This policy explains how and why we collect your personal information, what we may do with that information and how long we retain it.
The EU General Data Protection Regulation (GDPR), which came into force in May 2018, includes rules on giving privacy information to those whose data is held by an organisation. These are more detailed and specific than in the Data Protection Act and place an emphasis on making privacy notices understandable and accessible. Data controllers are expected to take ‘appropriate measures’ to ensure that this is the case.
Hollygirt School interprets this requirement as using very clear language to explain the school’s responsibilities to each individual in the various groups of people (e.g. – parents of pupils) whose data we collect. GDPR identifies six principles for dealing with Personal Data. These can be summarised as follows:
• It is processed lawfully, fairly and in a transparent manner
• It is collected for specific, explicit and legitimate purposes
• Its use is adequate, relevant and limited to what is necessary for processing
• It is correct and, where necessary, this accuracy has a means of being maintained
• It is only retained for as long as necessary
Processing is undertaken in a manner that will protect its security. Personal Data is information that identifies you as an individual and specifically relates
to you. The GDPR says that the information provided to you about how the school processes your personal information must be:
Any information we collect and hold must be for:
• Legitimate interest – to allow us to operate the school, admit children to the school, deliver education and safeguard pupils, staff and the reputation of the
• Legal requirements – to fulfil our legal obligations to appropriate and relevant authorities and to safeguard children
There is sensitive personal information, such as ethnic origin and health information, which the school may collect, in order to satisfy social protection and social security laws, and legal claims, to communicate with insurers and legal advisors.
We see the provision of personal information (including sensitive information) as necessary to admit your child to the school, and for the school to fulfil its obligations under the contract once your child is a pupil here.
Information Collected Directly
This privacy notice will be provided to you at the time your data is being obtained, if it is being obtained directly from you.
On admission, data will be processed for the purposes of responding to requests for information about joining the school and the school will therefore have a “legitimate interest” for processing basic personal data and sensitive personal data. During the time your child is at Hollygirt the data the school holds will be the minimum it requires to form and maintain the contract between you and the school and to fulfil its legal obligations.
Information Collected Indirectly
For admissions, we will obtain the data the school requires from you and should we need data from other sources we will contact you within a month.
Whilst your child is a pupil, we may ask for information from other sources, such as reports from outside agencies, but it will always be treated as personal information and subject to the same rules for information collected directly from you.
The School uses no automated decision making or profiling in admissions to the School and in a pupil’s life throughout the school.
Sharing of Information
The school will share your data, when essential, with companies who have contracts with the school and which have equalled the school’s precautions and systems for dealing with data.
Examples of these are:
• Examination Boards
• Health care service provider
• IT Contractor
• IT software provider
• Trip organisers (but only for trips within the UK)
It is not necessary for data to be shared with other countries. The exception to this will be international trips that the school organises. Should a trip abroad be organised for your child, you will be contacted for your specific consent and that consent will be limited in time and content.
Retention of Information
The retention period for pupil data will be until the pupil reaches the age of 25, but modified, if necessary, by any other legal obligation under which the school has to operate.
Right to Withdraw Consent
You have the right to withdraw your consent to data processing at any time; however, this will only apply to certain groups of data for which you have given particular consent and should not compromise the School’s legal liability or its ability to fulfil the contract between you and the School.
Decisions about your Information
• ask us to rectify incorrect information we have on our system
• ask us to provide details of information on our system
• ask us to delete information that we hold in certain circumstances
• ask us to restrict our use of certain information as Confidential
We treat the safety of your information as an absolute priority, but if you have a complaint about the way in which we handle your information, please contact the Bursar at Hollygirt immediately in writing or by email (LauraHudson@hollygirt.notts.sch.uk). Please explain how you feel we have mishandled your data and the impact it has had on you.
We would appreciate the opportunity to resolve your issue within the school and will try to resolve your complaint within a month of your advising us.
You can complain at any time about how the school has handled your data, the Information Commissioner is available as follows: ICO helpline is 0303 123 1113. The website is www.ico.org.uk.