How we use your information

Privacy notice for Ysgol Uwchradd Aberteifi

The proper handling of personal information by Ysgol Uwchradd Aberteifi is very important to the delivery of our services and maintaining public confidence. Ysgol Uwchradd Aberteifi is the data controller of the personal information you provide to us. This means the school determines the purposes for which, and the manner in which, any personal data relating to pupils and their families, staff and governors is to be processed. Personal data is any information that relates to a person who can be directly or indirectly identified from the information. The terms ‘personal information’ and ‘personal data’ are used throughout this privacy notice and have the same meaning. This privacy notice has been produced to explain as clearly as possible what we do with your personal data.

1. The purposes for which we use your personal data
   As data controller, the school uses the information received for the purposes below:

   • To support the school’s teaching and learning;

   • Reporting on school performance;

   • To provide learners with access to learning opportunities, including school trips and

     learning platforms such as Hwb;

   • To provide free school meals;

   • To support health needs including medical conditions, allergies;

   • To provide transport;

   • To support pupils’ wider needs, such as additional learning needs, mental health, wellbeing

     and career support.
     No data will ever be published that would identify individual pupils.

2. Why do we collect and use your information?
   Ysgol Uwchradd Aberteifi holds the legal right to collect and use personal data relating to pupils and their families, and we may also receive information regarding them from their previous school, LA and/or the Welsh Government. We collect and use personal data in order to meet legal requirements and legitimate interests as set out in the General Data Protection Regulation (GDPR) and Data Protection Act 2018, including those in relation to the following:

   • Article 6 and Article 9 of the GDPR;

   • Education (Wales) Act 2014;

   • The Pupil Information (Wales) Regulations 2011.

3. What type of information do we use?
   We collect the following types of personal data about you to deliver this service:

   • Name;

   • Address;

   • Date of birth;

• Gender;

• Special Educational Needs;

• Assessments and attendance records

• Telephone number;

• Email address;

• Your family composition;

• Images / photographs;

• Information about your health;

• Your racial or ethnic origin;

• Biometric data (in some schools for cashless catering);

• Employee records.

4. Do we use information received from other sources?
To provide this service, we collect information directly from you but may also receive information from the following sources:

• Teachers;

• Ceredigion County Council;

• Qualification Boards.

  The following types of personal data may be obtained, depending on your circumstances:

• Assessments / Test results;

• GCSE, A-level results or equivalent;

• Information on well-being / attendance / exclusions.

5. Transferring your information abroad
   Your information will not be transferred outside the European Union.

6. Who has access to your information?
   We may share your information with the following recipients, depending on your circumstances:

   • Welsh Government;

   • Ceredigion County Council;

   • Regional education consortia;

   • Careers Wales;

   • NHS;

   • Any body recognised by The Office of Qualifications and Examinations Regulation

     (Ofqual) in respect of the award or authentication of a specified qualification or

     description of qualification;

   • Companies providing educational platforms to create learner accounts to access their

     software platforms;

   • Other educational learning resources that the school uses to improve the pupil’s

     learning experience;

• Parents / Guardians. The school will only provide data to another organisation for a specific purpose and for a limited time period, after which the organisation must confirm that it has been destroyed. Any analyses produced must follow Welsh Government disclosure rules to ensure that individual pupils cannot be identified. However, there are specific situations where we may be required to disclose information about you, such as:

• Where the school is required to provide the information by law;

• Where disclosing the information is required to prevent or detect a crime;

• Where disclosure is in the vital interests of the person concerned.

7. For how long will we keep your information?
The school will keep a full pupil record until the pupil leaves the school (for primary schools) or until the pupil’s 25th birthday (for secondary and middle schools) or for the duration of the criteria which underpin the statutory regulation, in accordance with Ceredigion Council’s Retention Guidelines. Other data may have different retention periods, which can be found in the “Data Retention Schedule for Schools and the LA”. After this point the data will be anonymised in line with best practices and only used for statistical and research purposes. 8. Your rights under the Data Protection Act (2018) & GDPR You have the right to:

• Obtain access to the personal data that the school is processing about you;

• Have any inaccurate or incomplete information corrected;

• Withdraw your consent to processing, where this is the only basis for the processing;

• Make a complaint to the Information Commissioner’s Office (ICO), the independent

  body in the UK which protects information rights. In some circumstances, you may have the right to:

  • Object to the processing of your personal information;

  • The erasure of your personal data;

  • Restrict the processing of your personal information;

  • Data portability (which gives you the right to receive personal data you have

    provided to the school in a structured, commonly used and machine readable format).

    Contact details For more information regarding this privacy notice and your rights, please contact: Data Protection Officer,
    Learning Services, Ceredigion County Council,
    Canolfan Rheidol,

    Rhodfa Padarn,
    Llanbadarn Fawr,
    Aberystwyth SY23 3UE
    Email: servicedesk@cerenet.org.uk Tel: 01970 633678

    Contact details for the Information Commissioner’s Office along with further guidance on Data Protection legislation can be found on the ICO website: www.ico.org.uk