Share This Page

Privacy Notice

Privacy Notice - Parent/Carers

For parents/carers of students attending The Douay Martyrs Catholic Secondary School

The Douay Martyrs Catholic Secondary School collects a lot of data and information about our students so that we can run effectively as a school. This privacy notice explains how and why we collect students’ data, what we do with it and what rights parents and students have.

The Douay Martyrs Catholic Secondary School is an academy within the Diocese of Westminster Academy Trust (“DOWAT”), a multi academy trust with 11 academies. DOWAT is a charitable company limited by guarantee (registration number 07944160) whose registered office is Vaughan House, 46 Francis Street, London, SW1P 1QN. DOWAT is the Data Controller for all the academies within the Trust.

The Data Protection Officer for DOWAT is Dr K Sullivan, Foundation Director. Contact number: 01895 679414. Postal address: The Diocese of Westminster Academy Trust, Edinburgh Drive, Ickenham, Middlesex, UB10 8QY. The Academy Data Protection Lead is Mrs T E Doyle, School Business Manager.

The term “parent” is widely defined in education law to include the natural or adoptive parents (regardless of whether parents are or were married, whether a father is named on a birth certificate or has parental responsibility for the student, with whom the student lives or whether the student has contact with that parent), and also includes non-parents who have parental responsibility for the student, or with whom the student lives. It is therefore possible for a student to have several “parents” for the purposes of education law. This privacy notice also covers other members of students’ families who we may process data about from time to time, including, for example, siblings, aunts, uncles and grandparents.

Why do we collect and use parent/carer information?

We collect and use parent/carer information under the following lawful basis:

where we have the consent of the data subject (Article 6 (a));
where it is necessary for compliance with a legal obligation (Article 6 (c));
where processing is necessary to protect the vital interests of the data subject or another person (Article 6(d));
where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6 (e)).

Where the personal data we collect about parents/carers is sensitive personal data, we will only process it where:

we have explicit consent;
processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; and/or
processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Please see our GDPR Policy for a definition of sensitive personal data.

We use the parent/carer data to support our statutory functions of running a school, in particular:

to decide who to admit to the school;
to maintain a waiting list;
to support student learning;
to monitor and report on student progress;
to provide appropriate pastoral care;
to assess the quality of our services;
to comply with the law regarding data sharing;
for the protection and welfare of students and others in the school;
for the safe and orderly running of the school;
to promote the school;
to send you communications that may be of interest to you, which may include information about school events or activities, news, campaigns, appeals, other fundraising activities;
in order to respond to investigations from our regulators or to respond to complaints raised by our stakeholders;
in connection with any legal proceedings threatened or commenced against the school

The categories of parent/carer information that we collect, hold and share include:

Personal information (such as name, address, telephone number and email address);
Information relating to your identity, marital status, employment status, religion, ethnicity, language, medical conditions, nationality, country of birth and free school meal/student premium eligibility/entitlement to certain benefits, information about Court Orders in place affecting parenting arrangements for students);

PRIVACY NOTICE - PARENT/CARERS

For parents/carers of students attending The Douay Martyrs Catholic Secondary School

From time to time and in certain circumstances, we might also process personal data about parents/carers, some of which might be sensitive personal data, information about criminal proceedings/convictions or information about child protection/safeguarding. This information is not routinely collected about parents/carers and is only likely to be processed by the school in specific circumstances relating to particular students, for example, if a child protection issue arises or if a parent/carer is involved in a criminal matter. Where appropriate, such information may be shared with external agencies such as the child protection team at the Local Authority, the Local Authority Designated Officer and/or the Police. Such information will only be processed to the extent that it is lawful to do so and appropriate measures will be taken to keep the data secure.

We collect information about parents/carers before students join the school and update it during students’ time on the roll as and when new information is acquired.

Collecting parent/carer information

Whilst the majority of parent/carer information provided to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain parent/carer information to us or if you have a choice in this. Where appropriate, we will ask parents/carers for consent to process personal data where there is no other lawful basis for processing it, for example where we wish to ask your permission to use your information for marketing purposes or to request voluntary contributions. Parents/carers may withdraw consent given in these circumstances at any time.

When students are deemed to be old enough to make their own decisions in relation to their personal data, we will also ask the student for their consent in these circumstances. This will usually be around the age of 13. Although parental consent is unlikely to be needed, we wish to take a collaborative approach so we will keep parents informed when we are approaching students for consent up to the age of 18. Students with the maturity to make their own decisions about their personal data may withdraw consent if consent has previously been given.

