GDPR Privacy Notice

Abercarn Primary School

 GDPR Privacy Notice

Abercarn Primary School

Chapel of Ease

NP11 5LH

Privacy Notice Ref No:

Date Created:

Date Published:

Version Number:


May 2018

June 2018



Contact Details:                    01495 244566

Privacy Notice Name:              Processing pupil information

Description of Privacy Notice:        This Privacy Notice describes how the school will process personal information about pupils and families.



As school we collect and use data in a various ways.

General Data Protection Regulations (GDPR) was released on 25th May 2018, and had implications for all schools and businesses that use data.  As a school we need to comply with these guidelines and make individuals aware of how their data is used and stored within our organisation.

Your Obligations


Certain pupil data is essential for the schools’ operational use. Whilst the majority of pupil information you provide to us is mandatory due to a legal or contractual obligation (see below), some of it is optional, and if this is the case you will be asked to give your consent.


We will inform you at the point of collection whether you are required to provide certain pupil information to us or if you have a choice in this, and any consequences should you decide not to provide information or to subsequently withdraw consent.



Purpose and legal basis for using your information


We process personal information about pupils and their families:


·                to support pupil learning

·                to monitor and report on pupil progress

·                to provide appropriate pastoral care

·                to assess the quality of our services

·                to keep children safe (food allergies, or emergency contact details)

·                to meet the statutory duties placed upon us for Welsh Government data collections

·                to administer trips and activities, catering and free school meal management

Legal basis for processing


For the processing of personal data to be lawful, an Article 6 condition from the General Data Protection Regulations 2016 is required.


·       Mandatory school processing of pupil information is covered by the Article 6 condition - processing is necessary for compliance with a legal obligation to which the controller is subject. The legal obligation is contained within the Education Act 1996 and associated Welsh Government regulations.


·       Optional processing of personal data is covered by the Article 6 condition – explicit consent. If this is case, you have the right to withdraw consent. Please contact the school for further information.


Data Protection legislation provides extra protection for certain classes of information called 'special category’ personal data, which includes:


•         Physical or mental health or condition

•         Politics

•         Racial or ethnic origin

•         Religion or other beliefs of a similar nature

•         Sex life

•         Sexual orientation

•         Trade union membership

•         Genetics

•         Biometrics (where used for identification purposes)


Data Protection legislation also provides extra protection for personal data in relation to criminal allegations, proceedings, outcomes and sentences.


If any information falls within these definitions, additional conditions are required from Article 9 for special category personal data and Article 10 for personal data relating to crimes. These additional conditions are contained in the UK Data Protection Bill, due to be enacted during 2018. When the Bill has been enacted this privacy notice will be updated, but if you have any questions in the meantime please contact the school.



How we use pupil information

Why do we collect and use pupil information and Legal Basis for Using Information?

We collect and use pupil information under section 537A of the Education Act 1996, and section 83 of the Children Act 1989. We also comply with Article 6(1)(c) and Article 9(2)(b) of the General Data Protection Regulation (GDPR).

We use the pupil data:


·       As part of our admissions process

·       To support teaching and learning

·       To monitor and report on pupil progress to provide appropriate pastoral care

·       To assess the quality of our services

·       To comply with the law regarding data sharing

·       To access our school meals, payments and school communication system   

·       To support you (pupils) to decide what to do after they leave school


Categories of personal data obtained


Most of the information that the school holds/uses about you has been collected from you directly, but some information may have been received from other organisations/sources, as listed below.


The school has obtained the following categories of your personal data that make up your education record:


·       personal identifiers and contacts (such as name, unique pupil number, contact details and address)

·       characteristics (such as ethnicity, language, free school meal eligibility and immigration status)

·       safeguarding information (such as court orders and professional involvement)

·       special educational needs (including the needs and ranking)

·       medical and administration (such as doctors information, child health, dental health, allergies, medication and dietary requirements)

·       attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)

·       performance in internal and national assessments and examinations

·       behavioural information (such as exclusions and any relevant alternative provision put in place)


Source of the personal data


This information has been collected from:

·       Pupils/families directly, (e.g. via registration forms at the start of the school year, school trip applications, etc)

·       Caerphilly County Borough Council Education Directorate

·       Caerphilly County Borough Council Social Services Directorate (if applicable)

·       This information has been shared with the school by a previous school attended by the pupil


If you would like further information on the source of this information please contact the school.


Categories of pupil information that we collect, hold and share include:

·       Personal information (such as name, unique pupil number and contact details)

·       Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)

·       Attendance information (such as sessions attended, number of absences and absence reasons)

·       National curriculum assessment results, special educational needs information, relevant medical information


Storing pupil information

Abercarn Primary School keeps information about you on computer systems and also sometimes on paper.


We hold your education records securely (computerised and paper) in accordance with guidance issued by the Local Authority regarding document retention i.e. to comply with legal requirements.


Prime documents linked to Safeguarding, SEN, Educational Psychology, are transferred to Secondary School.


Access to the school’s IT and Data Systems is restricted to authorised individuals only and is underpinned and protected by our Digital Safety and Acceptable Usage Policies. Access is logged and routinely monitored to protect users and the integrity and security of systems and data.


