This privacy notice is written for both students and their parents/carers at Marylebone Boys’ School and explains how we collect, store and use personal data about our students.
Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.
We, Marylebone School Ltd, are the ‘data controller’ for the purposes of data protection law.
The Data Protection Officer (DPO) is Mr P. Green.
Personal data that we may collect, use store and share (when appropriate) about students includes, but is not restricted to:
We may also hold data about students that we have received from other organisations, including other schools, local authorities and the Department for Education.
We use this data to:
We will only collect and use your information when the law allows us to. Most often, we will use your information where:
Sometimes, we may also use personal information where:
Students or parents/carers have given us permission to use it in a certain way:
We will make this clear when we ask for permission, and explain how to go about withdrawing consent.
Some of the reasons listed above for collecting and using your information overlap, and there may be several grounds which mean we can use your data.
Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis.
In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain student information to us or if you have a choice in this. If it is mandatory, we will explain the possible consequences of not complying.
We will keep personal information about you while you are a pupil at our school. We may also keep it after you have left the school, where we are required to by law.
We have a record retention schedule/records management policy which sets out how long we must keep information about student.
We do not share personal information about you with anyone outside the school without permission from student or parents/carers, unless the law and our policies allow us to do so.
Where it is legally required, or necessary for another reason allowed under data protection law, we may share personal information about you with:
We are required to provide information about students to the Department for Education as part of statutory data collections such as the school census. For further information please see:
Some of this information is then stored in the National Student Database (NPD), which is owned and managed by the Department and provides evidence on school performance to inform research.
The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.
The Department for Education may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.
You can also contact the Department for Education with any further questions about the NPD
Once our pupils reach the age of 13, we also pass pupil information to our local authority (LA) and/or provider of youth support services because they have responsibilities in relation to the education or training of 13 to 19-year-olds under section 507B of the Education Act 1996.
Sharing this information allows them to provide the following services:
The information we share is limited to the pupil’s name, address and date of birth; however, where a parent has provided their consent, other relevant information will be shared – this right to consent is transferred to pupils once they reach 16-years-old.
Sharing by the DfE
The DfE is legally allowed to share pupils’ personal information with certain third parties, including the following:
Organisations fighting or identifying crime, such as the Home Office and the police, may use their legal powers to contact the DfE to request access to individual level information relating to detecting a crime. The DfE typically supplies information on around 600 pupils per year to the Home Office and approximately one per year to the police.
For more information about how the DfE collects and shares pupil information, you can look at the information in the following two links:
You have specific rights to the processing of your data, these are the right to:
If you want to request access to the personal information that we have about you, please contact the DPO at the following address email@example.com
If you are concerned about the way we are collecting or using your information, please raise your concern with the school’s DPO in the first instance. You can also contact the ICO at: firstname.lastname@example.org