Privacy Notice

Contents 

1.    Who collects your personal information 
2.    How St. Cuthbert’s RC Collect information 
3.    What information do we collect 
4.    How we use personal information 
5.    What is our legal basis for processing your personal information 
6.    Where do we store your data 
7.    How long is your personal information kept for 
8.    Who do we share your personal information with 
9.    How you can amend your data 
10.    Your rights and Freedoms under GDPR 
  
Who collects your personal information? 

St. Cuthbert’s RC High School  
Shaw Road 
Rochdale 
OL16 4RX 
 
The Primary school which your son/daughter has transferred from will also share admission data with the school. 
 
Rochdale Local Authority 
Number One Riverside 
Smith Street 
Rochdale 
OL16 1XU 

How do St. Cuthbert’s RC High School Collect information 

We collect information in a number of ways, through child transfer documents when a child is transferring from a primary school or another secondary school, via the local authority for admissions purposes, and from select 3rd party agencies such as the NHS for vaccination plans and Safeguarding reasons such as Greater Manchester Police. 
We also collect information when you make an enquiry to the school such as your name, address and date of birth, similar information is also recorded via our communication systems and social media. During a phone call we may also record the phone conversation. 

What information do we collect?

We collect personal information about parents and students to help us provide an education to your child. 
This will include but is not limited to,  
•    First name 
•    Middle name/s 
•    Surname 
•    Date of Birth 
•    Gender 
•    UPN and ULN Department of Education Numbers 
•    Behaviour information 
•    Attendance information 
•    Exam results 
•    Grades and reporting information  
•    Addresses 
•    Telephone numbers 
•    Email addresses 
•    Next of kin and parental/carer information (including name, address, and contact information) 
•    Any family links such as siblings at the school • Dietary requirements 
•    Medial information including Dr’s name and address 
•    Ethnic/Cultural information (Ethnicity, Languages Spoken, Asylum Status, National Identity, Country of Birth, Religion, Traveller Status and Date of Entry into the UK) 
•    Information about your eligibility for Free School Meals and Pupil Premium 
•    Armed forces service information 
•    Youth Services involvement 
•    Local Authority transport provisions 
•    Children in care status (Welfare status) 
•    Uniform allowance 
•    Learner Support (Special Educational Needs) 
•    Any agents/agencies that work with the student and or parents and carers 
•    Access arrangements (Disabled status) 
•    Child protection plan information 
•    Young Carer status 
•    CAF (Common Assessment Framework, child welfare assessment information) 
•    Supported Families information 
•    School history (start date, end date, destination after leaving, ground for removal, reason for leaving, previous schools) 
•    Parental/Carer consent (Copyright, internet access, photographing students, sex education, data exchange and school visits) 
•    Biometric information (for cashless catering) Separate opt in required for Biometrics 
•    School closed authorisation and choice 
•    Discretionary bus pass status 
•    Parents evening attendance 

How we use personal information?

Your information is used in a number of ways in school: 
•    Identification of students, visitors and parents 
•    Class registration 
•    Data collections (grades) 
•    3rd Party suppliers of programs and reporting tools such as Doddle Learn and Active Learn, parental information is shared with RSConnect for the purposes of home reporting via our MyED app. Room Booking Systems for the Parents Evening system. 
•    Communication with students and parents via text and email services 
•    Share statutory information with the Local Authority (Rochdale LA) and the Department for Education. 
•    The NHS, Police, Immigration Services and related services for the purposes of training and crime prevention. 
•    The sharing of news from the school via the social media platforms and website. 
•    Information is provided via our till system to our outside catering company and also shared with our online payment service. 
•    Safeguarding and behaviour teams may share restricted information to outside agencies who perform intervention or support tasks. 
•    Data will be shared to other schools if the student should move and relevant information will be provided to colleges or universities if the student moves into higher education. 
•    Information is used across the school to support the teaching staff in providing an education under the Education Act 1996, this is a statutory requirement under UK law. 
•    Information limited to name will be provided to Microsoft and Google for the purposes of email and authentication services. 
•    Additional information may be requested from parents/carers when there is a requirement either under UK law to do so, or the task the student wants to undertake requires that the information is provided. In all cases, this information will only be kept for the length of time that is required to fulfil the task and will then be deleted, an example of this is ID requirement for exams registration such as a passport. 
•    Census – We have to provide under UK Law a number of cense reports each year as our mandate states. 

