Pupil and parent carer privacy notice

Updated September 2026 | Version 2.0 | England

This notice explains how we use personal information about pupils, parents, carers and emergency contacts, why we need it, who we share it with and the rights you have. You do not need to sign or consent to this privacy notice. Optional publicity choices are provided separately at the end.

Personalised for St Willibrord’s RC Primary School | 29 September 2026

Who is responsible for your information

School: St Willibrord’s RC Primary School. The data controller, which decides how and why personal information is used, is the Governing Body of St Willibrord’s RC Primary School (Voluntary Aided).

Controller contact: St Willibrord’s RC Primary School, Vale Street, Clayton, Manchester, M11 4WR; admin@st-willibrords.manchester.sch.uk; 0161 223 9345. Where another organisation controls particular records, we explain its role when relevant.

Our Data Protection Officer service is provided by Global Policing Limited.

Email: data@globalpolicing.co.uk.

Telephone: 0161 510 2999 (answerphone).

Website: www.globalpolicing.co.uk/data.

You may contact the school or the DPO about this notice or your rights.

We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025.

Information we collect and where it comes from

We collect information from you and your child, previous schools, local authorities, education and health professionals, and safeguarding agencies. We also create records during education and school activities. Information may include:

• Names, dates of birth, addresses, contact details, pupil identifiers, parental responsibility, emergency contacts and relevant family circumstances.

• Admissions, attendance and absence reasons, attainment, assessments, behaviour, exclusions, school transfers, trips and support provided.

• Special educational needs and disabilities, health and allergy information, care plans, safeguarding concerns and referrals; ethnicity, religion or other characteristics where relevant and lawful.

• Parent and carer communications, complaints, payment and funding eligibility information, including free school meal eligibility; photographs and system-use records where applicable.

Why we use information and our lawful bases

We use information to provide education, support learning and wellbeing, manage attendance and behaviour, protect children, communicate with families, administer services and funding, and meet reporting and record-keeping duties. We use the minimum information needed for each purpose.

Education and school administration

For a maintained school or academy, delivering education and associated pastoral and administrative functions normally relies on public task under Article 6(1)(e). Compliance with a specific statutory duty relies on legal obligation under Article 6(1)(c). These bases cover necessary processing rather than an unrestricted right to use information.

Applicable education duties may include the Education Act 1996 and the Education (Information About Individual Pupils) (England) Regulations 2013, as amended, for relevant pupil information returns. St Willibrord’s is a maintained voluntary-aided Roman Catholic primary school. Relevant duties include the Education Act 1996; the Education Act 2002, including section 175; the Education (Pupil Information) (England) Regulations 2005; the Education (Information About Individual Pupils) (England) Regulations 2013, as amended; the School Attendance (Pupil Registration) (England) Regulations 2024; and safeguarding duties including section 16LA of the Children Act 2004 from 30 September 2026. These statutory duties support the school’s education, safeguarding, attendance, assessment, funding and record-keeping functions.

Health safeguarding and other sensitive information

Health, ethnicity, religion and certain other information require an additional condition under Article 9. For necessary safeguarding we may use substantial public interest under Article 9(2)(g), with the applicable Data Protection Act 2018 Schedule 1 condition, including paragraph 18 for safeguarding children and individuals at risk where its requirements are met. Other statutory functions may use paragraph 6 where applicable. We maintain an appropriate policy document where required.

For statutory education and SEND functions involving special category data, we may rely on Article 9(2)(g) with an applicable Schedule 1 condition, including paragraph 6 for statutory and government purposes where its requirements are met. Equality monitoring may use Article 9(2)(g) with Schedule 1 paragraph 8 where applicable. Safeguarding processing uses Article 9(2)(g) with Schedule 1 Part 2 paragraph 18 where its requirements are met. Health information may also be processed under Article 9(2)(h) where the health or social care conditions and professional-confidentiality safeguards apply. Where required by law, we may share relevant information for safeguarding and promoting the welfare of children without consent. This includes information sharing under section 16LA of the Children Act 2004 where the statutory requirements for sharing are met. Criminal offence information is handled only where Article 10 and the applicable domestic-law authorisation permit it.

