high standards of confidentiality

GDPR - DATA PROTECTION AND PRIVACY POLICY

POLICY SECTION:

School Welfare as of:

11/09/2019

INTRODUCTION

The Schools Trust (and schools chartered by the Trust) is committed to maintaining high standards of confidentiality and privacy concerning the processing of personal information.

This Policy sets out the obligations of TST and its employees when processing personal data about individuals, as well as explain the rights parents, students and staff have as determined by applicable local laws, including the European Union (“EU”) General Data Protection Regulation (“GDPR”) and the UK Data Protection Act 2018.

PERSONAL DATA

This policy applies to all Personal Data collected for or on behalf of the School whether in analogue form (documents and forms in writing) or digital form (such as information systems, databases and emails). The School needs to know the necessary personal data of parents, staff, service providers, volunteers, candidates and interns (such as but not limited to contact details, dates of birth, languages, gender, diplomas achieved, and criminal background checks) and students (including names, addresses, dates of birth, languages, academic progress, examination results and behaviour records). Personal data can also include medical data, CCTV footage, photos and video recordings.

The legal basis for processing Personal Data

Personal Data will be collected, processed and stored for the enrolment and education of students, contacting parent or guardians, the employment of staff or the execution of contracts and agreements with the School. This is in accordance with the lawful basis provided under Article 6(1)(b) of the GDPR, namely that such processing is necessary for
the performance of the contracts or agreements to which parents, staff, service providers, volunteers, candidates and interns are party with TST or TST schools, or in order to take steps upon their explicit request prior to entering into such a contract or agreement with them.

There are further lawful bases for collecting and processing Personal Data. These include that the School has legitimate interests in providing children with an education, safeguarding and promoting the welfare and facilitating the efficient operation of the School, without any adversarial effect on children, and protecting vital interests to prevent injury or harm. It may also process personal data to meet a legal obligation or if it is acting in the public interest.

How is Personal Data used

The TST and TST Schools collect Personal Data of parents, students, staff, service providers, volunteers and interns to provide a safe and caring international environment for teaching, learning and general educational purposes. TST and TST Schools use the information provided for purposes that are necessary and required to undertake the performance of the contract or agreement into which you have entered and, in some cases, as we are required to do by law.

TST and TST schools may use the Personal Data provided in many ways including the following:

• to undertake and manage the School admissions and enrolment

• to provide a safe learning environment

• to comply with child protection requirements

• to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of

• to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of progress

• to provide support and care for emotional and psychological well-being (pastoral and counselling)

• to protect the health of the parents, students, staff, service providers, volunteers and interns. TST and TST Schools may also use Personal Data provided to the School by health professionals to safeguard parents, students, staff, service providers, volunteers and interns

• to provide a tailored learning environment and make evidence-based educational decisions for the children we serve

• to enable students to continue or progress their education at other educational organisations

• to support and develop staff in the performance of their duties
  for financial reasons to help in future planning and resource investment purposes

• to meet statutory reporting requirements

• to the education and other authorities

• to help investigate any concerns or complaints which parents, students, staff, service providers, volunteers and interns may have

• to communicate with parents, students, staff, service providers, volunteers and interns

In the course of its processing, the Personal Data may be disclosed to third parties to protect students’ vital interests (e.g. where students and/or staff are away on trips or sporting activities). Such third parties may be located both within and outside the EU. Third parties who are located in the EU will only have access to Personal Data where the law allows them to do so.

Where Personal Data is disclosed to third parties located in countries outside the EU which do not ensure an adequate level of protection for Personal Data, the disclosure of such Personal Data will rely on the protection of the vital interests of students, parents, staff, service providers, volunteers, candidates and interns or explicit consent as set out in Article 49(1)(f) and Article 49(1)(a) GDPR respectively.

For the purposes of IT hosting and maintenance, data is located on servers within the School, and where hosted external to the School the appropriate protections are in place to evidence compliance with Article 32 of the GDPR - Security of Processing.

Personal Data will not be retained for longer than required for its processing and reasonable subsequent data retention, subject to any limitation periods provided by the law.

Why Personal Data is collected and used TST AND TST SCHOOLS collect and use Personal Data to carry out the education services as described above. TST AND TST SCHOOLS does so under the legal basis that the processing is necessary for the performance of a contract or agreement.

In some circumstances, TST AND TST SCHOOLS may have to process Personal Data for other purposes that are not necessary for the performance of the contract. Where this is the case, TST AND TST SCHOOLS will either have a legitimate interest to do so, need to do so as there is a legal requirement, or that it is in the vital interests of the individual for the School to process or share the Personal Data. From time to time the School may ask for explicit consent to process or transfer data for reasons that sit outside those detailed herein.

Special Categories of Data

The education services TST AND TST SCHOOLS require the School to collect and process special categories of data for safeguarding, the protection of vulnerable children, and wellbeing of those within its care. TST AND TST SCHOOLS do not disclose or share special categories of data without explicit and unambiguous consent unless required to do so by law, or it is in the vital interests of an individual, or where not doing so would place someone else at risk.

