

When it is no longer required, we will delete your information in accordance with our Data Retention policy. The Data Retention policy can be requested from meadow@meadowhighschool.org

 

6. Unsuccessful Candidates

If your application for employment is unsuccessful, the organisation will hold your data on file for 6 months

after the end of the relevant recruitment process.

 

At the end of that period, your data is deleted or destroyed.

7.  Who we share data with.

In order for us to legally, effectively and efficiently function we are required to share data with appropriate third parties, including but not limited to

• Former employers – to obtain references
• Employment background check providers- to obtain necessary background checks
• Our auditors- to ensure our compliance with our legal obligations
• Our local authority – to meet our legal obligations to share certain information with it, such as shortlists of candidates for a headteacher position

• Suppliers and service providers – to enable them to provide the service we have contracted them for, such as HR and recruitment support
• Professional advisers and consultants
• Employment and recruitment agencies.

8. Transferring data internationally

We may send your information to other countries when:

• we or a company we work with store information on computer servers based overseas; or
• we communicate with you when you are overseas.

We conduct due diligence on the companies we share data with and note whether they process data in the UK, EEA (which means the European Union, Liechtenstein, Norway and Iceland) or outside of the EEA.

The UK and countries in the EEA are obliged to adhere to the requirements of the GDPR and have equivalent legislation which confer the same level of protection to your personal data.

For organisations who process data outside the UK and EEA we will assess the circumstances of how this occurs and ensure there is no undue risk.

Additionally, we will assess if there are adequate legal provisions in place to transfer data outside of the UK.

9. Data Protection Rights

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them.

If you make a subject access request, and if we do hold information about you, we can:

• Give you a description of it
• Tell you why we are holding and processing it, and how long we will keep it for
• Explain where we got it from, if not from you
• Tell you who it has been, or will be, shared with
• Let you know whether any automated decision-making is being applied to the data, and any consequences of this
• NOT provide information where it compromises the privacy of others
• Give you a copy of the information in an intelligible form.

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

In most cases, we will respond to subject access requests within 1 month, as required under data protection legislation However, we are able to extend this period by up to 2 months for complex requests or exceptional circumstances.

 

Your Other Rights regarding your Data:

You may:

• Withdraw your consent to processing at any time (This only relates to data for which the school relies on consent as a lawful basis for processing)
• Ask us to rectify, erase or restrict processing of your personal data, or object to the processing of it in certain circumstances and where sufficient supporting evidence is supplied
• Prevent the use of your personal data for direct marketing
• Challenge processing which has been justified on the basis of public interest, official authority or legitimate interests.
• Request a copy of agreements under which your personal data is transferred outside of the United Kingdom.
• Object to decisions based solely on automated decision making or profiling (decisions taken with no human involvement, that might negatively affect you)
• Request a cease to any processing that is likely to cause damage or distress
• Be notified of a data breach in certain circumstances
• Refer a complaint to the ICO
• Ask for your personal data to be transferred to a third party in a structured, commonly used and machine-readable format (in certain circumstances).

The School will comply with the data protection legislation in regard to dealing with all data requests submitted in any format, individuals are asked to preferably submit their request in written format to assist with comprehension.

Requests should include:

• Name of individual
• Correspondence address
• Contact number and email address
• Details of the request

 

If you would like to exercise any of the rights or requests listed above, please contact Meadow High School

• Email: meadow@meadowhighschool.org
• Phone: 01895 443310

We reserve the to verify the requesters’ identity by asking for Photo ID. If this proves insufficient, then further ID may be required.

10. Data Protection Breaches

If you suspect that your or someone else’s data has been subject to unauthorised or unlawful processing, accidental loss, destruction or damage, we ask that you please contact meadow@meadowhighschool.org and advise us without undue delay.

11. Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our independent data protection officer, David Coy (contactable on david.coy@london.anglican.org, 020 3837 5145.

Alternatively, you can refer a complaint to the Information Commissioner’s Office:

• • Report a concern online at https://ico.org.uk/concerns/
  • Call 0303 123 1113
  • Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Contact us

• If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact either our School Data Protection Lead, Jack Barnes meadow@meadowhighschool.org - 01895 443310 or our independent Data Protection Officer, David Coy (contactable on david.coy@london.anglican.org, 02038375145).

Meadow High School

School Privacy Notice

How we use Visitor Information

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about Visitors.

 

Meadow High School is the ‘Data Controller’ for the purposes of data protection law.

 

As a public body as we have appointed Grow Education Partners Ltd as our Data Protection Officer (DPO).  The responsible contact is David Coy (see contact us below)

1. The personal data we collect and hold.

We process data relating to those visiting our school. Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not limited to:

• Name
• Company/Institution details
• Vehicle registration details
• Closed-circuit television Images (CCTV) images and audio 
• Disclosure and Barring Service details
• Photo ID.

