St Mary's Catholic Primary School

  1. Home
  2. About Us
  3. Privacy Notice - GDPR

Privacy Notice - GDPR

📄 Privacy Notice for Parents and Carers – Use of Your Child’s Personal Data

Under UK data protection law, individuals have the right to be informed about how their personal data is collected and used. At St Mary’s Catholic Primary School, we take this responsibility seriously and fulfil it by providing privacy notices (also known as ‘fair processing notices’) to individuals whose data we process.

This privacy notice outlines how we collect, store, and use personal data relating to pupils.

🏫 Who We Are

St Mary’s Catholic Primary School is the data controller for the purposes of data protection law. This means we are responsible for deciding how and why we use personal data.

Our designated Data Protection Officers are Rob Montgomery and Sue Wright from Telford and Wrekin Council.

📌 What Personal Data We Collect

We may collect, use, store, and share (when appropriate) the following types of personal data about pupils:

  • Contact details and communication preferences

  • Date of birth and identification documents

  • Results from internal assessments and externally set tests

  • Pupil records and curriculum information

  • Characteristics such as ethnic background, eligibility for free school meals, and special educational needs

  • Exclusion records

  • Medical information, including physical and mental health

  • Attendance data

  • Safeguarding records

  • Details of support received, including care packages, plans, and support providers

  • Photographs

We may also receive and hold pupil data from other organisations, including:

  • Other schools

  • Local authorities

  • The Department for Education

🔍 Why We Use Pupil Data

We collect and use pupil data to:

  • Support effective teaching and learning

  • Monitor academic progress and report outcomes

  • Provide appropriate pastoral care and support

  • Safeguard pupil welfare

  • Evaluate and improve the quality of our services

  • Manage admissions and waiting lists

  • Conduct educational research

  • Fulfil our legal obligations regarding data sharing

⚖️ Our Legal Basis for Using Pupil Data

We only process personal data when permitted by law. The most common legal bases include:

  • Legal obligation – when we are required to process data to comply with the law

  • Public task – when processing is necessary for us to perform a task in the public interest

In some cases, we may also process data under:

  • Vital interests – to protect a pupil’s life or wellbeing

  • Consent – when we have obtained clear permission to use data in a specific way

If we rely on consent, you have the right to withdraw it at any time. We will explain how to do this when we request consent.

Please note that multiple legal bases may apply to the same data processing activity.

📥 Collecting Pupil Information

Most of the data we collect is required by law or necessary for school operations. However, some information is provided voluntarily. When we request data, we will always clarify:

  • Whether it is mandatory or optional

  • The consequences of not providing mandatory information

🗄️ How We Store Pupil Data

We retain pupil data for as long as necessary to meet legal and educational requirements. This includes:

  • While the pupil is enrolled at our school

  • Beyond their attendance, if required by law

Our retention periods are outlined in our Records Management Policy, which follows guidance from the .

🔄 Sharing Pupil Data

We do not share pupil data with third parties unless:

  • We have your consent

  • The law requires it

  • It is necessary and compliant with data protection regulations

We may share data with:

  • Local authority – for safeguarding, exclusions, and statutory duties

  • Department for Education

  • Pupil’s family or representatives

  • Educators and examining bodies

  • Ofsted – our regulatory body

  • Contracted suppliers and service providers (e.g. Purple Mash, Letterjoin)

  • Central and local government

  • Auditors

  • Survey and research organisations

  • Health authorities and social welfare organisations

  • Professional advisers and consultants

  • Police, courts, and tribunals

  • Professional bodies

🗃️ National Pupil Database (NPD)

We are legally required to submit pupil data to the Department for Education (DfE) for statutory collections such as the school census. This data is stored in the National Pupil Database (NPD), which:

  • Is managed by the DfE

  • Supports research and policy development

  • Is held securely and used to generate statistics

The DfE may share NPD data with organisations that promote education or child wellbeing in England, under strict terms and conditions.

For more information, visit the , or contact them directly with questions about the NPD.

🌍 Transferring Data Internationally

If we transfer personal data to a country or territory outside the European Economic Area (EEA), we will ensure that the transfer complies with UK data protection law. This includes using appropriate safeguards to protect the data and uphold individuals’ rights.

👨‍👩‍👧 Parents’ and Pupils’ Rights Regarding Personal Data

Under data protection law, individuals have the right to access and control their personal data. This includes the right to make a Subject Access Request (SAR) to view the personal information the school holds.

Subject Access Requests

Parents/carers may make a request on behalf of their child if:

  • The child is not considered mature enough to understand their data rights (typically under age 12), or

  • The child has given consent for the parent/carer to act on their behalf

If we hold information about you or your child, we will:

  • Provide a description of the data

  • Explain why we are processing it and how long we will retain it

  • Identify the source of the data, if not obtained directly from you or your child

  • List any third parties with whom the data has been shared or may be shared

  • Inform you of any automated decision-making and its impact

  • Supply a copy of the data in an understandable format

You also have the right to request that your personal data be transmitted electronically to another organisation, where applicable.

To make a request, please contact our Data Protection Officer.

Access to Educational Records

Parents/carers have a legal right to access their child’s educational record. To request access, please contact Mrs Samantha Griffiths, Headteacher.

🔐 Other Rights Under Data Protection Law

Individuals also have the right to:

  • Object to the use of their personal data if it causes or may cause harm or distress

  • Prevent their data from being used for direct marketing

  • Object to decisions made solely by automated means

  • Request correction, deletion, or restriction of inaccurate or unnecessary data

  • Seek compensation for damages caused by breaches of data protection regulations

To exercise any of these rights, please contact our Data Protection Officer.

🗣️ Complaints

We take concerns about data privacy seriously. If you believe our handling of personal data is unfair, misleading, or inappropriate, please contact us directly.

You also have the right to raise your concern with the Information Commissioner’s Office (ICO):

  • Call: 0303 123 1113

  • Write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

📞 Contact Us

If you have questions, concerns, or would like more information about this privacy notice, please contact our Data Protection Officers:

Rob Montgomery / Sue Wright GDPR Officers, Telford and Wrekin Council

This notice is based on the Department for Education’s model privacy notice for pupils and has been adapted to reflect how we use data at St Mary’s Catholic Primary School.

⚖️ Legal Basis for Processing

We process personal data under the following legal bases:

  • It is necessary for performing a task in the public interest

  • It is necessary to protect the vital interests of the data subject or another person

For special category data, our legal basis is:

  • It is necessary for reasons of substantial public interest, in the exercise of official functions by a Minister or government department

📤 Data Recipients

Where appropriate and proportionate, personal data may be shared with:

  • Government departments and agencies

  • Executive agencies and other public bodies

📁 Data Retention

Personal data is retained only for the purposes outlined in this notice. It will not be held for more than one year unless required for legal, public interest, or historical record purposes.

📚 Sources of Information

We may obtain personal data from other data controllers when necessary and proportionate to support our educational and legal responsibilities.