GDPR Privacy Notice

Abercarn Primary School

 GDPR Privacy Notice

Abercarn Primary School

Chapel of Ease

NP11 5LH

Privacy Notice Ref No:

Date Created:

Date Published:

Version Number:


May 2018

June 2018



Contact Details:                    01495 244566

Privacy Notice Name:              Processing pupil information

Description of Privacy Notice:        This Privacy Notice describes how the school will process personal information about pupils and families.


How we will use your information


Source and type of information being processed

The Categories of pupil information that we collect, hold and share include:


·        personal information (such as name, unique pupil number and address)

·        characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)

·        attendance information (such as sessions attended, number of absences and absence reasons)

·        behavioural information (such as exclusions and any relevant alternative provision put in place)

·        safeguarding information (such as court orders and professional involvement)

·        special educational needs (including the needs and ranking)

·        medical and administration (such as doctors information, child health, dental health, allergies, medication and dietary requirements)

·        contact details, contact preferences, date of birth, identification documents

·        performance in internal and national assessments and examinations, assessment information

·        pupil and curricular records

·        details of any medical conditions, including physical and mental health

·        details of any support received, including care packages, plans and support providers

·        photographs

·        CCTV images captured in school


Source of the personal data


This information has been collected from:


·       Pupils/families directly, (e.g. via registration forms at the start of the school year, school trip applications, etc)

·       Other schools where a pupil has previously attended

·       Caerphilly County Borough Council Education Directorate

·       Caerphilly County Borough Council Social Services Directorate (if applicable)

·       Aneurin Bevan University Health Board School Health Service


If you would like further information on the source of this information, please contact the school.


Your Obligations


Certain pupil data is essential for the schools’ operational use. Whilst the majority of pupil information you provide to us is mandatory due to a legal or contractual obligation (see below), some of it is optional, and if this is the case you will be asked to give your consent.


We will inform you at the point of collection whether you are required to provide certain pupil information to us or if you have a choice in this, and any consequences should you decide not to provide information or to subsequently withdraw consent.


Why do we collect and use your information


Abercarn Primary collects information about children and young people and their parents or legal guardians upon enrolment and at other key times during the school year. When children and young people transfer to the School, we may receive information from other schools and early years providers.


Abercarn Primary processes the information it collects to administer the education it provides to children and young people. For example:

  • the provision of educational services to individuals;
  • monitoring and reporting on pupils’/children’s educational progress;
  • the provision of welfare, pastoral care and health services;
  • the giving of support and guidance to children and young people, their parents and legal guardians;
  • the organisation of educational events and trips;

Abercarn Primary collects information about children and young people and their parents or legal guardians when they apply for admission to Abercarn Primary. This data can be accessed by Caerphilly County Borough Council for the same reasons listed above.

We collect and use pupil information under Section 537A of the Education Act 1996 and section 83 of the Children Act 1989.  We also comply with Article 6(1)(c) and Article 9 (2)(b) of the General Data Protection Regulation (GDPR).


We use pupil data:


·                to support pupil learning

·                to monitor and report on pupil progress

·                to provide appropriate pastoral care

·                to assess the quality of our services

·                to keep children safe (food allergies, or emergency contact details)

·                to meet the statutory duties placed upon us for Welsh Government data collections

·                to administer trips and activities, catering and free school meal management

Legal basis for processing


In order for the processing of personal data to be lawful under the General Data

Protection Regulations 2016, a valid condition from Article 6 of the Regulations must

be identified.


·       Mandatory school processing of pupil information is covered by the Article 6 condition - processing is necessary for compliance with a legal obligation to which the controller is subject. The legal obligation is contained within the Education Act 1996 and associated Welsh Government regulations.


·       Optional processing of personal data is covered by the Article 6 condition – explicit consent. If this is case, you have the right to withdraw consent. Please contact the school for further information.


Data Protection legislation provides extra protection for certain classes of information called 'special category’ personal data, which includes:


•         Physical or mental health or condition

•         Politics

•         Racial or ethnic origin

•         Religion or other beliefs of a similar nature

•         Sex life

•         Sexual orientation

•         Trade union membership

•         Genetics

•         Biometrics (where used for identification purposes)


Data Protection legislation also provides extra protection for personal data in relation to criminal allegations, proceedings, outcomes and sentences.


If any information falls within these definitions, additional conditions are required from Article 9 for special category data and Article 10 for personal data relating to crimes, taking into account additional provisions of the Data Protection Act 2018. If you have any questions in the meantime, please contact the school.


Article 9(2)(g) for special category data –

processing is necessary for reasons of substantial public interest on the basis of Union or Member State law; and Article 10 for criminal data – when the processing is authorised by Union or Member State law.


The relevant Member State law is the Data Protection Act 2018, and this processing is covered by Schedule 1, Part II, 6(1).


This condition is met if the processing—


(a) is necessary for a purpose listed in sub-paragraph (2), and

(b) is necessary for reasons of substantial public interest.


 (2) Those purposes are—


(a) the exercise of a function conferred on a person by an enactment or rule of law;

(b) the exercise of a function of the Crown, a Minister of the Crown or a government department.