In addition, the School also uses CCTV cameras around the school site for security purposes and for the protection of staff and students. CCTV footage may be referred to during the course of disciplinary procedures (for staff or students) or to investigate other issues. CCTV footage involving parents/carers will only be processed to the extent that it is lawful to do so. Please see our Trust CCTV policy for more details.

Storing parent/carer data

A significant amount of personal data is stored electronically, for example, on our database, SIMS. Some information may also be stored in hard copy format.

Data stored electronically may be saved on a cloud based system which may be hosted in a different country.

Personal data may be transferred to other countries if, for example, we are arranging a school trip to a different country. Appropriate steps will be taken to keep the data secure.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, insurance or reporting requirements. Details of retention periods for different aspects of your personal information are available in our Retention of Records Policy for the Diocese of Westminster Academy Trust which is available from the Trust website www.dowat.co.uk. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer a parent/carer of a child at the school we will retain and securely destroy your personal information in accordance with Retention of Records Policy for the Diocese of Westminster Academy Trust

Who do we share parent/carer information with?

We routinely share parent/carer information with:

schools that students attend after leaving us;
our local authorities within the geographical area of the Trust Hillingdon, Hertfordshire, Brent and Hounslow;
the central team at the Diocese of Westminster Academy Trust;
exam boards including exam boards including AQA, OCR, Edexcel, WJEC, BTEC

PRIVACY NOTICE - PARENT/CARERS

For parents/carers of students attending The Douay Martyrs Catholic Secondary School

From time to time, we may also share parent/carer information with other third parties including the following:

The Department for Education (DfE);
The Education and Skills Funding Agency
School local governors/trustees
the Police and law enforcement agencies;
NHS health professionals including the school nurse, educational psychologists,
Education Welfare Officers;
Courts, if ordered to do so;
the National College for Teaching and Learning;
the Joint Council for Qualifications;
the Standards Testing Agency
Prevent teams in accordance with the Prevent Duty on schools;
The Local Safeguarding Board relevant to the Academies location
other schools, for example, if we are negotiating a managed move and we have your consent to share information in these circumstances;
the Catholic Education Service
Diocesan Officers at the Diocese of Westminster for the purposes of receiving educational support;
OfSTED
the school chaplain;
our HR providers, for example, if we are seeking HR advice and a student is involved in an issue;
UCAS
our legal advisors;
our insurance providers/the Risk Protection Arrangement;

Some of the above organisations may also be Data Controllers in their own right in which case we will be jointly controllers of your personal data and may be jointly liable in the event of any data breaches.

In the event that we share personal data about students with third parties, we will provide the minimum amount of personal data necessary to fulfil the purpose for which we are required to share the data.

Data sharing with the Diocese of Westminster

The Diocesan Education Commission of the Diocese of Westminster is chaired by Bishop John Wilson and is appointed by the Archbishop as a decision-making body which acts in his name. It is responsible to him in all areas relating to education in schools and colleges set out in canon law and English law. It is responsible to the Diocesan Trustees for the financial aspects of providing and maintaining Catholic education in the Diocese of Westminster. The Trust and its academies as Catholic schools within the diocese share information with the Diocese of Westminster to allow them to meet these requirements. Examples of the data provided:

Personal information (such as name, unique student number, date of birth, address, gender, year group, admissions data
Characteristics (such as ethnicity, religion, language, medical conditions, nationality, Special Education Needs information and free school meal eligibility)
Continued Professional Development (Training data, Inset days)
Standards data for the Diocesan Inspection of Catholic Schools
Information requested by the Bishop
Financial Benchmarking data

Requesting access to your personal data

Under data protection legislation, parents/carers have the right to request access to information about you that we hold (“Subject Access Request”). To make a request for your personal data, please contact the Academy Data Protection Lead, although any written request for personal data will be treated as a Subject Access Request.

The legal timescales for the School to respond to a Subject Access Request is one calendar month. As the School has limited staff resources outside of term time, we encourage parents/carers to submit Subject Access Requests during term time and to avoid sending a request during periods when the School is closed or is about to close for the holidays where possible. This will assist us in responding to your request as promptly as possible. For further information about how we handle Subject Access Requests, please see our GDPR Policy.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

PRIVACY NOTICE - PARENT/CARERS

For parents/carers of students attending The Douay Martyrs Catholic Secondary School

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

You also have the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress;
prevent processing for the purpose of direct marketing;
object to decisions being taken by automated means;
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
claim compensation for damages caused by a breach of the our data protection responsibilities.

