Privacy Notice

Download: Privacy Notice Download: Appendix to Privacy Notice (Covid-19)

Identity and contact details

Our postal address is:
Penyrheol Comprehensive School,
Pontarddulais Road,

Our website address is:

Issues of how data is handled are dealt with by the Headteacher or the school’s Data Protection Officer.

As a public authority, we must comply with all relevant legislation relating to data handling. The Information Commissioner’s Office (ICO) is the supervisory authority in the United Kingdom established to ensure that your data rights are upheld.

Categories of personal data we hold and process

Obtaining, recording, holding and dealing with personal information is known as ‘processing’.
As a school the vast majority of information we collect is about our pupils but we do also hold key information needed about parents / guardians and staff members.

Generally a school file may include:-

  • Attendance data
  • Academic achievements and progress
  • Information about behaviour
  • Ethnicity
  • Wellbeing and pertinent health information (medication, allergies and illnesses)
  • Free School Meal eligibility
  • Contact details of parents and guardians
  • Minutes of meetings relating to the child
  • Any statement of Special Educational Need and reviews of the same
  • Information about other additional learning needs
  • Reports and referrals to and from other agencies if applicable e.g. Youth Offending Service and Social Services.

The school as an employer will also hold a personnel file for all staff and this file will generally consist of:-

  • Contact details
  • Bank details, National Insurance Number for payroll purposes
  • Details of any references or DBS checks where applicable
  • Details of driving licence and vehicle MOT / Insurance
  • Details of any disciplinary action
  • Information regarding sickness and annual leave

How the School collects and uses personal data

The School has a responsibility to provide its pupils with a good education in a safe environment.

It is necessary to collect personal data to enable the school to provide pupils with an education, to track and monitor academic progress and to ensure those with parental responsibility are kept informed of key milestones and achievements.

Some of the information will be provided to us by parents / guardians and some will be generated by us whilst the pupil is in our school.

Here are some examples of how we collect and use your data:

Providing an education:

We generate and then hold the reports of a pupil’s progress and any examination results. We generate and keep attendance data which can be analysed to ensure that children are attending school regularly and attending on time. The school will on occasion utilise educational apps and websites with pupils, all of which will be undertaken under the supervision of a staff member.

Maintaining school discipline and awarding positive behaviour:

As part of the school file we will create a behaviour record that includes all significant incidents of breaches of the school discipline policy. This would include any fixed term or permanent exclusions. The school file will also include examples of excellence and achievements.

Keeping learners safe and improving wellbeing:

There may be occasions when the school will collect documentation regarding the wellbeing of pupils. It is a legal requirement for all schools to develop and have in place systems for safeguarding and promoting the wellbeing of children in their care. This may involve documenting concerns and receiving information from other agencies such as Social Services when they have a worry about a pupil. Monitoring wellbeing allows the school to ensure the best possible services and support are available to the pupils and their families.

This school also operates CCTV cameras within its grounds. The purpose of these cameras are to maintain school discipline and to keep learners safe.

Keeping parents updated and involved in the school:

We do collect contact details of parents and guardians to ensure that we are able to keep you informed of school events and activities and can contact you quickly in the event of an emergency.

It is important that parents / guardians inform the school as soon as possible of any changes that occur to their contact details.

To enable efficient administration and reduce the need for children to be carrying money:

We have adopted a biometric fingerprint system for school meal purchases which parents and pupils can take advantage of. The system uses thumbprints to create a unique identifier for each pupil. This identifier is only stored on our system while the pupil is at Penyrheol and is destroyed as soon as they leave. It is never shared with anybody else.

The key benefits of using this system are that it is quicker and safer than handling money and so reduces queuing time. It also means that pupils eligible to receive Free School Meals can receive this benefit very simply.


When individuals apply to work for the school, we will only use the information they supply to process their application and to monitor equal opportunities statistics.

Personal information about unsuccessful candidates will be held for six months after the recruitment process has been completed and will then be destroyed securely.

Once a person has taken up employment with the school we compile a personnel file relating to their employment. The information contained in this is kept secure and will only be used for purposes directly relevant to that employment.

The Source of Personal Data

The vast majority of personal data we hold will have been generated in the course of a pupil attending the school or will have been provided to us directly from you. There are occasions where personal data is collected about you in other ways.

This includes:

  • When partner agencies share information with us to provide a joined-up service to you.
  • When you move into our local authority area, data may be shared from the previous school or local authority area.

People We Share Data With


Service Provision:

We may share data with others to enable a requested or statutory service to be provided. This could be where we use another agency to deliver the service for us or where we collaborate with other agencies.

An example would be that information would be shared with the Local Authority to enable an assessment of a child’s additional learning needs. Another example would be the supply of information at your request to contribute to a Child and Adolescent Mental Health assessment.

Transfer of information to another school / local authority:

Personal information about you may also be provided to other local authorities or schools.

An example would be where you have moved from one area to another or start at a new school. The school file will be securely transferred to the new Local Authority / school.

Health Information

In some circumstances we may share information with NHS professionals providing services to our school children. This would be for services such as vaccinations, dental provision and school nursing activities.

We may collect health information on staff members when such information is supplied as part of the sickness policy and / or following referrals to occupational health.

Transfer of information required by law:

We also share personal information where we are required to do so by law. Examples include where we are required by law to report matters to Welsh Government who then in turn publish a lot of the data they receive:

Another example would be our duties to share information with Social Services when they are carrying out their protective functions or the police when carrying out investigations.

