Privacy Policy

1. Privacy notice for Students/Parents

Under General Data Protection Regulation (UK GDPR), tailored by the Data Protection Act 2018, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about students and parents.

We, SMMA: The Courtyard, Magdalene Gardens, Holloway Road, Islington, London, N7 8LT, are the ‘data controller’ for the purposes of data protection law.
The school’s Data Controller is Deborah Shepherd, Headteacher
Our externally appointed Data Protection Officer (DPO) is Claire Mehegan, Data Protection Services, Grow Partners Ltd provided by London Diocesan Board for Schools (LDBS), (see ‘Contact us’ below).

The personal data we hold
Personal data that we may collect, use, store and share (when appropriate) about students and parents includes, but is not limited to:
● Personal information (such as name, unique student number and address, parent’s National Insurance Number)
● Contact details and preference (contact telephone numbers, email addresses and home addresses).
● Results of internal assessments and externally set tests.
● Student and curricular records.
● Characteristics, (such as ethnicity, religion, language, nationality, country of birth and free school meal eligibility).
● Exclusion information.
● Behavioral Information.
● Relevant medical information (such as NHS information, health checks, physical and mental health care, immunisation program and allergies).
● Special educational needs information - EHCP’s.
● Attendance information such as data scores, tracking, and internal and external testing).
● Safeguarding information.
● Details of any support received, including care packages, plans and support providers.
● Photographs (for internal safeguarding & security purposes, school newsletters, media and promotional purposes).
● CCTV images captured in school.

We may also hold data about students that we have received from other organisations, including other schools, local authorities and the Department for Education.

Why we use this data

We use this data to:
● Support student learning.
● Monitor and report on student progress.
● Provide appropriate pastoral care.
● Ensure we can safeguard our students and protect student welfare.
● Assess the quality of our services.
● Administer admissions waiting lists.
● Carry out research.
● Comply with the law regarding data sharing.
● Inform you about events and other things happening in the school.

Our lawful basis for using this data
We only collect and use students’ personal data when the law allows us to. Most commonly, we process it where:
● We need to comply with a legal obligation.
● We need it to perform an official task in the public interest.
Less commonly, we may also process students’ personal data in situations where:
● We have obtained consent to use it in a certain way.
● We need to protect the student’s vital interests (or someone else’s interests).
● Processing is necessary for the student’s legitimate interests or the legitimate interests of a third party.
Where we have obtained consent to use students’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.
Some of the reasons listed above for collecting and using students’ personal data overlap, and there may be several grounds which justify our use of this data.
A full breakdown of the information we collect on students can be in our record of Data Processing which is available upon request.

Collecting this information
While the majority of information we collect about students is mandatory, there is some information that can be provided voluntarily.
Whenever we seek to collect information from you or your child, we make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.

How we store this data

We keep personal information about students while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary in order to comply with our legal obligations. This data is stored on a virtual G-drive. We take appropriate technical and organisational measures to safeguard the data.

Who we share Data with.
We do not share information about students with any third party without consent unless the law and our policies allow us to do so.
Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about students with third parties, including but not limited to:
● A local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and exclusions.
● The Department for Education.
● The student’s family and representatives.
● Educators and examining bodies.
● Our regulators [ESFA, Ofsted, Independent Schools Inspectorate].
● Suppliers and service providers – to enable them to provide the service we have contracted them for.
● Central and local government.
● Our auditors.
● Our Sponsors.
● Survey and research organisations.
● Health authorities (NHS).
● Security organisations.
● Health and social welfare organisations.
● Professional advisers and consultants.
● Charities and voluntary organisations.
● Police forces, courts, tribunals.
● Professional bodies.
● Schools that a student attends after leaving us.
● Financial organisations.

Where we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

Why we share information.

National Student Database
We are required to provide information about students to the Department for Education as part of statutory data collections such as the school census.
This data sharing underpins school funding and educational attainment policy and monitoring.
We are required to share information about our students with our local authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Students) (England) Regulations 2013.
Some of this information is then stored in the National Student Database (NPD), which is owned and managed by the DfE and provides evidence on school performance to inform research.
The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.
The DfE may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.
For more information, see the DfE’s webpage on how it collects and shares research data.
You can also contact the Department for Education with any further questions about the NPD.
Youth support services
Once our students reach the age of 13, we are legally required to pass on certain information about them to their residential Local Authority or Youth Support Services provider, as it has legal responsibilities regarding the education or training of 13-19 year-olds.
This information enables it to provide youth support services, post-16 education and training services, and careers advisers.
Parents/carers, or students once aged 16 or over, can contact our data protection lead to request that we only pass the individual’s name, address and date of birth to the Local Authority or Youth Support Services provider.

Transferring data internationally
Where we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

Parents and students’ rights regarding personal data

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them.
Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.
Parents also have the right to make a subject access request with respect to any personal data the school holds about them.
If you make a subject access request, and if we do hold information about you or your child, we will:
● Give you a description of it.
● Tell you why we are holding and processing it, and how long we will keep it for.
● Explain where we got it from, if not from you or your child.
● Tell you who it has been, or will be, shared with.
● Let you know whether any automated decision-making is being applied to the data, and any consequences of this.
● Give you a copy of the information in an intelligible form.