RIGHT TO WITHDRAW CONSENT

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact Mrs T E Doyle. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

DATA PROTECTION OFFICER

We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO Dr K Sullivan, Foundation Director contact number 01895 679414, postal address the Diocese of Westminster Academy Trust, Edinburgh Drive, Ickenham, Middlesex, UB10 8QY. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

CHANGES TO THIS PRIVACY NOTICE

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice and upload to the School website when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

Privacy Notice - Students

For students attending The Douay Martyrs Catholic Secondary School

Why do we collect and use student information?

We collect and use student information under the following lawful basis:

where we have the consent of the data subject (Article 6 (a));
where it is necessary for compliance with a legal obligation (Article 6 (c));
where processing is necessary to protect the vital interests of the data subject or another person (Article 6(d));
where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6 (e)).

Where the personal data we collect about students is sensitive personal data, we will only process it where:

we have explicit consent;
processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; and/or
processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Please see our GDPR Policy for a definition of sensitive personal data.

We use the student data to support our statutory functions of running a school, in particular:

to decide who to admit to the school;
to maintain a waiting list;
to support student learning;
to monitor and report on student progress;
to provide appropriate pastoral care;
to assess the quality of our services;
to comply with the law regarding data sharing;
for the protection and welfare of students and others in the school;
for the safe and orderly running of the school;
to promote the school;
to communicate with parents/carers;
in order to respond to investigations from our regulators or to respond to complaints raised by our stakeholders;
in connection with any legal proceedings threatened or commenced against the school

The categories of student information that we collect, hold and share include:

Personal information (such as name, unique student number and address);
Characteristics (such as ethnicity, language, medical conditions, nationality, country of birth and free school meal eligibility);
Attendance information (such as sessions attended, number of absences and absence reasons)
Behaviour records, including exclusions (if relevant) records about attainment, assessment information, information about special needs (if relevant);
From time to time and in certain circumstances, we might also process personal data about students, some of which might be sensitive personal data, including information about criminal proceedings/convictions, child protection/safeguarding. This information is not routinely collected about students and is only likely to be processed by the school in specific circumstances relating to particular students, for example, if a child protection issue arises or if a student is involved in a criminal matter. Where appropriate, such information may be shared with external agencies such as the child protection team at the Local Authority, the Local Authority Designated Officer and/or the Police. Such information will only be processed to the extent that it is lawful to do so and appropriate measures will be taken to keep the data secure.

PRIVACY NOTICE - STUDENTS

For students attending The Douay Martyrs Catholic Secondary School

We collect information about students when they join the school and update it during their time on the roll as and when new information is acquired.

As the school has a cashless catering system, we also process biometric data about students if we have received explicit consent from parents. Please see our GDPR Policy for more details about how we process biometric data.

Collecting student information

Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain student information to us or if you have a choice in this. Where appropriate, we will ask parents or students for consent to process personal data where there is no other lawful basis for processing it, for example where we wish to use photos or images of students on our website or on social media to promote school activities or if we want to ask your permission to use your information for marketing purposes. Parents/students may withdraw consent at any time.

In addition, the School also uses CCTV cameras around the school site for security purposes and for the protection of staff and students. CCTV footage may be referred to during the course of disciplinary procedures (for staff or students) or to investigate other issues. CCTV footage involving students will only be processed to the extent that it is lawful to do so. Please see our Trust CCTV policy for more details.

Storing student data

We hold student data as defined in the Retention of Records Policy for the Diocese of Westminster Academy Trust.

A significant amount of personal data is stored electronically, for example, on our database, SIMS. Some information may also be stored in hard copy format.

Data stored electronically may be saved on a cloud based system which may be hosted in a different country.

Personal data may be transferred to other countries if, for example, we are arranging a school trip to a different country. Appropriate steps will be taken to keep the data secure.

Who do we share student information with?

We routinely share student information with:

Parents/carers (as defined in the Education Act 1996);
schools that students attend after leaving us;
our local authorities within the geographical area of the Trust Hillingdon, Hertfordshire, Brent and Hounslow;
a student’s home local authority (if different);
the Department for Education (DfE);
the Education and Skills Funding Agency
school local governors/trustees;
the central team at DOWAT;
exam boards including exam boards including AQA, OCR, Edexcel, WJEC, BTEC