 

2. Why we collect and process this data.

The purpose of collecting and processing this data is to help us run the school efficiently, including but not limited to:

• Fulfilling our legal obligations in relation to Keeping Children Safe in Education and Health & Safety.
• Informing our operational procedures
• Complying with the law regarding data sharing.

3. Our lawful basis for using this data.

This section contains information about the legal basis that we are relying on when handling your information. These are defined under Data Protection legislation and for personally identifiable information are:

• Processing is necessary to comply with the legal obligations of the school.
• Processing is necessary for tasks in the public interest or exercise of authority vested in the school (the provision of education).

4.  How we store this data.

Your data will be stored in the Inventry sign in/registration system. CCTV images and audio will be stored on the CCTV hard drive.

5. Who we share information with.

In order for us to legally, effectively and efficiently function we are required to share data with appropriate third parties, including but not limited to:

 

• Ofsted - during a school inspection
• Security organisations - to create a secure environment for all
• Our auditors, to ensure our compliance with our legal obligations
• Public bodies, such as NHS England
• Professional advisers and consultants - for us to develop our services and best provide our public service
• Police forces, courts, tribunals and security services.

 

6. Transferring data internationally

We may send your information to other countries when:

• we or a company we work with store information on computer servers based overseas; or
• we communicate with you when you are overseas.

We conduct due diligence on the companies we share data with and note whether they process data in the UK, EEA (which means the European Union, Liechtenstein, Norway and Iceland) or outside of the EEA.

The UK and countries in the EEA are obliged to adhere to the requirements of the GDPR and have equivalent legislation which confer the same level of protection to your personal data.

For organisations who process data outside the UK and EEA we will assess the circumstances of how this occurs and ensure there is no undue risk.

Additionally, we will assess if there are adequate legal provisions in place to transfer data outside of the UK.

 

7. Data Protection Rights

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them.

If you make a subject access request, and if we do hold information about you, we can:

• Give you a description of it
• Tell you why we are holding and processing it, and how long we will keep it for
• Explain where we got it from, if not from you
• Tell you who it has been, or will be, shared with
• Let you know whether any automated decision-making is being applied to the data, and any consequences of this
• NOT provide information where it compromises the privacy of others
• Give you a copy of the information in an intelligible form.

You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.

In most cases, we will respond to subject access requests within 1 month, as required under data protection legislation However, we are able to extend this period by up to 2 months for complex requests or exceptional circumstances.

Your other rights regarding your data

You may;

• Withdraw your consent to processing at any time (This only relates to data for which the school relies on consent as a lawful basis for processing)
• Ask us to rectify, erase or restrict processing of your personal data, or object to the processing of it in certain circumstances and where sufficient supporting evidence is supplied
• Prevent the use of your personal data for direct marketing
• Challenge processing which has been justified on the basis of public interest, official authority or legitimate interests
• Request a copy of agreements under which your personal data is transferred outside of the United Kingdom.
• Object to decisions based solely on automated decision making or profiling (decisions taken with no human involvement, that might negatively affect you)
• Request a cease to any processing that is likely to cause damage or distress
• Be notified of a data breach in certain circumstances
• Refer a complaint to the ICO
• Ask for your personal data to be transferred to a third party in a structured, commonly used and machine-readable format (in certain circumstances)

The School will comply with the Data Protection legislation in regard to dealing with all data requests submitted in any format, although individuals are asked to preferably submit their request in written format to assist with comprehension.

Requests should include:

• Name of individual
• Correspondence address
• Contact number and email address
• Details of the request

 

If you would like to exercise any of the rights or requests listed above, please contact Meadow High School

• Email: meadow@meadowhighschool.org
• Phone: 01895 443310

We reserve the to verify the requester’s identity by asking for photo ID. If this proves insufficient, then further ID may be required.

Data Protection Breaches

If you suspect that yours or someone else’s data has been subject to unauthorised or unlawful processing, accidental loss, destruction, or damage, we ask that you please contact the DPO or school contact.

 

8. Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

 

To make a complaint, please contact our data protection officer, David Coy (contactable on david.coy@london.anglican.org, 020 3837 5145).

 

Alternatively, you can refer a complaint to the Information Commissioner’s Office:

• Report a concern online at https://ico.org.uk/concerns/
• Call 0303 123 1113
• Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

 

9. Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact either our School Data Protection Lead, Jack Barnes - meadow@meadowhighschool.org - 01895 443310 or our independent Data Protection Officer David Coy (contactable on david.coy@london.anglican.org, 02038375145).