Individuals also have the right for their personal information to be transmitted electronically to another organisation in certain circumstances.
We reserve the right to verify the requesters identification by asking for Photo ID, if this proves insufficient then further ID may be required.

If you would like to make a request please contact our Data Controller/Headteacher: (deborah.shepherd@smmacademythecourtyard.org)
Parents/carers also have a legal right to access to their child’s educational record. To request access, please contact the School’s Headteacher: deborah.shepherd@smmathecourtyard.org

Other rights
Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe, including the right to:
● Object to the use of personal data if it would cause, or is causing, damage or distress.
● Prevent it being used to send direct marketing.
● Object to decisions being taken by automated means (by a computer or machine, rather than by a person).
● In certain circumstances, have inaccurate personal data corrected, deleted or destroyed, or restrict processing.
● Claim compensation for damages caused by a breach of the data protection regulations.
To exercise any of these rights, please contact the schools Data Controller: (deborah.shepherd@smmacademythecourtyard.org)

Data Protection Breaches
If you suspect that yours or someone else’s data has been subject to unauthorised or unlawful processing, accidental loss, destruction or damage. Then we ask that you please contact Deborah Shepherd, Data Controller/Headteacher of The Courtyard School, and advise us without undue delay.

Complaints
We take any complaints about our collection and use of personal information very seriously.
If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint you can follow the school’s complaints policy procedure that is available on its website or alternatively contact the School’s Data Controller: deborah.shepherd@smmacademythecourtyard.org

Alternatively, you can make a complaint to the Information Commissioner’s Office:
● Report a concern online at https://ico.org.uk/concerns/
● Call 0303 123 1113
● Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Contact us
If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data controller:
Deborah Shepherd, Headteacher, St Mary Magdalene Academy: The Courtyard, St Mary Magdalene Gardens, Holloway Road, London, N7 8LT.

Data Protection Officer: Grow Partners LTD, London Diocesan Board for Schools (LDBS), London Diocesan House, 36 Causton Street, London, SW1P 4AU, Phone Number: 020 7932 1100 Email address: schoolsDPO@london.anglican.org

2. Privacy notice for staff
Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about individuals we employ, or otherwise engage, to work at our school.

We, SMMA: The Courtyard, St Mary Magdalene Gardens, Holloway Road, London, N7 8LT, are the ‘data controller’ for the purposes of data protection law.
Our data controller is Deborah Shepherd, Headteacher, SMMA: The Courtyard, St Mary Magdalene Gardens, Holloway Road, London, N7 8LT. (see ‘Contact us’ below).

Our externally appointed Data Protection Officer (DPO) is Claire Mehegan, Data Protection Services, Grow Partners Ltd provided by London Diocesan Board for Schools (LDBS), (see ‘Contact us’ below).

The personal data we hold
We process data relating to those we employ, or otherwise engage, to work at our school. Personal data that we may collect, use, store and share (when appropriate) about you includes, are not limited to:
● Personal information (such as name, address, national insurance number).

● Contact details and preference (contact telephone numbers, email addresses, addresses).

● Characteristics (such as ethnicity, religion, language, nationality, country of birth).

● The terms and conditions of your employment.
● Details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation.
● Information about your remuneration, including entitlement to benefits such as pensions or insurance cover.
● Details of your bank account and national insurance number.
● Information about your marital status, next of kin, dependents and emergency contacts.
● Information about your entitlement to work in the UK.
● Information about your criminal record.
● Details of your schedule (days of work and working hours) and attendance at work.
● Details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave.
● Details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence.
● Assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence.
● Information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments and fulfil its duty of care (including the use of Occupational Health Services).
● Details of trade union membership where provided by yourself or your trade union.
● Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief where this has been provided.
● Photographs (for internal safeguarding & security purposes, school newsletters, media and promotional purposes).
● CCTV images.

We may also hold personal data about you from third parties, such as references supplied by former employers, information provided during the completion of our pre-employment checks, and from the Disclosure & Barring Service, in order to comply with our legal obligations and statutory guidance.

Why we collect and use this data
The purpose of processing this data is to help us recruit staff and run the school efficiently, including but not limited to:
● Enable you to be paid and other benefits be provided.
● Facilitate safe recruitment, as part of our safeguarding obligations towards students.
● Fulfil our legal obligations in recruiting staff.
● Support effective management of the school workforce, along with the implementation of its policies and procedures.
● Respond to any staffing issues.
● Assess the quality of our services.
● Support effective performance management.
● Inform our recruitment and retention policies.
● Allow better financial modelling and planning.
● Enable ethnicity and disability monitoring.
● Improve the management of workforce data across the sector.
● Support the work of the School Teachers’ Review Body.