In a genuine emergency we may rely on vital interests under Article 6(1)(d). For special category information, Article 9(2)(c) also requires that the person is physically or legally incapable of consenting. Routine health support is not automatically treated as an emergency.

Optional uses and required information

We seek freely given, specific consent under Article 6(1)(a) for optional publicity uses where appropriate. Essential education, necessary safeguarding, lawful school transfers and statutory returns do not depend on signing the optional form. We identify our lawful basis before using information.

When requesting information we explain whether it is required by law, needed to provide a service or optional, and the consequences of not providing it. Missing essential details may prevent us from arranging a requested service or suitable support. Please tell the school when your details change.

Sharing protecting and retaining information

We share relevant information only where necessary and lawful. Depending on the purpose, recipients include receiving schools and colleges, our local authority and its commissioned services, the Department for Education (DfE), examination bodies, health professionals, safeguarding partners, social care, police or courts, and providers supporting school services. For St Willibrord’s, the local authority is Manchester City Council. Its Education Services privacy notice is available at Education Services Privacy Notice . Other recipients are used only where the relevant purpose and legal basis apply.

School suppliers may support management information, learning platforms, IT, communications, payments and trips. When acting as our processors, they must follow our documented instructions and contractual security obligations; individual parental permission is not automatically required for their necessary work. Other recipients may be independent controllers with their own privacy notices.

Supplier information: the School Office at admin@st-willibrords.manchester.sch.uk or the Data Protection Officer.

We share statutory pupil information with the DfE where the relevant duties apply. The DfE is responsible for its own processing and explains its uses and further sharing at Gov. This includes information about the National Pupil Database. Categories supplied where required include pupil identifiers and characteristics, school history, attendance and absence, SEND, free school meal and funding eligibility information, statutory assessment information and other fields required by the school census or other statutory returns.

Security and school technology

Access is limited to people who need information for their work. We use appropriate organisational and technical safeguards and verify identity and authority before releasing personal information. Medical care information is shared only with those who need it; optional publicity consent does not authorise unrestricted display of medical details.

School-managed internet access and school-managed devices are subject to filtering, monitoring and security logging for safeguarding, acceptable use, cyber security and technical support. Logs may include user or device identifiers, websites or services accessed, filtering alerts and security events. Access is restricted to authorised school staff and approved ICT/support providers and records are retained only for the operational, safeguarding or security period required. CCTV is used on selected areas of the school site for security and safeguarding; access is restricted to authorised staff and relevant support or law-enforcement personnel where lawful, and routine footage is overwritten after the system’s configured security period unless an incident requires preservation. The school does not use biometric identification systems. No AI workspace is currently approved to process personal data; any future use must be separately approved, risk assessed and covered by the school’s data protection controls.

International transfers: some approved cloud or service providers may store or access information outside the UK. Where a restricted international transfer occurs, the school uses a lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards including the UK International Data Transfer Agreement or UK Addendum where appropriate, and carries out the required transfer assessment. Current provider and transfer details can be obtained from the School Office or the Data Protection Officer.

How long we keep information

We apply different retention periods to different records. Our retention schedule is available at the School Office at admin@st-willibrords.manchester.sch.uk or the Data Protection Officer. It sets out the periods or criteria for pupil and parent records, safeguarding, attendance, finance, images and system logs. We consider legal duties, safeguarding needs, transfers and the time reasonably needed to handle complaints or legal claims. Records subject to a lawful preservation requirement are retained until it ends.

Primary pupil records normally transfer to the next school; secondary pupil records are generally retained to the pupil’s 25th birthday. Safeguarding records may need longer retention, including child sexual abuse records under current guidance. There is no blanket promise to erase all information at age 25 or all parent information when a child leaves. We securely destroy or anonymise records when no longer needed.

Your rights and how to contact us

You can ask for access to your personal information and correction of inaccurate or incomplete information. Depending on the lawful basis and circumstances, you may also ask for erasure, restriction of use or a portable copy, or object to processing. These rights have conditions and exceptions; for example, we may need to retain records to meet a legal duty.