How long we keep your data

Data is held for no longer than is necessary and the school follows legal guidelines on how long information should be kept before it is securely destroyed.

The timeframe for holding data is different depending on the type of data involved.

To see our full retention schedule please visit our website where the retention schedule is included in our Data Protection Policy.

Transfers outside the European Economic Area

We do not share personal information beyond the European Economic Area (EEA) except if a pupil moves to a school outside of the EEA. This is quite rare but does occur, particularly with children of British Forces personnel. In this circumstance the school file will be securely transmitted to the new school / authority as appropriate.

Your Data Rights

In so far as is compatible with legal requirements you have a number of rights in respect of your data:

  1. Right to be informed: We must be completely transparent with you by providing information ‘in a concise, transparent, intelligible and easily accessible form, using clear and plain language’. Our privacy notice is one of the ways we try and let you know how data is handled.
  2. Right of access: You have the right to access your personal information. Parents also have the right to access the educational record of their child.
  3. Right to rectification: You have the right without undue delay to request the rectification or updating of inaccurate personal data.
  4. Right to restrict processing: You can ask for there to be a restriction of processing, such as where the accuracy of the personal data is contested. This means that we may only store the personal data and not further process it except in limited circumstances.
  5. Right to object: You can object to certain types of processing such as direct marketing. The right to object also applies to other types of processing, such as processing for scientific, historical research or statistical purposes (although processing may still be carried out for reasons of public interest).
  6. Rights on automated decision making and profiling: The law provides safeguards for you against the risk that a potentially damaging decision is taken without human intervention. The right does not apply in certain circumstances, such as where you give your explicit consent.
  7. Right to data portability: where personal data is processed on the basis of consent and by automated means, you have the right to have your personal data transmitted directly from one data controller to another where this is technically possible.
  8. Right to erasure or ‘right to be forgotten’: you can request the erasure of personal data including when: (i) the personal data is no longer necessary in relation to the purposes for which they were collected (ii) you no longer provide your consent, or (iii) you object to the processing.

The Information Commissioner regulates data handling by organisations in the U.K. and works to uphold the data rights of citizens. The Information Commissioner’s Office website provides more information on the rights available to you:

Withdrawing Consent

If you consented to providing your personal information to us and you have changed your mind and you no longer want the school to hold and process your information, please let us know.

If you encounter any difficulties in withdrawing consent, please contact the school’s Data Protection Officer or the Headteacher.

Automated Decision Making and Profiling

The school does not carry out automated decision-making, and as such any decision taken by us which affects you will always include human intervention.

We do on occasion carry out profiling and track the progress of pupils to enable us as a school to target services to those who are in need of help and support.

The Right to Complain About Data Handling

The school sets very high standards for the collection and appropriate use of personal data. We therefore take any complaints about data handling very seriously. We encourage you to bring to our attention where the use of data is unfair, misleading or inappropriate and we also welcome suggestions for improvement.

Informal Resolution:

In the first instance we would ask that you try and resolve data handling issues directly with the Data Protection Officer, Headteacher or any member of the senior leadership team.

We are committed to handling data appropriately and are confident that we can resolve most issues informally.

Formal Resolution:

You can ask for your issue to be investigated by following the school’s normal Complaints Procedure, which is published on our website.

If you remain dissatisfied following the response to your contact with the school, if it relates to issues of data handling, you can raise the issue with the Information Commissioner. It is free of charge to contact the Information Commissioner and request their assistance.

Information Commissioner’s Office – Wales
2nd Floor, Churchill House
Churchill Way
CF10 2HH
Telephone: 029 2067 8400
Fax: 029 2067 8399

Appendix to Privacy Notice (Covid-19)

Collecting attendance and personal characteristics data from schools from September 2020

We collect a wide range of data about pupils on an annual basis, and this is explained in more detail in our privacy notice. Some of this data is passed on to the Welsh Government where required.
Due to the Covid-19 pandemic and schools having to adapt to new ways of working, the Welsh Government (WG) needs to be able to collect attendance data more frequently than once a year. Collecting up to date information will support the WG and provide the evidence we need to understand the impact of the Covid-19 pandemic on attendance and how the WG can support schools.

How frequently will the WG collect this data?

The WG will keep the frequency of collection under regular review. Initially the data will be collected every week but they may need to collect the data more regularly.

For which pupils are WG collecting data?

WG are collecting data for every pupil in a maintained school as at September 2020.

What information are WG collecting?

WG are collecting the following information about pupils every week:

  • UPN
  • Forename
  • Middle name(s)
  • Surname
  • Gender
  • DOB
  • Home postcode
  • Ethnic background
  • Eligibility for free school meals
  • Additional learning needs
  • English as an additional language
  • Attendance code for each half day session in that week

Why are WG collecting this information?

This information is needed as a key part of WG’s response and planning during the ongoing Covid-19 pandemic. The data will be collected every week to ensure that the latest data is available to inform their response. The data will be used for statistical and research purposes only and no decisions will be made about pupils using this data.

How will WG use this information?

WG will use the data in the same ways that the school has listed in its main privacy notice:

Will WG be sharing the data?

WG may share this information with those organisations listed in the school’s main privacy notice:

How long will WG keep the information about pupils?

WG will keep the data that identifies pupils until they are 25 years old.

What is the legal basis for collecting this data?

Section 538 of the Education Act 1996 provides the legal basis for collecting this data. This requires schools to make such reports and returns, and give such information, to Welsh Ministers as they may require for their functions in relation to education.

Your rights under the GDPR

Your rights are explained in full in the main privacy notice: