Newfriars College collects data and information about our students and from parents/carers (for example telephone numbers and email addresses) so that we can run effectively and safely as a college.  This privacy notice explains how and why we collect student and parent/carer data, what we do with it and what rights parents and students have.

Newfriars College is a Specialist College providing education to young people aged 16+. We are a wholly owned subsidiary of the Shaw Education Trust (“the Trust”), a multi academy trust with over 25 academies and schools.  The Trust is a charitable company limited by guarantee (registration number 09067175) whose registered office is Shaw Education Trust Head Office, Kidsgrove Secondary School, Gloucester Road, Kidsgrove, ST7 4DL.  

The Data Protection Officer for the Trust is Chris Spender, data.protection@shaw-education.org.uk Please visit Shaw Education Trust’s Data Protection section for further information: https://shaw-education.org.uk/our-trust/data-protection.

The Data Protection Lead for Newfriars College is Jay Marshall Jay.Marshall@newfriarscollege.org.uk The Data Protection Officers are Jim Barrow Jim.Barrow@newfriarscollege.org.uk

Why do we collect and use student information?

We collect and use student information under the following lawful bases:

1. where we have the consent of the data subject
2. where it is necessary for compliance with a legal obligation
3. where processing is necessary to protect the vital interests of the data subject or another person
4. where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

Where the personal data we collect about students is sensitive personal data (including medical and disability information), we will only process it where:

1. we have explicit consent;
2. processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; and / or
3. processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

We use the student data to support our statutory functions of running a college, in particular:

1. to decide who to admit to the college;
2. to maintain a waiting list;
3. to support student learning;
4. to monitor and report on student progress;
5. to provide appropriate pastoral care;
6. to ensure safeguarding of students;
7. to assess the quality of our services;
8. to comply with the law regarding data sharing;
9. for the protection and welfare of students and others in the college;
10. for the safe and orderly running of the college;
11. to promote the college;
12. to communicate with parents/carers;
13. in order to respond to investigations from our regulators or to respond to complaints raised by our stakeholders;
14. to access financial support (requiring National Insurance number)
15. in connection with any legal proceedings threatened or commenced against the college

We use parent/carer data to support our statutory functions of running a college, in particular:

1. Contacting parent/carer to provide progress data
2. Contacting parent/carer in the event of emergency
3. Supporting parents/carers to access financial support

The categories of student information that we collect, hold and share include:

1. Personal information (such as name, unique learner number and address);
2. Characteristics (such as ethnicity, language, medical conditions, nationality, country of birth and free college meal/bursary eligibility);
3. Attendance information (such as sessions attended, number of absences and absence reasons)
4. Behaviour records, including exclusions (if relevant) records about attainment, assessment information, information about special needs (if relevant)
5. Disability and health information.

From time to time and in certain circumstances, we might also process personal data about students, some of which might be sensitive personal data, including information about criminal proceedings/convictions, information about sex life and sexual orientation, child protection/safeguarding.  This information is not routinely collected about students and is only likely to be processed by the college in specific circumstances relating to particular students, for example, if a child protection issue arises or if a student is involved in a criminal matter.  Where appropriate, such information may be shared with external agencies such as the child protection/safeguarding team at the Local Authority, the Local Authority Designated Officer and/or the Police.  Such information will only be processed to the extent that it is lawful to do so and appropriate measures will be taken to keep the data secure.

We collect information about students when they join the college and update it during their time on the roll as and when new information is acquired.

Collecting student information

Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain student information to us or if you have a choice in this. Where appropriate, we will ask parents/students for consent to process personal data where there is no other lawful basis for processing it, for example where we wish to use photos or images of students on our website or on social media to promote college activities, or if we want to ask your permission to use your information for marketing purposes.  Parents/students may withdraw consent at any time.

When students are deemed to have the capacity to make their own decisions in relation to their personal data, we will also ask the student for their consent in these circumstances.  Although parental consent is unlikely to be needed, we wish to take a collaborative approach so we will ask both parents/carers and students (where they have capacity) for consent. Students with the capacity to make their own decisions about their personal data may withdraw consent if consent has previously been given.

In addition, the College also uses CCTV cameras around the college site for security purposes and for the protection of staff and students.  CCTV footage may be referred to during the course of disciplinary procedures (for staff or students) or to investigate other issues.  CCTV footage involving students will only be processed to the extent that it is lawful to do so.  Please see our CCTV policy for more details.

Storing student data

A significant amount of personal data is stored electronically, for example, on our college databases, Databridge/Pro Solution, Evidence for Learning also in applications used for progress monitoring, safeguarding and communications. Some information may also be stored in hard copy format.