Abercarn Primary School adheres to the following retention periods for computer held personal data:


·       Pupil Google mailboxes/Drive are retained for a period of 2 calendar year.

·       Staff local home drives and mailboxes/Drive are retained for a period of 5 calendar years.

·       System and Web Filter logs are retained for a period of 1 calendar year with the exception of print logs which are held for a period of 1 calendar year and 1 month. (LA)

·       CCTV Footage is retained for a period of 30 days.

·       Pupil information is retained on our SIMS system (School Management Information System) and retained for a period of 25 years.


Access to data on all laptop computers is secured through encryption pens or other means, to provide confidentiality of a data in the event of loss or theft of equipment. NO DATA will be stored on laptop/computer hard drive.



After the following retention periods the data is deleted securely from our systems Where data resides on third party systems e.g. Google Apps, contracts exist to ensure data security, integrity and retention periods match legislation with Abercarn Primary School in house systems.


All system backups are encrypted and are held in multiple, physically secure locations as part of the school’s disaster recovery plan. (LA)


There are strict controls on who can see your information. We will not share your data if you have advised us that you do not want it shared unless it is the only way we can make sure you stay safe and healthy, we are legally required to do so or the data is required for operational purposes.


Paper records are held in lockable cabinets. All visitors to site have a photograph taken and are logged into an electronic visitors access system. Control to areas where records are stored is restricted – pupils and visitors are not permitted to access any such area unless required and under the supervision of a staff member.  


Who will have access to your information

Identity of Data Controller and Data Protection Officer The Data Controllers are Mr G Roden and Mr L Greenslade and the Data Protection officer is Mr G Roden

The Data Controller for your information is Gareth Roden, Abercarn Primary School.

The Data Protection Officer is contracted by the school to Caerphilly County Borough Council. You can contact the school Data Protection Officer on 01443 864322 or by email at


Details of any sharing of your information with other organisations

We must share certain pupil information with specific organisations, but only with a clearly defined reason and an appropriate legal basis under data protection law.

We always ensure that the sharing of personal information is securely undertaken.


Reason and lawful basis

School that the pupil subsequently attends

Continuity of education - compliance with a legal obligation (Art 6 GDPR)

Caerphilly County Borough Council

To monitor education provision and research to inform policy and funding decisions- compliance with a legal obligation (Art 6 GDPR)

To provide IT support – performance of a contract (Art 6 GDPR)

To provide Health and Safety support - performance of a contract (Art 6 GDPR)

To defend insurance claims – legitimate interests (Art 6 GDPR) and legal proceedings (Art 9 GDPR)

To administer Special Educational Needs support – public task (Art 6 and 9 GDPR)

Safeguarding purposes – compliance with a legal obligation, vital interests, or public task (Art 6 and 9 GDPR)

Welsh Government (further detail below)

Provision of statistics to monitor education - compliance with a legal obligation (Art 6 GDPR)

Aneurin Bevan University Health Board

To provide a school health service – public task (Art 6 GDPR); public health (Art 9 GDPR)

Safeguarding purposes – compliance with a legal obligation, vital interests, or public task (Art 6 and 9 GDPR)

Secondary schools only Youth support services (pupils aged 13+)

Education or training of 13-19 year olds (S507B of the Education Act 1996) - compliance with a legal obligation (Art 6 GDPR)


School cashless system


Google Suit for Education

My School App

Parent Evening Booking System

GL Assessment

Text Messaging System

Abacus Maths

Purple Mash


School Website

Social Media – Twitter/Instagram/Facebook/YouTube (Photographs)

Thrive Intervention Group

Classroom Monitor

Oxford Owl



Pupil Reward Points


To support teaching and learning


Sharing information with Welsh Government

The Welsh Government receives information on pupils directly from schools normally as part of statutory data collection which consists of the following:

  • Post-16 data collection
  • Pupil Level Annual School Census (PLASC)
  • Educated other than at school (EOTAS) pupil level collection
  • National data collection (NDC)
  • Attendance collection
  • Welsh National Tests (WNT) data collection

In addition to the data collected as part of PLASC, the Welsh Government and local authorities also receive information regarding National Curriculum assessments, public examination results, and attendance data at individual pupil level which comes from Schools and /or Awarding Bodies (e.g. WJEC).  

The Welsh Government uses this personal information for research (carried out in a way that ensures individual children and young people cannot be identified) and for statistical purposes, to inform, influence and improve education policy and to monitor the performance of the education service as a whole. Examples of the sort of statistics produced can be viewed at  Further information is on the Welsh Governments’ use of personal data is set out within the Welsh Governments’ Privacy Policy which is available here.   


Details of any external data processors

Enter details of external data processors here, e.g. IT suppliers, App suppliers, etc


Seesaw gives families an immediate and personalised look into their child’s school day using photos or comments – We share pupil names and parents share their names and email addresses on sign up.

Google Suite for Education

Pupils use Google to complete various tasks e.g. word processing, email, collaboration. Pupil names are shared with Google and email addresses are generated.