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier use. Where we rely on public task or legitimate interests, you may object on grounds relating to your circumstances. You can object to direct marketing at any time.

Contact the school or our DPO to exercise your rights. Requests can be made verbally or in writing and do not have to use a particular form. We may need proportionate evidence of identity or authority to protect your information. We normally respond to a subject access request within one calendar month. Where the law allows clarification, an extension or an exemption, we will explain how this affects your request. School holidays do not automatically extend the deadline.

Personal information rights belong to the child as well as to parents in relation to their own information. A parent may act for a child where the child is not competent to act for themselves, or with the competent child’s authority. We consider the child’s understanding, wishes and interests before disclosing their information.

A parent’s separate right to request an educational record depends on the school type and applicable education regulations. Where this statutory right applies, the response period is 15 school days. This is different from a UK GDPR subject access request.

Automated decisions

The school does not currently use solely automated decision-making that produces legal or similarly significant effects for pupils, parents or carers. Significant decisions about education, safeguarding, attendance, behaviour, SEND, support and access to services involve human judgement and review. If this changes, we will update this notice and explain the safeguards that apply.

Questions and complaints

If you are concerned about our use of personal information, contact the school or Global Policing Limited using the details on the first page. Our data protection complaints procedure is available at the School Office at contact@st-willibrords.manchester.sch.uk or admin@st-willibrords.manchester.sch.uk; it is also set out in the school’s Data Protection Policy. We will acknowledge a data protection complaint within 30 days, investigate appropriately, keep you informed and provide an outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO). Visit Make a complaint or call 0303 123 1113. The ICO normally expects you to give the organisation an opportunity to address your concern first.

Keeping this notice up to date

We review this notice regularly and when our use of information changes. We will bring material changes to your attention. Current notice:Current privacy notice . Next scheduled review: September 2027, or sooner if needed. Ask the school for an accessible format or help understanding this notice.

Optional photographs and publicity consent

School: St Willibrord’s RC Primary School. This form records optional choices only. Refusing or withdrawing consent will not affect your child’s education or access to school services.

Pupil name: __________________________________   Class: ______________

Parent or carer name: _____________________________________________

Relationship to pupil: ______________________________________________

Select Yes or No for each purpose. Leaving a choice blank means no consent for that purpose. Photographs may include video images. We will seek a separate choice for any materially different use. This form does not authorise facial recognition or biometric identification.

Use images in optional celebration displays inside the school, without a name.    Yes ☐   No ☐

Add my child’s first name to those internal celebration displays.    Yes ☐   No ☐

Publish images on the school’s public website, without a name.    Yes ☐   No ☐

Add my child’s first name to those website images.    Yes ☐   No ☐

Publish images on the school’s official Facebook page (St Willibrord’s RC Primary School – https://www.facebook.com/StWillibrordsRC), without a name.    Yes ☐   No ☐

Add my child’s first name to those Facebook images.    Yes ☐   No ☐

Use images in printed school prospectuses or publicity leaflets, without a name.    Yes ☐   No ☐

Period covered: from the date signed until the pupil leaves St Willibrord’s RC Primary School or consent is withdrawn, whichever is earlier. Website and Facebook images will be reviewed when consent ends; existing printed stock may remain until exhausted. We will ask separately before providing identifiable images or names to newspapers or other external publishers.

Public images can be viewed, copied or shared by others, including outside the UK. We control our own publications but cannot guarantee removal of copies made by others. To withdraw or change a choice, contact admin@st-willibrords.manchester.sch.uk or 0161 223 9345. We will stop future consent-based use and remove images from channels we control where reasonably possible; already distributed printed material may not be recoverable.

I confirm that I have parental responsibility or appropriate authority to make these choices. The school will take account of the child’s views and ability to understand and make their own decisions. Permission to publish a name applies only where permission for the associated image has also been given.

Signature: __________________________________   Date: ______________

We retain evidence of your choices and any withdrawal in accordance with our retention schedule, for as long as necessary to manage and demonstrate those choices.

Data Protection Policy