Who will have access to your information?


Identity of Data Controller and Data Protection Officer


The Data Controller for your information is Mr G Roden and Mr L Greenslade


The Data Protection Officer is contracted by the school to Caerphilly County Borough Council. You can contact the school Data Protection Officer on 01443 864049, or by email at


Details of main users of your information


The main users of your information will be Abercarn Primary School.

Details of sharing your information with other organisations


We may be required to share certain pupil information with specific organisations, but only with a clearly defined reason and an appropriate legal basis under data protection law.


We always ensure that the sharing of personal information is securely undertaken.



Reason and lawful basis

School that the pupil subsequently attends

Continuity of education - compliance with a legal obligation (Art 6 GDPR)

Caerphilly County Borough Council

To monitor education provision and research to inform policy and funding decisions- compliance with a legal obligation (Art 6 GDPR)

To provide IT support – performance of a contract (Art 6 GDPR)

To provide Health and Safety support - performance of a contract (Art 6 GDPR)

To defend insurance claims – legitimate interests (Art 6 GDPR) and legal proceedings (Art 9 GDPR)

To administer Special Educational Needs support – public task (Art 6 and 9 GDPR)

Safeguarding purposes – compliance with a legal obligation, vital interests, or public task (Art 6 and 9 GDPR)

Welsh Government (further detail below)

Provision of statistics to monitor education - compliance with a legal obligation (Art 6 GDPR)

Aneurin Bevan University Health Board

To provide a school health service – public task (Art 6 GDPR); public health (Art 9 GDPR)

Safeguarding purposes – compliance with a legal obligation, vital interests, or public task (Art 6 and 9 GDPR)

Secondary schools only Youth support services (pupils aged 13+)

Education or training of 13-19 year olds (S507B of the Education Act 1996) - compliance with a legal obligation (Art 6 GDPR)


School cashless system


Google Suit for Education

My School App

Parent Evening Booking System

GL Assessment

Text Messaging System

Abacus Maths

Purple Mash


School Website

Social Media – Twitter/Instagram/Facebook/YouTube (Photographs)

Thrive Intervention Group

Classroom Monitor

Oxford Owl



Pupil Reward Points


To support teaching and learning

Sharing information with Welsh Government

The Welsh Government receives information on pupils directly from schools normally as part of statutory data collection which consists of the following:

  • Post-16 data collection
  • Pupil Level Annual School Census (PLASC)
  • Educated other than at school (EOTAS) pupil level collection
  • National data collection (NDC)
  • Attendance collection
  • Welsh National Tests (WNT) data collection

In addition to the data collected as part of PLASC, the Welsh Government and local authorities also receive information regarding National Curriculum assessments, public examination results, and attendance data at individual pupil level which comes from Schools and /or Awarding Bodies (e.g. WJEC).  

The Welsh Government uses this personal information for research (carried out in a way that ensures individual children and young people cannot be identified) and for statistical purposes, to inform, influence and improve education policy and to monitor the performance of the education service as a whole. Examples of the sort of statistics produced can be viewed at  Further information is on the Welsh Governments’ use of personal data is set out within the Welsh Governments’ Privacy Policy which is available here.   

Details of any external data processors


Seesaw gives families an immediate and personalised look into their child’s school day using photos or comments – We share pupil names and parents share their names and email addresses on sign up. |

Google Suite for Education

Pupils use Google to complete various tasks e.g. word processing, email, collaboration. Pupil names are shared with Google and email addresses are generated.

My School App

My School App uses data such as parents name, telephone number and email address. Parents / Families can receive notifications, updates, newsletters and report absence through this app.

Parent Evening Booking System

This system is linked with SIMs and transfers pupil names, classes and dates of birth as well as parents’ names, email addresses and telephone numbers. This system allows parents to book parents evening appointments online.

GL Assessment

We use GL Assessment for English, Reading and Maths assessments. We share pupil names, classes and dates of birth in order for assessments to be standardised. |

Text Messaging System

This system is linked with SIMs and transfers pupil names and classes as well as parents’ names and telephone numbers.

Abacus Maths

Abacus Maths is an active learn maths site in which pupils complete home tasks linked to learning in school. Pupil names are shared with Abacus Maths.

Purple Mash

Purple Mash is an IT toolkit and allows pupils to complete many IT based tasks. Pupil names are shared with Purple Mash.


Hwb is a Welsh Government digital learning website. It allows learners access to Microsoft packages and various other software. Hwb is linked to SIMS and takes pupil names and year groups.

School Website

The school website is used to share various school information but also allows pupils to login to access various aspects. Pupil email addresses are shared with the school website.

Social Media – Twitter / Instagram / Facebook / YouTube (Photographs etc)

Pupil photographs are shared with our Social Networking sites. Detailed consent is gained at the start of every year.

Thrive Intervention Group

Thrive is a social and emotional intervention. Some pupils are involved in this intervention and consent is gained separately.

Pupils name, UPN, class and date of birth are shared.

Classroom Monitor

Classroom Monitor is used as an assessment reporting tool for literacy, numeracy and digital competency. Classroom Monitor is linked to SIMS and pulls pupils unique number, Additional Learning Needs information,  name, gender, date of birth and class / year group.