What is our legal basis for processing your personal information?

We will only collect and use your personal information (as described in section 4) in accordance with data protection legislation. Our legal basis for processing your personal information are as follows: 
1.    Consent – When we ask you for your explicit consent to use you, or your child’s information – for example Biometrics 
2.    Contractual – the processing is necessary for a contract you have with an individual because they have asked you to take specific steps before entering into a contract – for example when signing up to Parentpay you are asking them to provide a service and as such are entering into a contract with them. 
3.    Legal Obligation – the processing is necessary to comply with the law. For example as a school we have legal obligations under the education act to provide an education to your child and also possess information about their parents and carers for communication. 
4.    Public Task – the processing is necessary for us to perform a task in the public interest or for our official functions and the task or the function has a clear basis in law – a number of reasons in school come under this for example we have to provide a safe learning environment so we follow Health and Safety regulations.  

Where do we store your data?

Almost all of the personal data we record is kept on the school premises in our central management system, this is encrypted and only accessible by members of staff who are deemed eligible to have access for their role in school. This is especially prudent where special category data is being processed (Race, Religion, Ethnic information, Politics, Religion, Trade Union Membership, Genetics, Biometrics, Health/Medical and Sexual Orientation).   
Some information is provided to 3rd parties such as Doddle Learn, Active Teach, MyMaths, Microsoft and Google for the purposes of providing learning platforms and utilities in school. No other information is shared with these platforms. 
Goupcall which is our registration provider alongside Capita Sims are provided with a limited data set which will enable staff to register students into classes, this is a statutory requirement, all information is kept on a server in school and uses the Microsoft Azure cloud for access outside of the school, this information is fully encrypted during transit and on devices used to access it. 
We have a statutory/legal obligation to share information with the Local Authority and the Department of Education, this is using a service called s2s and at all points is encrypted. 
The schools Safeguarding and Behaviour teams have data sharing agreements with certain outside agencies such as the Police, Public Health England and the NHS, CAMS, Social Services, UK Immigration Services. This is in the interest of the child in a safeguarding capacity under the Data Protection Bill 2018 Schedule 2 Exemptions. 

How long is your personal information kept for?

All personal information will be kept for the duration that the Department for Education deems legally acceptable. 
The school adheres to the Information and Records Management Society guidelines and a copy of their retention schedule can be found here. 
In simplistic terms, information about a student will be kept until their 25th birthday, where there has been special education needs, or involvement from Safeguarding services, this is extended to the child 35th birthday. 
Other information such as school lunches and attendance are only kept for around 3 years.  
Please contact the school if you wish to know the exact retention period for a specific data set. 
 

Who do we share your personal information with?

Information is shared with:  
•    Rochdale Local Authority (including special category data) 
•    Teens and Toddlers (Intervention agency) 
•    Microsoft (Office 365 and email) 
•    Google (Directory services for ICT Login) 
•    GMPF (Statutory requirement) 
•    NHS Health England (Statutory requirement) 
•    CAMS (Intervention Services) 
•    Groupcall Limited (Registration Services) 
•    Pearson Active Teach (Online learning platform) 
•    Doddle Learn (Online learning platform) 
•    MyMaths (Online learning platform) 
•    Maths Watch (Online Learning Platform) 
•    AQA Education (Exams) 
•    AutoDesk (Online learning Platform) 
•    Capita Education Software Services (Central management system) 
•    Department for Education (Statutory requirement) 
•    Parent Pay (Online payment services) 
•    P&A Food Management (Do not receive data, their employees process payments in school, data does not leave site) 
•    Disclosure and Barring service (Statutory requirement) 
•    H Tempest Limited (School photographs) 
•    HM Revenue and Customs (Statutory requirement) 
•    Home Office (Uk Visa and Immigration Status) 
•    Pearson (Exams) 
•    Oxford and Cambridge (Exams) 
•    Renaissance Learning (Online Learning Platform) 
•    Results Squared Limited (SMS messaging and parental app) 
•    Room Booking System (Parents evening bookings) • Sisra Analytics (Reporting tool) 
•    The Duke of Edinburgh’s Awards (DofE when students enrol) 
•    Toot Toot online bullying notification system 
•    We also share to a number of agencies for the purposes of Safeguarding children, this is in line with the Data Protection Bill, Schedule 2 Exemptions. 

