Data Protection and Privacy

Norbury Manor Primary School is committed to protecting the privacy and personal information of our pupils, parents and carers, staff and wider school community.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other relevant data protection legislation.

Norbury Manor Primary School is the Data Controller for the personal information that we collect and use.

Why we collect personal information

We collect and use information about pupils and their families for a range of purposes connected with providing education and operating the school. These include:

supporting teaching, learning and pupil progress;
providing appropriate pastoral care and support;
safeguarding and promoting the welfare of pupils;
supporting pupils with special educational needs and/or disabilities;
monitoring attendance and behaviour;
assessing and reporting pupil achievement;
communicating with parents and carers;
managing admissions and transitions;
meeting our legal and statutory responsibilities;
managing school services and resources; and
evaluating and improving the education and services we provide.

We only collect and use personal information where we have a lawful basis for doing so.

Depending on the purpose, this may include complying with a legal obligation, carrying out a public task, protecting someone's vital interests, pursuing a legitimate interest where appropriate, or obtaining consent where consent is the appropriate lawful basis.

Information we may hold

The information we hold about pupils may include:

names, addresses and contact information;
date of birth and pupil identifiers;
parent and carer information;
attendance information;
assessment, attainment and progress information;
behaviour information;
information about special educational needs and disabilities;
medical, health and dietary information;
safeguarding and pastoral information;
ethnicity, language and other information required for statutory purposes;
eligibility for support such as free school meals and Pupil Premium; and
photographs and videos where these are used for legitimate school purposes or where the appropriate permission or consent has been obtained.

Some of this information is classed as special category data and receives additional protection under data protection law.

Sharing information

We may share information where this is necessary and lawful. Depending on the circumstances, this may include sharing information with:

the Department for Education (DfE);
Croydon Council and other local authorities;
other schools or education settings when a pupil transfers;
health services and other professionals supporting a child;
safeguarding partners and children's services;
examination, assessment and education service providers;
organisations providing services to the school, such as our management information, communication, payment and learning platforms; and
other organisations where we are legally required or permitted to share information.

We do not need consent to share information where the law requires or permits us to do so, including where information needs to be shared to safeguard a child.

Where organisations process personal information on the school's behalf, appropriate data protection arrangements are put in place.

Photographs, videos and media

Photographs and videos are an important part of school life. They may be used to celebrate pupils' achievements, record learning and activities, and share the work of the school.

Images and videos in which a pupil can be identified are personal data and are managed in accordance with data protection and safeguarding requirements. Current DfE guidance specifically recognises uses including newsletters, websites, social media, performances, trips and classroom displays.

For uses where the school relies on parental/carer permission or consent, preferences are recorded through MyChildAtSchool (MCAS).

Parents and carers can review or change their preferences. Where consent is the lawful basis for processing, consent can be withdrawn at any time.

Before publishing photographs or videos, the school will also consider safeguarding requirements. We will not knowingly publish images that could place a pupil at risk or identify a pupil where there are safeguarding reasons why their identity should be protected.

The ICO confirms that schools need a lawful basis for official use of identifiable photographs and recommends that pupils are given an opportunity to opt out of their image being used, regardless of the lawful basis relied upon.

How long we keep information

We do not keep personal information for longer than necessary.

Information is retained and securely disposed of in accordance with the school's Data Retention Schedule and Data Protection Policy, taking account of statutory requirements and recommended retention periods.

Your data protection rights

Depending on the circumstances and the lawful basis being used, individuals have a number of rights regarding their personal information. These can include the right to:

be informed about how personal information is used;
request access to personal information held about them;
ask for inaccurate information to be corrected;
request erasure of information in certain circumstances;
request restriction of processing in certain circumstances;
object to certain types of processing; and
withdraw consent where processing is based upon consent.

Some rights are subject to exemptions and do not apply in every circumstance.

Privacy Notices

Our Privacy Notices provide more detailed information about the personal information we collect, why we collect it, our lawful bases for processing, who information may be shared with, how long it is retained and the rights of individuals

Data Protection Officer

If you have any questions about how the school collects, uses or protects personal information, or you wish to exercise one of your data protection rights, please contact:

Data Protection Officer
Norbury Manor Primary School
Email: DPO@nmp.croydon.sch.uk

If you are unhappy with the way the school has handled your personal information, you can also raise a concern with the Information Commissioner's Office (ICO).