Data stored electronically may be saved on a cloud based system which may be hosted in a different country.

Personal data may be transferred to other countries if, for example, we are arranging a college trip to a different country.  Appropriate steps will be taken to keep the data secure.

We store data in compliance with FE guidance: Record keeping and retention information for training providers - GOV.UK (www.gov.uk)

Who do we share student information with?

We routinely share student information with:

• Parents/carers (as defined in the Education Act 1996);
• colleges that students attend after leaving us;
• our local authority;
• a student’s home local authority (if different);
• the Department for Education (DfE);
• college academy councillors / trustees;
• the central team at the Trust;
• NHS health professionals including the college nurse, educational psychologists,
• exam boards.

From time to time, we may also share student information other third parties including the following:

• the Police and law enforcement agencies;
• Education Welfare Officers;
• Courts, if ordered to do so;
• the National College for Teaching and Learning;
• Natspec, the specialist college’s support body;
• The Joint Council for Qualifications;
• Prevent teams in accordance with the Prevent Duty on colleges;
• Other colleges or settings including social care settings, for example, if we are negotiating a managed move and we have your consent to share information in these circumstances;
• our HR providers, for example, if we are seeking HR advice and a student is involved in an issue;
• UCAS
• our legal advisors;
• our insurance providers/the Risk Protection Arrangement;

Some of the above organisations may also be Data Controllers in their own right in which case we will be jointly controllers of your personal data and may be jointly liable in the event of any data breaches. 

In the event that we share personal data about students with third parties, we will provide the minimum amount of personal data necessary to fulfil the purpose for which we are required to share the data.

Why we share student information

We do not share information about our students with anyone without consent unless the law allows us to do so.

We share students’ data with the Department for Education (DfE) and Education and Skills Funding Agency (ESFA) on a statutory basis. This data sharing underpins college funding and educational attainment policy and monitoring.

Collecting parent/carer information

The term “parent” is widely defined in education law to include the natural or adoptive parents (regardless of whether parents are or were married, whether a father is named on a birth certificate or has parental responsibility for the student, with whom the student lives or whether the student has contact with that parent), and also includes non-parents who have parental responsibility for the student, or with whom the student lives.  It is therefore possible for a student to have several “parents” for the purposes of education law.

We require parent/carer contact information including phone, email and address. This information is maintained on our college systems to ensure that we are able contact parent/carers in the event of an emergency; to discuss student progress; and, to discuss any concerns or questions that may arise during the course of college business.

In order to assess if students are eligible for financial support including free college meals or college bursary funds we request national insurance numbers to access benefit information. The NI is used to access information about benefits received by the student and/or family to ensure they are eligible for the financial support. A parent/carer is not required to share their national insurance number however without this information the college may not be able to provide financial support to eligible students.

Data collection requirements:

Youth support services

Our students aged 16+

We will also share certain information about students aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

• post-16 education and training providers;
• youth support services;
• careers advisers.

For more information about services for young people, please visit your local authority website.

We are required by law, to provide information about our students to the DfE and to ESFA as part of statutory data collections such as applying for funding and to evidence use of funding.

The DfE and ESFA have robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE and/or ESFA releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data;
• the purpose for which it is required;
• the level and sensitivity of data requested; and
• the arrangements in place to store and handle the data.

To be granted access to student information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

Requesting access to your personal data

Under data protection legislation, students, and in some circumstances, parents, have the right to request access to information about them that we hold (“Subject Access Request”).  As our students are 16+ we generally regard students as having the capacity to exercise their own rights in relation to their personal data.  This means that where we consider a student to have sufficient maturity and capacity to understand their own rights, we will require a Subject Access Request to be made by the student and not their parent(s) on their behalf.  This does not affect any separate statutory right parents might have to access information about their young person.

Subject to the section below, the legal timescales for the College to respond to a Subject Access Request is one calendar month.  As the College has limited staff resources outside of term time, we encourage parents / students to submit Subject Access Requests during term time and to avoid sending a request during periods when the College is closed or is about to close for the holidays where possible.  This will assist us in responding to your request as promptly as possible. 

By enrolling at College, students are agreeing to allow the College to communicate with parents/carers (named as contacts) to share progress information in addition to discussion of any concerns including attendance.

You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress;
• prevent processing for the purpose of direct marketing;
• object to decisions being taken by automated means;
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
• claim compensation for damages caused by a breach of the our data protection responsibilities.

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/

Contact:

The Data Protection Lead for Newfriars College Jay Marshall Jay.Marshall@newfriarscollege.org.uk or the Data Protection Officer Jim Barrow Jim.Barrow@newfriarscollege.org.uk