From time to time, we may also share student information with other third parties including the following:

the Police and law enforcement agencies;
NHS health professionals including the school nurse, educational psychologists,
Education Welfare Officers;
Courts, if ordered to do so;
the National College for Teaching and Learning;
the Joint Council for Qualifications;
the Standards Testing Agency
Prevent teams in accordance with the Prevent Duty on schools;
The Local Safeguarding Board relevant to the Academies location
other schools, for example, if we are negotiating a managed move and we have your consent to share information in these circumstances;
the Catholic Education Service
Diocesan Officers at the Diocese of Westminster for the purposes of receiving educational support;

PRIVACY NOTICE - STUDENTS

For students attending The Douay Martyrs Catholic Secondary School

OfSTED
the school chaplain;
our HR providers, for example, if we are seeking HR advice and a student is involved in an issue;
UCAS
our legal advisors;
our insurance providers/the Risk Protection Arrangement;

Data sharing with the Diocese of Westminster

Personal information (such as name, unique student number, date of birth, address, gender, year group, admissions data
Characteristics (such as ethnicity, religion, language, medical conditions, nationality, Special Education Needs information and free school meal eligibility
Continued Professional Development (Training data, Inset days)
Standards data for the Diocesan Inspection of Catholic Schools
Information requested by the Bishop
Financial Benchmarking data

Aged 14+ qualifications

For students enrolling for post 14 qualifications, the Learning Records Service will give us a student’s unique learner number (ULN) and may also give us details about the student’s learning or qualifications

Why we share student information

We do not share information about our students with anyone without consent unless the law allows us to do so.

We share students’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.

We are required to share information about our students with the (DfE) under regulation 5 of The Education (Information About Individual Students) (England) Regulations 2013.

Data collection requirements:

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

Youth Support Services

What is different about students aged 13+?

Once our students reach the age of 13, we also pass student information to our local authority and/or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

youth support services
careers advisers

A parent/carer can request that only their child’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the child/student once he/she reaches the age 16.

PRIVACY NOTICE - STUDENTS

For students attending The Douay Martyrs Catholic Secondary School

Students aged 16+

We will also share certain information about students aged 16+ with our local authority and/or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

post-16 education and training providers;
youth support services;
careers advisers.

For more information about services for young people, please visit our local authority website.

The National Student Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about students in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our students to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Students) (England) Regulations 2013.

To find out more about the student information we share with the department, for the purpose of data collections, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-student-database-user-guide-and-supporting-information.

The department may share information about our students from the NPD with third parties who promote the education or well-being of children in England by:

conducting research or analysis
producing statistics
providing information, advice or guidance

The DfE has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

who is requesting the data;
the purpose for which it is required;
the level and sensitivity of data requested; and
the arrangements in place to store and handle the data.

To be granted access to student information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided student information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-student-database-requests-received

To contact DfE: https://www.gov.uk/contact-dfe

PRIVACY NOTICE - STUDENTS

For students attending The Douay Martyrs Catholic Secondary School

Requesting access to your personal data

Under General Data Protection Regulations, students, and in some circumstances, parents, have the right to request access to information about them that we hold (“Subject Access Request”). From the age of 13, we generally regard students as having the capacity to exercise their own rights in relation to their personal data. This means that where we consider a student to have sufficient maturity to understand their own rights, we will require a Subject Access Request to be made by the student and not their parent(s) on their behalf. This does not affect any separate statutory right parents might have to access information about their child.

Subject to the section below, the legal timescales for the School to respond to a Subject Access Request is one calendar month. As the School has limited staff resources outside of term time, we encourage parents/students to submit Subject Access Requests during term time and to avoid sending a request during periods when the School is closed or is about to close for the holidays where possible. This will assist us in responding to your request as promptly as possible. For further information about how we handle Subject Access Requests, please see our GDPR Policy.

Parents of students who attend academies have a separate statutory right to receive an annual written report setting out their child’s attainment for the main subject areas which are taught. This is an independent legal right of parents rather than a student’s own legal right which falls outside of the GDPR, therefore a student’s consent is not required even where a student is able to make their own decisions in relation to their personal data, unless a court order is in place which states otherwise.

You also have the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress;
prevent processing for the purpose of direct marketing;
object to decisions being taken by automated means;
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
claim compensation for damages caused by a breach of the our data protection responsibilities.

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/

Contact:

If you would like to discuss anything in this privacy notice, please contact: Dr K Sullivan, Foundation Director. Telephone: 01895 679414. Postal address: The Diocese of Westminster Academy Trust, Edinburgh Drive, Ickenham, Middlesex, UB10 8QY

Privacy Notice

Privacy Notice - Parent/Carers

PRIVACY NOTICE - PARENT/CARERS

Privacy Notice - Students

About Us