Privacy

Privacy notice for students and parents

This privacy notice is written for both students and their parents/carers at Marylebone Boys’ School and explains how we collect, store and use personal data about our students.

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

We, Marylebone School Ltd, are the ‘data controller’ for the purposes of data protection law.

The Data Protection Officer (DPO) is Mr P. Green.

The personal data we hold

Personal data that we may collect, use store and share (when appropriate) about students includes, but is not restricted to:

Contact details, contact preferences, date of birth, identification documents
Results of internal assessments and externally set tests
Student and curricular records
Characteristics, such as ethnicity, language, nationality, country of birth, eligibility for free school meals, or special educational needs
Exclusion information
Details of any medical conditions, including physical and mental health
Attendance information (Such as sessions attended, number of absences and absence reasons)
Safeguarding information
Details of any support received, including care packages, plans and support providers
Photographs
CCTV images captured in the school.
Catering information such as food/drinks purchased
Biometric Data (fingerprint recognition system)

We may also hold data about students that we have received from other organisations, including other schools, local authorities and the Department for Education.

Why we use this data

We use this data to:

Support student learning
Monitor and report on student progress
Provide appropriate pastoral care
Assess how well our school is doing
Protect student welfare and ensure the safety of the school site
Assess the quality of our services
Administer admissions waiting lists
Carry out research
Comply with the law regarding data sharing

Our legal basis for using this data

We will only collect and use your information when the law allows us to. Most often, we will use your information where:

We need to comply with the law
We need to use it to carry out a task in the public interest (in order to provide you with an education)

Sometimes, we may also use personal information where:

Students or parents/carers have given us permission to use it in a certain way:

We need to protect your interests (or someone else’s interest)
Where we have got permission to use your data, you or your parents/carers may withdraw this at any time.

We will make this clear when we ask for permission, and explain how to go about withdrawing consent.

Some of the reasons listed above for collecting and using your information overlap, and there may be several grounds which mean we can use your data.

Collecting this information

Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis.
In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain student information to us or if you have a choice in this. If it is mandatory, we will explain the possible consequences of not complying.

How we store this data

We will keep personal information about you while you are a pupil at our school. We may also keep it after you have left the school, where we are required to by law.

We have a record retention schedule/records management policy which sets out how long we must keep information about student.

Data sharing

We do not share personal information about you with anyone outside the school without permission from student or parents/carers, unless the law and our policies allow us to do so.

Where it is legally required, or necessary for another reason allowed under data protection law, we may share personal information about you with:

Our local authority – to meet our legal duties to share certain information with it, such as concerns about student’ safety and exclusions
The Department for Education (a government department)
Your family and representatives
Educators and examining bodies
Our regulator (the organisation or “watchdog” that supervises us), e.g.
Ofsted, Independent Schools Inspectorate
Suppliers and service providers – so that they can provide the services we have contracted them for
Financial organisations
Central and local government
Our auditors
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts, tribunals
Professional bodies

National Student Database

We are required to provide information about students to the Department for Education as part of statutory data collections such as the school census. For further information please see:
https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data

Some of this information is then stored in the National Student Database (NPD), which is owned and managed by the Department and provides evidence on school performance to inform research.

The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.

The Department for Education may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.

You can also contact the Department for Education with any further questions about the NPD
https://www.gov.uk/contact-dfe

Youth support services

Once our pupils reach the age of 13, we also pass pupil information to our local authority (LA) and/or provider of youth support services because they have responsibilities in relation to the education or training of 13 to 19-year-olds under section 507B of the Education Act 1996.

Sharing this information allows them to provide the following services:

Youth support services
Careers advisers
Post-16 education and training providers

The information we share is limited to the pupil’s name, address and date of birth; however, where a parent has provided their consent, other relevant information will be shared – this right to consent is transferred to pupils once they reach 16-years-old.
Sharing by the DfE

The DfE is legally allowed to share pupils’ personal information with certain third parties, including the following:

Schools
LAs
Researchers
Organisations connected with promoting the education or wellbeing of pupils
Other government departments and agencies
Organisations fighting or identifying crime

Organisations fighting or identifying crime, such as the Home Office and the police, may use their legal powers to contact the DfE to request access to individual level information relating to detecting a crime. The DfE typically supplies information on around 600 pupils per year to the Home Office and approximately one per year to the police.

For more information about how the DfE collects and shares pupil information, you can look at the information in the following two links:

What are your rights?

You have specific rights to the processing of your data, these are the right to:

Request access to the information the school holds about you.
Object to the processing of your information that is likely to cause, or is causing, damage or distress.
Prevent processing for the purpose of direct marketing.
Object to decisions being taken by automated means.
In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed.
Seek compensation, either through the ICO or the courts.

If you want to request access to the personal information that we have about you, please contact the DPO at the following address dpo@maryleboneschool.org

If you are concerned about the way we are collecting or using your information, please raise your concern with the school’s DPO in the first instance. You can also contact the ICO at: dpo@maryleboneschool.org

https://ico.org.uk/concerns/