Some categories of data such as ethnicity, age and gender may be used from time to time in forecasting and planning for educational service provision. If used in this way, Personal Data will be anonymised.

Participating in the TST AND TST SCHOOLS community

TST AND TST SCHOOLS are keen to ensure all individuals associated with the School can participate in the life of the community. To do so, TST AND TST SCHOOLS will use the Personal Data provided to make parents, students, staff, service providers, volunteers and interns aware of services, information, news, events and activities that are undertaken at or in association with the School and do so under the legal basis of legitimate interests.

TST AND TST SCHOOLS will invite parents, staff, service providers, volunteers and interns to sign up for information or to agree to make contact details available to other parties for arranging activities outside the School hours (e.g.: play dates, shared rides, study groups, community celebrations, lift sharing, etc) and to process Personal Data for the purposes of fundraising; in such circumstances TST AND TST SCHOOLS will request explicit consent.

Direct Communication

Where TST AND TST SCHOOLS contacts parents, students, staff, service providers, volunteers and interns the School may keep a record of emails, letters and other types of correspondence. Where the School needs to communicate sensitive or confidential information to parents, students, staff, service providers, volunteers and interns, TST AND TST SCHOOLS may use additional and proportionate security measures to do so.

CCTV

TST AND TST SCHOOLS may collect information in the form of CCTV to ensure the safety and security of parents, students, staff, service providers, volunteers and interns. Parents, staff, service providers, volunteers and interns have the right to access their images; parents also have the right to obtain images of their children. Access to these images can be requested through the Data Protection Officer by emailing privacy@schoolstrust.co.uk.

Sharing Data

The information collected is shared within the School to deliver the services required. It may also be shared with other organisations such as other schools (for trips, sports and activities), government organisations, police, health and social care. Sharing Personal Data will take place where TST AND TST SCHOOLS are required to do so by law, or where the School has explicit consent to do so or to protect the vital interests of the individual.

Personal Data may be shared with or processed by a third party processor in the undertaking of a service or contract in the delivery of the education services provided by TST AND TST SCHOOLS.

The categories of personal information that are collected, held and shared include:

• personal information (such as name, unique number and address)

• special categories of data (such as medical data, race, gender)

• other relevant categories for the performance of TST AND TST SCHOOLS’s services (such as assessment, student special educational needs, behavioural information and psychological reports and assessments)

• attendance information (such as sessions attended, number of absences and absence reasons)

• logging and audit in the use of IT systems and education technology apps, applications and cloud-based systems

Examples of who TST AND TST SCHOOLS may share data with:

• schools, colleges or universities that the students attend after leaving TST AND TST SCHOOLS local education authorities

• family nurses, doctors or social service organisations where sharing is in the vital interests of the individual, or where not sharing could have a negative impact on the individual providers of information systems that are necessary for the School to deliver the admissions, administration, teaching and learning, pastoral development, and child protection services

• Companies that provide school services, such as Caterers for school lunches, Bus Companies for the school bus service and travel companies whenever they are used to organise trips. The School will only share Personal Data if there is a lawful basis to do so.

Transfers to Third Countries

Personal Data may be transferred to organisations outside the country and the EU for student applications for college or university. Various teaching and learning applications are also used that are based outside the country. As stated above, the School ensures that organisations outside the EU who receive or process Personal Data are compliant with EU data protection regulations, or that a legal basis for transferring data, such as the explicit consent or the vital interest of the child, is met. Where this is not the case, the data is anonymised before transmission.

Publication of photos and videos by the School

Photos and videos are essential media that significantly enhance communication about the School’s programmes and activities to the TST AND TST SCHOOLS community, prospective families, alumni, and the general public. For this reason, the School uses such media on its website, in its print publications, press releases, and articles for external publications. Furthermore, photos and video are also created for educational purposes by students and teachers and play an essential role in the instructional programme.

As members of the TST AND TST SCHOOLS community, parents, students, staff, service providers, volunteers and interns may be filmed or photographed. These images may be used for both educational and promotional purposes. We are conscious and respectful of the privacy of all TST AND TST SCHOOLS community members, and therefore the publication of these images takes place under the following conditions:

Public

Publications destined for the general public, including the TST AND TST SCHOOLS public website, School publications, press releases and articles: individuals will not be identified by name in photos or video clips without prior agreement. Students who take part in School productions such as plays, concerts or other events that are open to the general public and which are publicised outside the School may be identified by name in photos or video clips that are published by the School.

TST AND TST SCHOOLS Community

Publications destined for the TST AND TST SCHOOLS community, including the password-protected portals, School Yearbook and School newspapers: students, parents, staff, service providers, volunteers and interns may be identified by name in images found in publications such as the TST AND TST SCHOOLS Yearbook, School newspapers or other in-house documents. On the password-protected portals, individuals may be identifiable by name. Images and video clips that appear on these pages may identify students, parents, staff, service providers, volunteers and interns either directly or indirectly depending on their context. These pages are password protected and only available to members of the TST AND TST SCHOOLS community.

