Policy key definitions:
- “I”, “our”, “us”, or “we” refer to the establishment, “St John Fisher Catholic Comprehensive School”.
- “you”, “the user” refer to the person(s) using this website.
- GDPR means General Data Protection Act.
- PECR means Privacy & Electronic Communications Regulation.
- ICO means Information Commissioner’s Office.
- Cookies mean small files stored on a users computer or device.
Processing of your personal data
Under the GDPR (General Data Protection Regulation) we control and/or process any personal information about you electronically using the following lawful bases.
- We are registered with the ICO under the Data Protection Register, our registration number is Z7106056.
Lawful basis: Consent
The reason we use this basis:
- We process personal information to enable us to;
- Provide education, training, welfare and educational services.
- Administer school property.
- Maintain our own accounts and records.
- Carry out fundraising.
- Support and manage our employees.
We use CCTV systems to monitor and collect visual images for security and the prevention of crime.
We process your information in the following ways:
The Type/Class of information processed
We include information relating to the above reasons/purposes. This information may include:
- Name and personal details
- Family, lifestyle and social circumstances
- Financial details
- Education details
- Employment details
- Student and disciplinary records
- Vetting checks
- Goods and services
- Visual images, personal appearance and behaviour
We also process sensitive classes of information that may include:
- Physical or mental health details
- Racial or ethnic origin
- Religious or other beliefs of a similar nature
- Trade union membership
- Sexual life
- Offences and alleged offences
Who the information is processed about
We process personal information about:
- Our students and pupils
- Advisers and other professional experts
- School staff
- Members of school boards
- Donors and potential donors
- Complainants and Enquirers
- Individuals captured by CCTV images
Who the information may be shared with
We sometimes need to share the personal information we process with the individual themselves and also other organisations. Where this is necessary we are required to comply with all aspects of the Data Protection Act (DPA). What follows is a description of the types of organisations we may need to share some of the personal information we process with for one or more reasons.
Where necessary or required we share information with:
- Education, training, careers and examining bodies
- School staff and boards
- Family, associates and representatives of the person whose personal data we are processing
- Local and central government
- Healthcare professionals
- Social and welfare organisations
- Police forces
- Current, past or prospective employers
- Voluntary and charitable organisations
- Business associates and other professional advisers
- Suppliers and service providers
- Financial organisations
- Security organisations
- Press and the media
It may sometimes be necessary to transfer personal information overseas. When this is needed information may be transfer to countries or territories around the world. Any transfers made will be in full compliance with all aspects of the data protection act.
The data controller also processes personal data which are exempt from notification.
Data retention period: We will continue to process your information under this basis until you withdraw consent, it is determined your consent no longer exists or the data retention period for the specific category of data retained has expired.
Sharing your information: We do share your personal information with third parties and they include;
Parent Mail https://www.parentmail.co.uk/gdpr
Behaviour Watch https://eduspot.co.uk/article/gdpr-statement/
If, as determined by us, the lawful basis upon which we process your personal information changes, we will notify you about the change and any new lawful basis to be used if required. We shall stop processing your personal information if the lawful basis used is no longer relevant.
Your individual rights
Under the GDPR your rights are as follows. You can read more about your rights in detail here;
- the right to be informed;
- the right of access;
- the right to rectification;
- the right to erasure;
- the right to restrict processing;
- the right to data portability;
- the right to object; and
- the right not to be subject to automated decision-making including profiling.
You also have the right to complain to the ICO [www.ico.org.uk] if you feel there is a problem with the way we are handling your data.
We handle subject access requests in accordance with the GDPR.
Some cookies are required to enjoy and use the full functionality of this website.
Cookies that we use are;
Used to manage the refresh of the announcement pop up display on the school home page.
wp-settings 2 and wp-settings-time-2:
Used for managing visual effects by the WordPress theme that is the basis of the school website.
Data security and protection
We ensure the security of any personal information we hold by using secure data storage technologies and precise procedures in how we store, access and manage that information. Our methods meet the GDPR compliance requirement.
Transparent Privacy Explanations
We have provided some further explanations about user privacy and the way we use this website to help promote a transparent and honest user privacy methodology.
Sponsored links, affiliate tracking & commissions
Our website does not contain adverts, sponsored and affiliate links that generate revenue for the school.
We do provide links to third party websites for non-commercial, informational purposes. We have no control over the ongoing content or reliability of the information provided on the third party websites.
If you have any concerns regarding the reliability or validity of a linked website, please do not click the link.
Email marketing messages & subscription
Under the GDPR we use the consent lawful basis for anyone subscribing to our newsletter or marketing mailing list. We only collect certain data about you, as detailed in the “Processing of your personal data” above. Any email marketing messages we send are done so through an EMS, email marketing service provider. An EMS is a third party service provider of software/applications that allows marketers to send out email marketing campaigns to a list of users.
Email marketing messages that we send may contain tracking beacons / tracked clickable links or similar server technologies in order to track subscriber activity within email marketing messages. Where used, such marketing messages may record a range of data such as; times, dates, I.P addresses, opens, clicks, forwards, geographic and demographic data. Such data, within its limitations, will show the activity each subscriber made for that email campaign.
Any email marketing messages we send are in accordance with the GDPR and the PECR. We provide you with an easy method to withdraw your consent (unsubscribe) or manage your preferences / the information we hold about you at any time. To unsubscribe from ParentMail or BehaviourWatch, please contact the school reception (01634 543123) or email your details to firstname.lastname@example.org
Our EMS providers are; ParentMail and BehaviourWatch. We hold the following information about you within our EMS system;
- Email address
- SMS mobile number
- I.P address
- Subscription time & date
Resources & further information
- Overview of the GDPR – General Data Protection Regulation
- Data Protection Act 1998
- Privacy and Electronic Communications Regulations 2003
- The Guide to the PECR 2003
- Small business GDPR policy template
Privacy Notice Policy Base: v.4.0 May 2018 – Made available without liability by Jamie King, Website management services.