PRIVACY NOTICE

St. John’s School & College General Privacy Notice

As a provider of Education and Care for children and young adults, St John’s School and College is required to collect and process personal and sensitive data concerning learners.

All data is collected and processed in line with the General Data Protection Regulations 2018 and is limited to that which is needed for our organisation to function.  Information will only be shared with third parties when there is a requirement to do so in order to educate and/or care for learners, for reasons of Safeguarding and Child Protection and in order to comply with contractual or legal obligations, for example, Local Authority or NHS. Any information shared with third parties will be sent securely.

Every effort will be made to keep personal details up to date. Data is securely stored and accessed on a “need to know” basis.  Disposal or archiving of data will depend on the type of data held. A list of retention periods is available on request.

Where a learner is over 13 and has mental capacity, their permission will be sought before sharing information with third parties, including parents/carers. Exceptions to this will be when there is a contractual obligation to share, when sharing is in the best interests of the learner or there is a lawful reason to do so. For example, in the case of Power of Attorney being in place. Where a learner is under the age of 13, permission will be sought from parents/carers or appointed persons.

Occasionally learner images may be used for display, marketing or publicity purposes. This will only be with the express permission of the learner or their appointed person and after an Image Permission form has been completed.

Individuals retain the right to access data we hold on them and to contact the Information Commissioners Office, should they feel that St. John’s has processed data unfairly or unlawfully.  St. John’s has a formal process to assist Subject Access Requests, which will require proof of identity, right to the information requested and it’s intended use.  Any such requests must be submitted to the Data Protection Officer at St. John’s.