Lambrook School is a data controller for the purposes of data protection legislation (UK General Data Protection Regulations – Data Protection Act 2018) as we process personal data. This notice is designed to give you information about how we process that data.
This policy is to be read in relation to other School policies including:
- Data Protection Policy
- Safeguarding Policy
- Complaints Procedure
Should you have any questions on this privacy policy, please contact info@lambrookschool.co.uk
What type of data we possess
This information will include:
- names, email addresses, contact details;
- parent banking or financial information;
- pupil assessment results, academic records, attendance information, any disciplinary or exclusion information;
- references from a previous school;
- any special educational needs pupils may have;
- where pupils go after they leave us and personal characteristics such as ethnic groups; and
- medical information for staff and pupils and contact details of next of kin and guardians.
We collect photographic images of our pupils which we use for purposes of identification and also for marketing purposes. Upon accepting an offer of a place at the School for your child, you will have been offered an opportunity to consent or otherwise to the use of your child’s photographic image for marketing purposes. We will not use images of pupils for marketing purposes where parental consent has not been explicitly given.
Images of parents, pupils and other visitors to the School will be captured by our CCTV system which monitors public areas including the main entrance used by visitors, the pedestrian and vehicle gates, and the entrances to all other School buildings. The School only has one CCTV camera inside
Lambrook House in the lobby outside the Headmaster’s office. These images are collected and stored in line with the Lambrook Security Statement and Data Protection Policy. The images do not leave School premises and are never shared with any third party, with the potential exception of law enforcement agencies in the event of a security breach. Images are kept for one month.
Keeping in Touch and Supporting the School – We fundraise from individuals, companies and foundations who may wish to support our charitable purposes and do so in accordance with the Fundraising Code of Practice. We analyse publicly available data about potential donors (e.g. from LinkedIn, Companies House, Charity Commission, Who’s Who, articles in publications) to create a profile of interests and preferences so that we can make appropriate requests. We carry out this analysis with care, avoiding solely automated processing or profiling, in order to respect individuals’ rights under data protection law.
We keep in touch with Old Lambrookians, current or former parents or other members of the School community. We will use your contact details to keep you updated about our charitable activities and invite you to events of interest by email and by post. We ask that contact preferences and detail changes are updated by contacting the School (info@lambrookschool.co.uk)
How we gather and use pupil information
We collect and hold personal information relating to our pupils and their parents directly from parent(s)/guardian(s) at the time of registration and joining the School and may also receive information about them from their previous School, local authority and/or the Department for Education (DfE). We do this for the legitimate interest of educating children. We also create personal information about the pupil during their time in the school in the form of assessments, marking of work and reports. We also create personal information for pupil safeguarding and welfare, including the use of CPOMS. We use this personal data:
- For the purposes of pupil assessment and to confirm the identity of prospective pupils and their parents.
- To provide education services (including SEN), digital remote learning education services, career services, and extra-curricular activities to pupils; monitoring pupils’ progress and educational needs; and maintaining relationships with alumni and the School community.
- For the purposes of management planning and forecasting, research and statistical analysis, and to enable the relevant authorities to monitor the School’s performance.
- To give and receive information and references about past, current and prospective pupils, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend.
- To enable pupils to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils of the School.
- To safeguard pupils’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency or accident, including by disclosing details of an individual’s medical condition where it is in the individual’s interests to do so, for example for medical advice, insurance purposes or to organisers of School trips.
- To monitor (as appropriate) use of the School’s IT and communications systems in accordance with the School’s ICT Acceptable Use Policy.
- To facilitate operation management of the school, including the compilation of pupil records, the administration of invoices, fees and accounts, the management of security and safety arrangements (including the use of CCTV in accordance with our CCTV policy), the maintenance of historic archives, and other operational purposes.
- To make use of photographic images of pupils for identification purposes and in School publications, on the School website and (where appropriate) on the School’s social media channels, where parental permission has been given, and in accordance with the School’s ICT Acceptable Use Policy.
- For security purposes, and for regulatory and legal purposes (for example child protection and health and safety) and to comply with its legal obligations.
- Where otherwise reasonably necessary for the School’s purposes, including to obtain appropriate professional advice and insurance for the School.
How we gather and use parent information
We collect and process personal data relating to the parents of pupils at the School at the time of registration and joining Lambrook. This data is used:
- For contractual purposes and/or to enable the payment of fees.
- To keep parents informed and provide accurate information relating to ongoing events and activities held within the school. This communication may take the form of the School e-newsletter or may be communicated directly through telephone, email or post.
