At Staverton Church of England VC Primary School, we take the privacy and security of personal information seriously.
We collect and use information about our pupils and their families so that we can provide a safe, effective and inclusive education, meet our legal responsibilities and support every child to thrive.
This notice explains what information we collect, why we collect it, how we use and protect it, who we may share it with and the rights you have in relation to your information.
Staverton Church of England VC Primary School is a Data Controller for the purposes of data protection legislation.
Our ICO registration reference is Z6541300.
We may collect and process information including:
Some of this information is classed as special category personal data and is given additional protection under data protection law.
We use personal information to:
We do not rely on consent for most of the information we process.
Most information is processed because:
Where we process special category information, such as health information, ethnicity or some safeguarding information, we also identify an appropriate additional condition under data protection legislation.
There are some occasions when we rely upon consent, for example for particular uses of photographs or other optional activities. Where consent is the lawful basis, it can normally be withdrawn at any time.
Withdrawing consent does not affect information we are required to process for another lawful reason.
We use photographs and video to celebrate children's learning and achievements and to communicate the life of our school.
Depending on the circumstances, images may be used within school, in school publications, on our website, through school communication platforms or for publicity.
Where consent is required, parents and carers will be given a clear choice about how images may be used. Consent can be changed or withdrawn by contacting the school.
There may also be circumstances where photographs or recordings are processed for safeguarding, security, evidential or educational purposes under another lawful basis.
The school uses digital systems and online services to support teaching, learning, communication and administration.
We also use appropriate filtering and monitoring systems to help keep pupils safe when using school technology and internet services.
This may include monitoring websites accessed, searches, activity on school devices and networks, and alerts generated where potentially harmful or inappropriate activity is identified.
Information arising from filtering and monitoring is only accessed by authorised staff or authorised service providers where there is an appropriate reason to do so, including safeguarding and the security of school systems.
Information is retained only for as long as necessary in accordance with the school's retention arrangements and the requirements of the relevant system.
Where there is a lawful reason to do so, we may share information with organisations including:
We do not sell personal information. We only share information where there is a lawful and appropriate reason to do so.
Protecting children is one of our most important responsibilities.
There will be circumstances where we need to share personal information with other organisations to safeguard a child or another person. This may include children's social care, health professionals, the police, the local authority or another education setting.
Where safeguarding is concerned, information may be shared without consent where the law allows or requires us to do so.
The school is required to provide information about pupils to the Department for Education (DfE) as part of statutory data collections, including the school census.
The DfE uses this information for purposes including funding, education policy, school accountability, research and statistics.
Information supplied to the DfE may form part of the National Pupil Database.
Further information about how the Department for Education uses pupil information and the National Pupil Database is available through GOV.UK.
Most information is provided directly by parents, carers and pupils.
We may also receive information from:
We do not keep personal information for longer than necessary.
Different records need to be retained for different periods depending upon their purpose and any statutory requirements.
The school follows an appropriate records retention schedule and securely deletes or destroys information when it is no longer required.
Some records relating to safeguarding, SEND, accidents, educational history or other statutory matters may need to be retained for significantly longer periods.
We take appropriate technical and organisational measures to protect personal information against loss, unauthorised access, alteration or disclosure.
This includes appropriate access controls, secure systems, staff training, policies and procedures and arrangements with organisations that process information on our behalf.
Under data protection legislation, individuals have a number of rights relating to their personal information.
Depending upon the circumstances, these include:
These rights do not apply in exactly the same way in every situation. For example, the school may be legally required to retain particular information even where someone asks for it to be deleted.
Children have data protection rights in their own right. As children develop sufficient understanding, they may be able to exercise these rights themselves.
Please contact the school if you would like to exercise a data protection right or discuss how your information is being used.
Individuals have the right to request access to personal information held about them. This is commonly known as a Subject Access Request.
Parents and carers do not automatically have a right to access all personal data about their child under UK GDPR. Whether information can be provided will depend upon the child's age and understanding and the circumstances of the request.
There are also separate rights of access to pupils' educational records which may apply.
Please contact the school if you wish to make a request.
We want to resolve concerns about the use of personal information promptly and fairly.
If you have a concern or wish to make a data protection complaint, please contact:
Laura Milsom
Data Protection Lead
Staverton Church of England VC Primary School
School Lane
Staverton
Trowbridge
Wiltshire
BA14 6NZ
Telephone: 01225 782388
Email: Finance@staverton.wilts.sch.uk
Data protection complaints are handled through a clear and proportionate process and are recorded appropriately. We will acknowledge and respond to complaints in accordance with current data protection requirements.
The school has access to an independent Data Protection Officer service through SchoolPro TLC Ltd.
SchoolPro TLC Ltd
Commercial House, 2 Abbeymead Avenue, Abbeymead, Gloucester, United Kingdom, GL4 5UA
Telephone: 01452 947633
Email: contact@schoolpro.uk
Website: schoolpro.uk
You may contact the Data Protection Officer if you have concerns about the way the school has handled your personal information.
You also have the right to raise concerns with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.
Information about your rights and how to make a complaint is available from the Information Commissioner's Office.
We review our privacy information regularly and will update this notice when necessary, including where there are significant changes to how we collect or use personal information.
Last reviewed: September 2026
Next review: September 2027