Berkswich CE Privacy notice

for governors

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing 'privacy notices' (sometimes called 'fair processing notices') to individuals where we are processing their personal data.

Privacy notice – how the school uses governors’ information

What categories of information are processed?

The categories of personal information that we process include the following:

• Personal identifiers and contacts – e.g. name, phone number, address (including postcode)
• Characteristics information – e.g. gender, age, ethnic group
• Governance information – e.g. role, start date, end date
• Relevant family and business interests

This list is not exhaustive – to access the current list of information the school or trust processes, please see the Data Asset Register which can be found in the school office.

Why do we collect and use your information?

The personal data we collect about you is essential, in order for the school to fulfil its official functions and meet legal requirements.

We collect and use your information for the following reasons:

• To enable the school to meet its obligations and legal duties in relation to publishing governance information on GIAS (Get Information About Schools - https://www.get-information-schools.service.gov.uk/)
• To provide transparency around governance arrangements
• To enable the school and the DfE to identify, with ease, individuals who are involved in governance and who govern at more than one school or within more than one trust
• To enable the DfE, when required, to conduct checks on the suitability of governors
• To keep pupils safe

For consent, legal obligation, vital interests, public task and legitimate interests, we use basis from Article 6 of the UK GDPR. For special category data, we also rely on the following conditions under Article 9 of the UK GDPR. Under the GDPR, the legal basis/bases we rely on for processing personal information for general purposes are:

• For the purpose of meeting the statutory duties placed upon the school in accordance with the lawful basis of legal obligation.
• For the purpose of keeping pupils safe, in accordance with the statutory requirements for schools contained in the government document, Keeping Children Safe in Education
• Governing bodies, under section 538 of the Education Act 1996, have a legal duty to provide the governance information as detailed above.

How do we collect your information?

We collect your personal information via the following methods:

• Governor application form
• Governor information record
• DBS form
• Record of business interests form

Governance roles data is essential for the school’s operational use. Whilst the majority of information you provide to us is mandatory, some of it is requested on a voluntary basis. To comply with the UK GDPR, we will inform you at the point of collection whether you are required to provide certain information to us or if you have a choice.

How do we store your information?

Your personal information is retained in line with the school’s Records Management Policy, which can be found on the school’s website at: www.berkswichceprimary.co.uk.

For more information about how we securely store your information, please see the school’s Data and E-Security Breach Prevention and Management Plan (available on the school’s website).

Who do we share your information with and why?

We do not share information about you with anyone without your consent, unless the law and our policies allow us to do so.

• The LA – to meet legal obligations to share certain information, e.g. safeguarding concerns
• The DfE – to meet legal obligations to share certain information, e.g. safeguarding concerns
• Auditors

Any information we share with other parties is transferred securely and held by the other organisation in line with their data security policies. All governor data required by the DfE is entered manually on the GIAS system and held by the DfE under a combination of software and hardware controls which meet the current government security policy framework.

Why do we share your information?

We do not share information about you with anyone without your consent, unless the law and our policies allow us to do so.

• The LA - we are required to share information about our governance roles with our LA, Staffordshire County Council
• The DfE collects personal data from schools and LAs. We are required to share information about individuals in governance roles with the DfE under Section 538 of the Education Act 1996.

Any information we share with other parties is transferred securely and held by the other organisation in line with their data security policies. All trustee and governor data required by the DfE is entered manually on the GIAS system and held by the DfE under a combination of software and hardware controls which meet the current government security policy framework.

The governance data that we lawfully share with the DfE via GIAS will:

• Increase the transparency of governance arrangements.
• Enable schools and the DfE to quickly and accurately identify individuals who are involved in governance and who govern in more than one context.
• Allow the DfE to be able to uniquely identify an individual and, in a small number of cases, conduct checks to confirm their suitability for this important and influential role.

You can find out more about the requirements placed on the school by the DfE, including the data we share with them, via this website: https://www.gov.uk/government/news/national-database-of-governors.

Some of this personal data is not publicly available and is encrypted within the GIAS system. Access is restricted to authorised DfE and education establishment users with a DfE Sign-in account who need to see it to fulfil their official duties. The information is for internal purposes only and is not shared beyond the DfE, unless the law allows it to be.

Under the Data Protection Act 2018, you are entitled to ask the DfE what personal information it holds about you. You have the right to ask the DfE:

• If it processes your personal data.
• For a description of the data it holds about you.
• The reasons it is holding your data and any recipient it may be disclosed to.
• For a copy of your personal data and any details of its source.

To exercise these rights, you should make a subject access request. Information on how to do this can be found by following this link: https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter. You can also contact the DfE directly using its online contact form by following this link: https://www.gov.uk/contact-dfe.

Auditors

Some of your details may be passed to auditors to enable them to carry out their work in overseeing governance reviews of the school. This data will be similar to that which is published by the DfE on GIAS.

What are your rights?

You have specific rights to the processing of your data, these are the right to:

• Request access to the information the trust or school holds about you.
• Restrict the processing of your personal information e.g. consenting to it being stored but restricting it being processed any further.
• Object to and prevent processing for the purpose of direct marketing and processing for the purpose of scientific or historical research and statistics.
• Object to decisions being taken by automated means.
• Have inaccurate or incomplete personal data rectified, blocked, erased or destroyed.
• Not be subjected to decisions based purely on automated processing where it produces a legal or similarly significant effect on you.
• To request the deletion or removal of personal data where there is no compelling reason for the continued processing.
• Seek compensation, either through the ICO or the courts.

If you want to request access to the personal information we hold about you, please contact the school’s Data Protection Officer (DPO). See contact details below.

How to withdraw consent and lodge complaints

Where the trust or school processes data on the basis of consent, you have the right to withdraw your consent at any time. To withdraw your consent, you can contact school’s Data Protection Officer (DPO). You are not required to provide a reason for withdrawing consent.

If you are concerned or unhappy about the way we are collecting or using your information, please raise your concern or lodge a complaint with the school’s DPO in the first instance. You can also contact the ICO at https://ico.org.uk/concerns/.

How can you find out more information?

If you require further information about how we and/or the DfE store and use your personal data, please visit our website to view our Data Protection Policy and Record Management Policy via www.berkswichceprimary.co.uk or visit the Gov.UK website.

You are entitled to contact the DfE under the provisions of the Data Protection Act 2018 to ask the following questions:

• If they are processing your personal data.
• For a description of the data they hold about you.
• The reasons that they're holding your data and any recipient it may be disclosed to.
• For a copy of your personal data and any details of its source.

Governors are also entitled to make a SAR directly to the DfE, further information on how to do this can be found here.

If you would like to discuss anything in this privacy notice, please contact Ms Jackson (headteacher) or the school’s DPO:

Natalie Morrissey

Information Governance Manager

Staffordshire County Council

Information Governance Unit – Directorate of Strategy, Governance and Change

IGU | Staffordshire County Council

4th Floor, Staffordshire Place 1,

Tipping Street, Stafford, ST16 2DH

 (01785) 278109

Berkswich CE Primary Governor Declaration

We ask that all governors click the link at the bottom of the page to sign the declaration that is also copied below:

I, ______________________________________ (print your name) declare that I understand:

• The categories of my personal information the school collects and uses.
• The school has a lawful basis for collecting and using my personal information.
• The school may share my information with the stated organisations.
• The school will not share information about me with anyone without my consent, unless the law and our policies allow us to do so.
• My information is retained in line with the school’s Records Management Policy.
• My rights to the processing of my personal information.