Data Protection
Data Protection Statement
At Malvern Wyche C of E Primary School, we take the privacy, security, and confidentiality of our pupils, parents, staff, and visitors very seriously. We comply strictly with the UK GDPR and the Data Protection Act 2018 to ensure all personal data is handled lawfully, fairly, and transparently.
1. Why We Collect and Use Information
Because we are a primary school, we must collect and process personal data to run effectively and meet our legal requirements. We use this data to:
-
Support pupil learning, academic progress, and well-being.
-
Provide vital pastoral care and protect pupil welfare.
-
Monitor and report on pupil progress and attendance.
-
Assess how well our school is doing as a whole.
-
Comply with the law regarding statutory data sharing with the local authority and the Department for Education (DfE).
2. The Categories of Pupil Information We Collect
This includes, but is not limited to:
-
Personal identifiers: Names, unique pupil numbers (UPN), addresses, and contact details.
-
Characteristics: Ethnicity, language, nationality, country of birth, and free school meal eligibility.
-
Attendance data: Sessions attended, number of absences, and absence reasons.
-
Assessment results: Early Years Foundation Stage (EYFS), Phonics screening, and Key Stage 1/2 profiles.
-
Medical information: Relevant medical conditions, allergies, and dietary requirements.
-
Special Educational Needs (SEN): Learning plans, support requirements, and specialist assessments.
-
Behavioural information: Exclusions, event logs or specific behavioural support records.
3. The Lawful Basis for Processing
We only collect and use pupil information when the law allows us to. Most commonly, we process data because:
-
Legal Obligation: It is required by law (e.g., the Education Act 1996).
-
Public Task: It is necessary to perform our official duties as a school and provide an education.
-
Consent: For optional activities where we ask for clear permission (e.g., school photos, marketing materials, or using specific digital learning apps). Parents can withdraw this consent at any time.
4. Storing and Sharing Data
We keep personal data safe using secure computer systems and locked physical filing cabinets. We only store data for as long as required by educational record-keeping guidelines.
We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so. We routinely share pupil information with:
-
Schools that the pupil attends after leaving us.
-
Our Local Authority.
-
The Department for Education (DfE).
-
NHS teams (e.g., school nurses for vaccination programmes).
We use Seesaw as an online learning journal to document pupil learning, share announcements, and facilitate communication between teachers, pupils, and parents.
-
Data Collected: To set up accounts, we share minimal personal data with Seesaw, including the pupil's name, class, and school email/identifier. The platform also stores pupil work, photographs, videos, and teacher feedback.
-
Lawful Basis: We process this data under Public Task (as it supports the delivery of the curriculum and parental engagement) and Consent where parental media permissions are required for photos or videos.
-
Data Security & Privacy: Seesaw acts as a data processor and complies fully with UK data protection regulations. Data is encrypted in transit and at rest. Seesaw does not own the student data, sell it, or use it for advertising purposes.
-
Parental Access: Parents are provided with secure, individual login credentials to view only their own child's journal.
5. Your Rights
Parents and pupils have the right to request access to the information we hold about them via a Subject Access Request (SAR). You also have the right to ask for inaccurate data to be corrected, or in some cases, erased.
You have the right to opt in or out of Seesaw at any time. Please contact the DPO for more details.
6. Contact Our Data Protection Officer
If you have any questions, concerns, or wish to exercise your data rights, please contact our school office or our designated Data Protection Officer (DPO):