My School App

My School App uses data such as parents name, telephone number and email address. Parents / Families can receive notifications, updates, newsletters and report absence through this app.

Parent Evening Booking System

This system is linked with SIMs and transfers pupil names, classes and dates of birth as well as parents’ names, email addresses and telephone numbers. This system allows parents to book parents evening appointments online.

GL Assessment

We use GL Assessment for English, Reading and Maths assessments. We share pupil names, classes and dates of birth in order for assessments to be standardised.

Text Messaging System

This system is linked with SIMs and transfers pupil names and classes as well as parents’ names and telephone numbers.

Abacus Maths

Abacus Maths is an active learn maths site in which pupils complete home tasks linked to learning in school. Pupil names are shared with Abacus Maths.

Purple Mash

Purple Mash is an IT toolkit and allows pupils to complete many IT based tasks. Pupil names are shared with Purple Mash.



Hwb is a Welsh Government digital learning website. It allows learners access to Microsoft packages and various other software. Hwb is linked to SIMS and takes pupil names and year groups.

School Website

The school website is used to share various school information but also allows pupils to login to access various aspects. Pupil email addresses are shared with the school website.

Social Media – Twitter / Instagram / Facebook / YouTube (Photographs etc)

Pupil photographs are shared with our Social Networking sites. Detailed consent is gained at the start of every year.

Thrive Intervention Group

Thrive is a social and emotional intervention. Some pupils are involved in this intervention and consent is gained separately.

Pupils name, UPN, class and date of birth are shared.

Classroom Monitor

Classroom Monitor is used as an assessment reporting tool for literacy, numeracy and digital competency. Classroom Monitor is linked to SIMS and pulls pupils unique number, Additional Learning Needs information,  name, gender, date of birth and class / year group.

Parent Teacher Association

Pupil names are shared with the PTA in order for them to facilitate class lists / parent communications.

Evolve - Educational Visits

This system is used to risk assess and record educational visits. Pupil names and classes are stored on this system.

Oxford Owl

Online reading books and activities. Pupil names and Gmail is shared with this service.

Pupil Rewards Points

Pupil Reward Points is used as a rewards/house points system where pupils can redeem points for prizes. Pupil names and classes are stored on this system.

Upay cashless system

Upay is used as a cashless catering system for School dinners . Upay is linked to FSM and pulls pupils unique number, name, gender, date of birth and class / year group, Parents email address.

Pupil Reward Points

An online system for pupils to collect points, and redeem points for gifts. Pupil names are shared with this service via SIMs.


EduKey is an online system that allows the school to track Additional Learning Need provisions throughout the school. This system is used to generate Individual Development Plans, Pupil Profiles and many other aspects relating to Additional Learning Needs. All details within SIMs is shared with this service – both pupil and parent.



Why we share pupil information

We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.

We share pupils’ data with the Welsh Assembly Government on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring. To find out more about the data collection requirements placed on us by the Welsh Assembly Government (for example; PLASC) go to

The school will, on an annual basis, share individual Data Collection Sheets with you in order to ensure that our records are accurate and up to date.



Requests for Information

All recorded information held by the School may be subject to requests under the Freedom of Information Act 2000, and the General Data Protection Regulations. If you would like to submit a Freedom of Information / Subject Access Request, you can e-mail us here.


Subject Access Requests will be dealt with within one month (including weekends) of the date of receipt by the school. Please note that no charge is made for this information.


Requests should be marked for the attention of  Gareth Roden and e-mailed to:


How long will we retain your information?


We hold pupil data securely for the set amount of time documented in our data retention schedule.

·       Primary schools will retain information whilst the child remains at the primary school, and securely transfer the information to the secondary school or alternative provision when the child moves on.

·       Secondary schools will retain information about pupils and their families for 25 years after the pupil’s birth date.


Information with historic value will be transferred to Gwent Archives, but any personal information will be subject to an appropriate closure period so that it is restricted from public inspection.


For more information contact Gwent Archives on 01495 353363




Your Rights

The Data Protection Act/GDPR gives you a number of rights.  Please note that not all of your rights are absolute and we will need to consider your request upon receipt.


You have the right to request;


·       to have your data rectified if it is inaccurate or incomplete.

·       to have your data erased.

·       to restrict the processing of your data.

·       to exercise your right to data portability.

·       to object to the processing for the purposes of direct marketing, profiling and automated decision making.


If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance by contacting one of the two School contacts detailed below or directly to the Information Commissioner’s Office at:-


Complaints Procedure


If you are unhappy with the way that the school has handled your request / information, you have the right of complaint. Please contact the school outlining your concerns in the first instance.


If you remain unhappy you can contact the schools Data Protection Officer on 01443 864322


You can also complain to the Information Commissioner's Office on 029 2067 8400.



If you would like to get a copy of the information about you that Caerphilly CB Council provides to other providers please contact: Joanne Jones on telephone no: (01443) 864322 or Email:


If you would like to discuss anything in this privacy notice, please contact the Schools Data Controllers: Head Teacher – Gareth Roden or Digital Media Manager – Luke Greenslade who will be pleased to assist.

Last modified: Sunday, 18 August 2019, 7:30 PM