Please contact the Communications Office if you have specific concerns about photos being published using the privacy@schoolstrust.co.uk email address.

Collecting Data and Consent

While the majority of data provided to TST AND TST SCHOOLS are required for the performance of a contract, agreement or by law, some of it is provided on a voluntary basis. To comply with the GDPR, TST AND TST SCHOOLS will inform parents, staff, service providers, volunteers and interns when consent is required to process the data. Where consent is provided, parents, staff, service providers, volunteers and interns are free to withdraw consent at any time. There may be instances where parents, staff, service providers, volunteers and interns may not want TST AND TST SCHOOLS to process or share Personal Data. In these cases, TST AND TST SCHOOLS may not be able to fulfil the contracted or agreed service, or only do so in a limited way, or be able to comply with a statutory obligation. In those instances, TST AND TST SCHOOLS may not be able to comply with such a request.

Parents, staff, service providers, volunteers and interns can contact the School’s Data Protection Officer (Ashley Andrews) by emailing privacy@schoolstrust.co.uk if they wish to withdraw consent.

Storing Personal Student Data

TST AND TST SCHOOLS will retain Personal Data for as long as required by law or best educational practice. TST AND TST SCHOOLS retains Personal Data after parents, students, staff, service providers, volunteers and interns have left TST AND TST SCHOOLS to provide traceability. It is widely accepted that a School should hold data on the achievements and experiences of a child for their benefit in later life should they need to access that information. Subject to appropriate safeguards, TST AND TST SCHOOLS may keep some information during a more extended period if needed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Security

For the time that TST AND TST SCHOOLS stores and uses Personal Data, the School will ensure the appropriate security of this Personal Data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Automated Decision Making/Profiling The School’s IT systems profile the use, access and content of all users. The profiling enables identification of safeguarding and child protection risks or concerns, on the basis of your explicit consent. Some education apps profile the behaviour, use and outcomes of children. The School has an internal process to assess the impact of this on students. In evaluating the use of these apps, the School will consider the benefit gained from using it for the student to learn, develop and explore, against the negatives identified from profiling.

Cookies

TST AND TST SCHOOLS may use cookies on its website and portals to ensure the best experience on its electronic media. Parents, students, staff, service providers, volunteers and interns can prevent cookies being stored on their computers or other devices but should be aware that this may downgrade or render inoperable some aspects of the functionality. It is recommended that all cookies are left on in case they are used to provide a service which might otherwise not be accessible. Third party analytics are used to track and measure usage of TST AND TST SCHOOLS sites so that the School can continue to produce engaging content. These cookies may track things such as time spent on the sites or pages visited which helps the School to understand how it can improve the experience for users.

Rights over Personal Data

TST and TST Schools parents, staff, service providers, volunteers, interns, and in some instances, students have the right to request access to Personal Data held about them. To make such a request, email the Data Protection Officer by emailing privacy@schoolstrust.co.uk.

Parents, staff, service providers, volunteers, interns, and in some instances, students, also have certain additional rights:

• to be informed of how TST AND TST SCHOOLS processes Personal Data – this policy serves to explain this to you but do get in touch if you have any questions;

• to have Personal Data corrected if it is inaccurate or incomplete;

• to have Personal Data erased (the “right to be forgotten”) in certain circumstances – e.g. where TST AND TST SCHOOLS no longer need it for the purpose for which it was collected or where explicit consent has been withdrawn;

• to restrict the use of Personal Data in certain circumstances, e.g. where TST AND TST SCHOOLS has been informed that the data is inaccurate, and the School is in the process of checking this. In such circumstances TST AND TST SCHOOLS will continue to store Personal Data but will not process it further until it is reviewed and confirmed whether the Personal Data is inaccurate;

• to object to the processing of Personal Data in certain circumstances - e.g. for direct marketing purposes;

• to object to decisions being taken by automated means;

• to object to the processing of Personal Data that is likely to cause, or is causing, damage or distress;

• in certain circumstances, to have Personal Data blocked, erased or destroyed;

• to receive the Personal Data in a structured, commonly used and machine-readable format to transmit those data to another controller or to require TST AND TST SCHOOLS to transmit them to such other controller;

• to claim compensation for damages caused by a breach of the Data Protection regulations.

Right to object to processing

As already stated above, there may be instances where parents, staff, service providers, volunteers, interns, and in some cases, students, may not want TST AND TST SCHOOLS to process or share Personal Data. In these cases, TST AND TST SCHOOLS may not be able to fulfil the contract or agreement or only do so in a limited way or be able to comply with a statutory obligation. In those instances, TST AND TST SCHOOLS may not be able to comply with such a request