Our lawful basis for using this data
We only collect and use personal information about you when the law allows us to. Most commonly, we use it where we need to:
● Fulfil a contract we have entered into with you.
● Comply with a legal obligation.
● Carry out a task in the public interest.
Less commonly, we may also use personal information about you where:
● You have given us consent to use it in a certain way.
● We need to protect your vital interests (or someone else’s interests).
● Processing is necessary for your legitimate interests or the legitimate interests of a third party.

Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent, and explain how you go about withdrawing consent if you wish to do so.
Some of the reasons listed above for collecting and using personal information about you overlap, and there may be several grounds which justify the school’s use of your data.
A full breakdown of the information we collect on staff can be found herein the record of data processing which can be provided upon request.

Collecting this information
While the majority of information we collect from you is mandatory, there is some information that you can choose whether or not to provide to us.
Whenever we seek to collect information from you, we make it clear whether you must provide this information (and if so, what the possible consequences are of not complying), or whether you have a choice.

How we store this data
We create and maintain an employment file for each staff member. The information contained in this file is kept secure and is only used for purposes directly relevant to your employment.
Once your employment with us has ended, we will retain this file, holding onto the data for 5 years as part of the GDPR expectations. Afterwards the information will be deleted.
Who share this Data with.
We do not share information about you with any third party without your consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about you with:
● A local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and information about head teacher performance and staff dismissals.
● The Department for Education - to meet our legal obligations to share certain information with it.
● Your family or representatives - such as in the event of an emergency.
● Educators and examining bodies - such as ensuring we adhere to examining regulations to guarantee the validity of examinations.
● Our regulators [ESFA, Ofsted, Independent Schools Inspectorate].
● Suppliers and service providers – to enable them to provide the service we have contracted them for, such as payroll.
● Financial organisations, e.g., Pension Scheme
● Central and local government - such as workforce analysis, HMRC.
● Our auditors - to ensure our compliance with our legal obligations.
● Our Sponsors.
● Survey and research organisations.
● Trade unions and associations - to enable them to provide the service their members require.
● Health authorities and Occupational Health and employee support schemes – to ensure the wellbeing of our staff body in accordance with our responsibilities as employer.
● Security organisations – to create a secure workplace for staff.
● Health and social welfare organisations.
● Professional advisers and consultants.
● Charities and voluntary organisations.
● Police forces, courts, tribunals.
● Professional bodies.
● Employment and recruitment agencies.
● Future Employers.

Transferring data internationally
Where we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

Why we share your information.
We do not share information about you with anyone without consent unless the law and our policies allow us to do so.

Local authority
We are required to share information about our workforce members with our local authority (LA) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.

Department for Education (DfE)
We share personal data with the Department for Education (DfE) on a statutory basis. This data sharing underpins workforce policy monitoring, evaluation, and links to school funding / expenditure and the assessment educational attainment. We are required to share information about our staff with our local authority (LA) and the Department for Education (DfE) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.

We are required to share information about our staff with the (DfE) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.

Your rights
How to access personal information we hold about you.
Individuals have a right to make a ‘subject access request’ to gain access to personal information that the school holds about them.
If you make a subject access request, and if we do hold information about you, we will:
● Give you a description of it.
● Tell you why we are holding and processing it, and how long we will keep it for.
● Explain where we got it from, if not from you.
● Tell you who it has been, or will be, shared with.
● Let you know whether any automated decision-making is being applied to the data, and any consequences of this.
● Give you a copy of the information in an intelligible form.
You may also have the right for your personal information to be transmitted electronically to another organisation in certain circumstances.
We reserve the right to verify the requesters identification by asking for Photo ID, if this proves insufficient then further ID may be required.
If you would like to make a request please contact the school’s data controller, see below.

Your other rights regarding your data
Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe. You have the right to:
● Object to the use of your personal data if it would cause, or is causing, damage or distress.
● Prevent your data being used to send direct marketing.
● Object to the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than by a person).
● In certain circumstances, have inaccurate personal data corrected, deleted or destroyed, or restrict processing.
● Claim compensation for damages caused by a breach of the data protection regulations.
To exercise any of these rights, please contact the school’s data controller, see below.

Data Protection Breaches
If you suspect that yours or someone else’s data has been subject to unauthorised or unlawful processing, accidental loss, destruction or damage, then we ask that you please contact Deborah Shepherd, Headteacher at SMMA: The Courtyard and advise us without undue delay.

Complaints
We take any complaints about our collection and use of personal information very seriously.
If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.
To make a complaint, please contact the Data Controller/Headteacher: Deborah Shepherd.
Alternatively, you can make a complaint to the Information Commissioner’s Office:
● Report a concern online at https://ico.org.uk/concerns/
● Call 0303 123 1113
● Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Contact us
If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our Data Protection officer:
Data Protection Officer: Claire Mehegan, Data Protection Services, Grow Partners LTD, London Diocesan Board for Schools (LDBS), London Diocesan House, 36 Causton Street, London, SW1P 4AU, Phone Number: 020 7932 1100 Email address: claire.mehegan@london.anglican.org