This list is not exhaustive and may include 3rd party data processors when we have passed information onto the Local Authority and the Department for Education. If the information changes then the Privacy Policy will be updated on the school website www.scrchs.net 
 
How you can amend your data?

A majority of the information we collect in school is of a statutory nature and therefor some preferences cannot be changed. 
However, items that require consent such as using your son or daughters image within news items or opt in to biometric registration can be amended. 
If you would like to amend your preferences please contact the school on 01706 647761 or send a message via the secure MyEd app.  

Your rights and Freedoms under GDPR 

Under the General Data Protection Regulations you have a number of rights which are detailed below.  

You also have the right to request to see or receive a copy of the information we hold about you by requesting a Subject Access Request, we will need a copy of identification off you and detail describing what information you require. Once we have received this we will provide the information within a period of 30 days. Please note you can only request information about yourself. If you require other information please submit a Freedom of Information request. 

Article 15 – Access 

You have a right to access your own personal data, you can request this by sending an email to DPOSchools@Rochdale.Gov.UK we will need a copy of your id so we can prove it is you making the request, the information will be returned within 30 days. 

Article 16 - Rectification 

You have the right to request that information we hold about you is corrected or information that is missing is added. 
You can do this by contacting the school on 01706 647761, filling in a data collection sheet or visiting the school in person. 

Article 17 – Erasure 

You have the right to have certain information erased, this right does not apply to the majority of the information we hold about you as we perform a statutory function that acts in the public interest, therefore we have a legal obligation to keep the information until the retention period is reached. 
Where you do have the right to erasure is if you no longer want to use the Biometric cashless catering system, we will remove your fingerprint and ensure that it is deleted. 
To ask for the erasure of select information we hold about you please email our Data Protection office at DPOSchools@Rochdale.Gov.UK 

Article 18 – Restriction 

As we perform a statutory function you do not have the right to request a restriction on the processing of your personal information we hold for legal reasons. This however can be imposed by a court or the ICO in the case of investigation. 

Article 21 – Object 

You do not have the right to object to how your personal information is being used as we are performing a statutory function in providing an education.  

Article 20 – Portability 

You do have the right to portability, this applies when you are moving from one school to another, this is usually an automatic process but in certain cases such as moving to another school outside of the UK you can request that the information we hold about your child’s education record is sent to the school electronically. 

Article 22 – Profiling – Automated Decision Making 

You do have the right to object to profiling, this is creating profiles to place people into categories to determine an outcome, schools use this information to arrange people into groups based on attainment. However we do not automate this process and human decisions are always made, you have the right to ask that another look is taken with regards to a student being placed in a specific group or category, for example your son/daughter is placed in the 2nd set maths group, you think the decision to do this based on their grades is detrimental to their education, you have a right to ask that this information is looked at again to ensure the decision is accurate. 

Changes to our Privacy Notice 

We may change the information within this privacy notice when we would like to share information to a new agency or supplier, or if the statutory information we share changes under UK law. If this happens then we will notify all current members of the school community of this change.  

Contacting us 

If you need to contact us about Data Protection, want to submit a Subject Access 

Request or a Freedom of Information request please send an email to Rochdale Local Authority Data Protection Officer 

You can also contact the school directly at 
St. Cuthbert’s RC High School 
Shaw Road 
Rochdale 
OL16 4RX 
01706 647761