- For our or a third party’s legitimate interests. ‘Legitimate interests’ include our interests in providing the best education possible to our pupils, fostering relationships with those in the school community including Old Lambrookians and their parents, current pupils and parents, including for fundraising purposes and for keeping in touch, and our interests in managing and operating the School;
- Upon accepting an offer of a place at the School for a child, parents will have been offered an opportunity to consent or otherwise to our sharing contact information with other parents in the child’s cohort. The purpose of this sharing of information is to facilitate the wider School community. We will not share contact information with the child’s cohort unless explicit consent has been given.
Who has access to personal data?
For the most part, personal data held by the School will remain within the School and will be processed by appropriate members of staff for the purpose for which the data was collected. Personal data, for example, will be used in communication with parents and senior schools, the organisation and management of classes and small groups within classes, assessment, organisation, school fixtures / team selection.
As an organisation, we have taken appropriate technical steps to protect your personal data and have implemented policies addressing use of technology. Particularly strict rules of access apply in the context of medical records and pastoral or safeguarding file although a certain amount of information will need to be disseminated more widely in order to provide the necessary care and education that the pupil requires (for example, details of any allergies or life threatening medical conditions).
Some of the School’s systems are provided by third parties with some being hosted by the School and others externally. Those hosted externally include the School’s website, Microsoft 365, SOCS and iSAMS. The organisations providing these systems are aware of the requirements of current data protection legislation.
In certain circumstances, we share personal data (including, where necessary, special category personal data) with third parties in order to further the objectives and interests of the School and facilitate the efficient operation of the School. Examples of the third parties with whom we share personal data are relevant authorities (such as the Local Children Safeguarding Board, the Charity Commission, the Independent Schools Inspectorate, the Information Commissioner), the emergency services, third parties who run or support academic, musical, sporting or co-curricular tuition, activities and training or school trips on behalf of or in conjunction with the School.
At the time that your child transitions to another School, we will share transfer reports about your child with their next School which may also include exam results. We are required, by law, to pass certain information about our pupils to our local authority (LA) and the Department for Education (DfE). DfE may also share pupil level personal data that we supply to them, with third parties. This will only take place where legislation allows it to do so and it is in compliance with the Data Protection Act 2018.
Consent for the sharing of data in this way may be given or withdrawn by you at any time during your child’s attendance at the School. If you wish to change your consent, please contact the Lambrook School Office.
How long do we keep data for?
Personal data will be kept securely and for no longer than is necessary or required by law. As this period will vary depending on the piece of personal data and the purpose for which it was collected, we follow a records and retention policy which details the time periods for each different category. If you have any specific questions in respect of retention, please direct them to the Compliance Officer at hr@lambrookschool.co.uk
It should be noted that records considered by the School to be of historic value are retained and passed to County Archive Services indefinitely. Personal data in the archive relating to living individuals which is not otherwise in the public domain is not shared with third parties without that individuals’ consent.
When your child leaves the School, you (and your child if s/he has reached the age of 13) will be offered the opportunity to be included in our Alumni programme. A separate Privacy Notice regarding the processing of your data for Alumni purposes will be provided to you at that time.
If you would like to receive a copy of the information about yourself, or your son/daughter that we hold, please contact info@lambrookschool.co.uk.
Your rights
Please see your rights as a ‘data subject’, which are the same as if you were any member for the public, under applicable data protection legislation from the Information Commissioner’s Office website available at www.ico.org.uk.
You have the following rights:
- to obtain access to, and copies of, the personal data that we hold about you or your child;
- to require us to correct the personal data we hold about you or your child if it is incorrect;
- to require us (in certain circumstances) to erase your or your child’s personal data;
- to request that we restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
- to receive from us the personal data we hold about you or your child which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller;
- to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.
Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. The school will endeavour to respond to any such requests as soon as is reasonably practicable and in any event within statutory time-limits (which is generally one month, but actually fulfilling more complex or multiple requests, e.g. those involving third party information, may take 1-2 months longer).
Complaints
If you have any complaint about the way that your data is handled please refer to the School’s Complaints Policy. If after following the complaints process you think we have not dealt with your request for information properly, you can complain to the Information Commissioners Office.
If you would like to exercise any of your rights under data protection law for which we are the data controller, please make your request to headmaster@lambrookschool.co.uk
This Privacy Notice will be updated from time to time. Any substantial changes that affect how we process personal data will be notified on our website and to parents directly, as far as practicable.