Parent Teacher Association

Pupil names are shared with the PTA in order for them to facilitate class lists / parent communications.

Evolve - Educational Visits

This system is used to risk assess and record educational visits. Pupil names and classes are stored on this system.  |

Oxford Owl

Online reading books and activities. Pupil names and Gmail is shared with this service.

Upay cashless system

Upay is used as a cashless catering system for School dinners . Upay is linked to FSM and pulls pupils unique number, name, gender, date of birth and class / year group, Parents email address.

Pupil Reward Points

An online system for pupils to collect points, and redeem points for gifts. Pupil names are shared with this service via SIMs.


EduKey is an online system that allows the school to track Additional Learning Need provisions throughout the school. This system is used to generate Individual Development Plans, Pupil Profiles and many other aspects relating to Additional Learning Needs. All details within SIMs is shared with this service – both pupil and parent.


The system is in place for signing in and out for staff and visitors. Data is stored on the iPad in school. The system will provide reports of attendance, time in and time out, and will be emailed via the schools account.


Captia SIMS is a Management Information System (MIS) used to store pupil information collected directly from parents/carers when a pupil joins the school. SIMS is hosted at a Microsoft Azure datacentre in the UK and data is encrypted at rest in cloud storage and as it travels across the internet or within networks. |


CCTV is used both inside the school to ensure the safety of all staff, pupils, and visitors. The school CCTV is monitored by APS and data is stored in Abercarn Primary.


Requests for information


All recorded information held by the school may be subject to requests under the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Data Protection legislation (General Data Protection Regulations 2016 and Data Protection Act 2018).


If the information you provide is subject to such a request, where possible, the school will consult with you on its release. If you object to the release of your information, we will withhold your information if the relevant legislation allows.


How long will we retain your information?


Details of retention period


We hold pupil data securely for the set amount of time documented in our data retention schedule. Abercarn Primary will retain information for the duration the child remains at the primary school, and securely transfer the information to the secondary school or alternative provision when the child moves on.


Your Rights (including Complaints Procedure)


Your rights under data protection law


Data Protection laws give data subjects (those who the information is about) a number of rights, which include:


  • Right to be informed how personal data is collected, stored, managed, protected, and processed.
  • Right of access to request a copy of personal information held of yourself. However, please be aware that information can sometimes be legitimately withheld.
  • Right to rectification of inaccurate or incomplete personal data.
  • Right to erasure where you have the right to have your personal data erased in certain circumstances. This does not include any personal data that must be retained by law.
  • Right to restriction, which allows you to limit the way we use your personal data in some circumstances.
  • Right to portability gives an individual the right the receive copies of data provided to a controller in a portable format.
  • Right to object to the processing of ones personal data; and the final one is the
  • Rights in relation to automated decision making and profiling.


Children and young people have certain rights under data protection legislation, including a general right to be given access to personal data held about them by an organisation. A child or young person is normally deemed to be mature enough to understand their rights of access from the age of 12 years or over. Therefore, the child or young person should either submit an information request themselves directly to the school, or provide a letter of authority to give a third party (i.e. a parent or carer) consent to act on their behalf. A parent requesting information on behalf of a child would need to provide proof of ID and Parental Responsibility.


To enact your rights, please contact Abercarn Primary as detailed at the top of this document. A copy of any individual right request and your response will be kept for 3 years.


Complaints Procedure


If you are unhappy with the way that the school has handled your request / information, you have the right of complaint. Please contact Mr G Roden outlining your concerns in the first instance.


If you remain unhappy, you can contact the schools Data Protection Officer on 01443 864322 /


You also have the right to ask the Information Commissioner, who enforces and oversees the Data Protection Act in the UK, to assess whether or not the processing of personal information is likely to comply with the provisions of our legislative responsibilities. Further information on your rights is available from:



If you would like to get a copy of the information about you that Caerphilly CB Council provides to other providers please contact: Joanne Jones on telephone no: (01443) 864322 or Email:


If you would like to discuss anything in this privacy notice, please contact the Schools Data Controllers: Head Teacher – Gareth Roden or Digital Media Manager – Luke Greenslade who will be pleased to assist.


Summary Privacy Notice


How we will use your information


Abercarn Primary School processes personal information about pupils and their families to support pupil learning and monitor attainment, to provide pastoral care, and to keep children safe. We also process personal information to meet the statutory duties placed upon us by Welsh Government, to administer optional school trips and activities, and to deliver the school catering service.


The school takes its responsibilities under data protection law very seriously, and will store and use all personal information securely, disposing of it when no longer required. Personal information may be shared securely for clear purposes with other organisations such as Caerphilly County Borough Council, Welsh Government, or other external partners (e.g. Seesaw, Gsuite for Education, Abacus, Purplmash, other Local Authorities, Health Boards, and Special Educational Needs Tribunal Wales) that provide a service to pupils/families. You have a number of rights in relation to your personal information, including the right of access to information and the right of complaint.


For further information on how we process your information and your rights please click the following link:

Last modified: Tuesday, 19 May 2020, 7:58 PM