General Data Protection Regulation (GDPR)

This Privacy Notice has been written to inform parents and pupils/students of Whitby School about what we do with your personal information. This Notice may be subject to change.


Who are we?

Whitby School is a ‘Data Controller’ as defined by Article 4 (7) of the UK GDPR. This means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation. The school has appointed Veritau Ltd to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the school is compliant with the UK GDPR and to oversee data protection procedures. If you would like to discuss anything in this Privacy Notice, please contact Veritau Ltd. Veritau’s contact details are:

Schools Data Protection Officer
Veritau Ltd
County Hall
Racecourse Lane
Northallerton
DL7 8AL 
schoolsDPO@veritau.co.uk
01904 554025 

Please ensure you include Whitby School in all correspondence to Veritau relating to your son/daughter


What information do we collect?

The categories of information that we collect, hold and share include the following:

  • personal information of students and their family members  (eg, name, pipil/student number, DOB and address)

  • educational and assessment attainment (such as KS1 and phonics results, post-16 courses and relevant results)

  • free school meal eligibility

  • attendance information (such as sessions attended, number of absences, absence reasons and any previous schools attended)

  • behavioural information (such as exclusions and any relevant alternative provision put in place)

  • safeguarding information (including but not limited to court orders and professional involvement)

  • photographs and communication preferences

  • school trips

  • extra-curricular activities

  • before and after school clubs.


We will also process certain ‘special category’ data about our students including:

  • relevant medical information - please be aware that where a pupil/student has a severe allergy or is thought to be at risk of needing emergency care for a medical issue then this will be shared with all relevant staff members. We may do this in the form of photo identification in the staff room to ensure that all staff members are aware of the issues should an emergency situation arise

  • Special Educational Needs and Disabilities information (including the needs and ranking)

  • race, ethnicity and religion

  • biometric data, eg, thumbprints for our cashless catering service

  • the school may also have information relating to you or your son/daughter’s sexual orientation and/or sexual activity. This is not routine and only likely to be collected if there is a safeguarding risk.


Why do we collect your personal data?

We use the information we collect:

  • to support pupil/student learning

  • to monitor and report on student progress

  • to provide appropriate pastoral care

  • to assess the quality of our services

  • to keep children safe (food allergies or emergency contact details) to meet the statutory duties placed upon us by the Department for Education

  • we also may keep some information for historical and archiving purposes in the public interest.

Any personal data that we process about our students and parents is done so in accordance with Article 6 and Article 9 of the UK GDPR.

Our legal basis for processing your personal data, in line with Article 6(1)(c) (legal obligation) includes (but not necessarily limited to):

  • Education Act 1944,1996, 2002, 2011

  • Education and Adoption Act 2016

  • Education (Information About Individual Pupils)(England) Regulations 2013

  • Education (Pupil Information) (England) Regulations 2005

  • Education and Skills Act 2008

  • Children Act 1989, 2004

  • Children and Families Act 2014

  • Equality Act 2010

  • Education (Special Educational Needs) Regulations 2001.

We also process information in accordance with Article 6(e) (public task), Article 6(a) (consent), Article 9 (2)(a) (explicit consent where applicable) and Article 9(2)(g) (reasons of substantial public interest).

We mainly collect pupil/student information through admission forms and common transfer file or secure file transfer from their previous school. The majority of pupil/student information you provide to us is mandatory in line with your parental responsibility – for further details please see the following link https://www.gov.uk/government/publications/dealing-with-issues-relating-to-parental-responsibility/understanding-and-dealing-with-issues-relating-to-parental-responsibility.

However, some information we ask for on a voluntary basis. When we do process this additional information we will ensure that we ask for your consent to process it. 

Where we are processing your personal data, with your consent, you have the right to withdraw that consent. If you change your mind, or are unhappy with our use of your personal data, please let us know by contacting the school office in the first instance.


Who do we obtain your information from?

Much of the information we process will be obtained directly from you (pupil/students and parents). We will also process information received from:

  • Department for Education (DfE)

  • Local Education Authority (North Yorkshire County Council)

  • previous schools attended


Who do we share your personal data with?

We routinely share pupil/student information with:

  • schools/organisations that students attend after leaving us

  • our Local Education Authority (North Yorkshire County Council) to ensure that they can conduct their statutory duties under the School Admissions Code, including Fair Access Panels

  • the Department for Education (DfE)

  • National Health Service bodies.

For more information on information sharing with the DfE (including the National Pupil Database and Census) please go to:

https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information

We will not share any information about you outside the College without your consent unless we have a lawful basis for doing so. For example, we may also share your data with classroom/teaching apps and some website for the purpose of enhancing pupil/student learning. Where we do this we will rely on either Article 6(e) (public task) or Article 6(a) (consent).

Where we rely on Article 6(e) you have the right to object to processing and where we are relying on Article 6(a) you have the right to withdraw that consent at any time. Please see section below on data subject rights.

Once our pupil/students reach the age of 13, we also pass information to our Local Authority and/or provider of youth support services, as stipulated under section 507B of the Education Act 1996. The information provided includes addresses, DOB of the pupil/student/parents, and any other information necessary for the provision of the service including gender or ethnicity. A parent or guardian can request that only their son/daughter’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the child/pupil/student once he/she reaches the age of 16.

Data is securely transferred to the youth support services via a secure email system or in person.

For more information regarding services for young people please visit our Local Authority‘s website: (https://www.northyorks.gov.uk/)

How long do we keep your personal data for?

Whitby School will keep your data in line with our Information Policy. Most of the information we process about you will be retained as determined by statutory obligations. Any personal information which we are not required by law to retain will only be kept for as long as is necessary to fulfil our organisational needs.


What rights do you have over your data?

Under the UK GDPR, parents and students have the following rights in relation to the processing of their personal data:

  • to be informed about how we process your personal data. This notice fulfils this obligation

  • to request access to your personal data that we hold, and be provided with a copy of it

  • to request that your personal data is amended if inaccurate or incomplete

  • to request that your personal data is erased where there is no compelling reason for its continued processing

  • to request that the processing of your personal data is restricted

  • to object to your personal data being processed.

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact the DPO on the address provided above. Please be aware that, usually, students are considered to have the mental capacity to understand their own data protection rights from the age of being 12 years old. The school may therefore consult with the pupil/student if it receives a request to exercise a data protection right from a parent.

If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the school has handled your personal data. You can do so by contacting:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow Cheshire
SK9 5AF
icocasework@ico.org.uk// 0303 123 1113


Last updated

We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated on 29 April 2022.