RAMSEY GRAMMAR SCHOOL

DELIVERING EXCELLENCE FOR ALL

Fair Processing Notice

The Headteacher in the name of Ramsey Grammar School as Data controller

The Headteacher, in the name of Ramsey Grammar School, is a data controller for the purposes of the Data Protection Act 2002/General Data Protection Regulation (Isle of Man) Order 2018. The contact details for the Data Controller are Ramsey Grammar School of Lezayre Road, Ramsey, Isle of Man IM8 2RG.

In addition to the information set out in the Isle of Man Privacy Notice, we may also collect the following information about your child as required by the Education Act 2001 and the Registration of Pupils Regulations 2016:

  1. full legal name and where known, any former name or names;
  2. gender;
  3. date of birth;
  4. unique pupil number;
  5. ethnic group and by whom that information was provided;
  6. first language;
  7. date of admission to the school;
  8. year group;
  9. the address and postcode of the pupil's usual residence and any other properties at which the pupil is also known to reside on occasion;
  10. the name and address of every person known to the school to be a parent of the pupil and at least one emergency contact telephone number;
  11. the name and address of any other schools the pupil is known to have attended, if any, and in the case of guest registration, any other schools at which the pupil is registered;
  12. full-time or part-time;
  13. day pupil or boarder;
  14. date of leaving the school;
  15. usual mode of transport to and from school;
  16. for any pupil who is known to the head teacher to be or to have been looked after by an appropriate organisation, the name of that organisation;
  17. (where applicable) that the pupil has been found eligible for free school meals;
  18. Attendance;
  19. Medical information for the vital interests of children where appropriate;
  20. Educational psychologists reports and supporting documents;
  21. Academic achievements;
  22. Skills and abilities;
  23. Educational progress;
  24. Special educational needs information;
  25. Suspension information;
  26. Course information;

The Data Protection Officer for the Department of Education, Sport and Culture is: Andrew Shipley, Department of Education, Sport and Culture, Hamilton House, Douglas. IM1 5EZ. Tel 01624 685828. Email: DPO-DESC@gov.im.

How we will use the information we collect about you

Ramsey Grammar School may use your information to:

  • register your child at the school;
  • record attendance information;
  • produce an educational record containing:
    • Information about your child
    • Personal education plans
    • Educational psychologist's reports and accompanying documents
  • produce a curricular record containing:
    • Academic achievements;
    • Skills and abilities; and
    • Educational progress
  • produce a record of special educational needs and special needs provision, if appropriate detailing:
    • The type of special need;
    • A ranking of the special needs if there is more than one;
    • The special needs provision being made; and
    • Whether teaching is in a special education needs unit or elsewhere
  • record details of suspensions
  • produce a record of the studies undertaken;
  • help prevent and detect crime

Ramsey Grammar School has a statutory obligation to check and verify the data you provide to us on registration documents and on consent forms. This may include checks of publicly available information but in some cases, where it is necessary and relevant, the information you provide may be disclosed or shared with other organisations.

How we will share the information we collect about you

App or Service Details Consent Required

DESC Attendance

Data Shared: Name, School, Attendance data if less than 80%

Sharing Basis: Public interest + official authority of the DC

Security Protocols: Secure access or information sent by email password protected

Server/Data Location: EEA

Retention Period: As needed while resolving issues


No

DHSC Dental Survey

more information

Data Shared: Child’s name, date of birth

Security Protocols: Information sent password protected with the password sent via an alternative means of communication

Server/Data Location: EEA

Retention Period: Current year


Yes

DHSC School / Community Nurses

more information

Data Shared: Child's name, date of birth, current address, previous address, current school and previous school

Security Protocols: Information sent password protected with the password sent via an alternative means of communication

Server/Data Location: EEA

Retention Period: Current year


Yes

employed.im

more information

Data Shared: Name, email, password. Information data subject supplies.

Sharing Basis: Public interest + official authority of the DC

Access Conditions: Supervised and unsupervised

Teacher Access: Limited access to enable placements

Server/Data Location: IOM

Retention Period: For as long as data subjects wish to use the services


No

Everlearning

more information

Data Shared: Forename and surname, including title (compulsory)
Email address (compulsory)

Security Protocols:
All personal data stored in one location only in fully encrypted format. Personal data only accessible by trained personnel at theeverlearner.com (see training policy). All hard copies of personal data destroyed after use. Personal data of children deleted in accordance with their deletion policy. All registrants declare age at signup.
All registrants less than 14 years must forward registration process to parent/guardian as set out in sign up process.
No data is collected until parent/guardian consents. Messenger service only available between student and teacher and tutor.
Messenger service unavailable between students or between students and teachers registered with another school.

Access Conditions: Supervised and unsupervised

Teacher Access: Yes

Server/Data Location: The EverLearner Ltd holds this data solely in the database of theeverlearner.com which is physically housed on two OVH SP-64 servers in London UK. Detailed information on the servers can be found at https://www.ovh.co.uk/

Retention Period:
The EverLearner Ltd has a robust and automated policy to achieve this:
All users on theeverlearner.com have the right and capability to permanently delete their personal data from the database at any time.
The EverLearner Ltd automatically deletes all personal data for a user when the user becomes “inactive”.
Inactivity is defined as time since last login.
The EverLearner Ltd guarantees to permanently delete personal data exactly 730 days after last activity unless the point that follows happens sooner.
School administrators and Heads of department can archive but cannot delete user data. User data is permanently deleted by The EverLearner Ltd exactly 365 days of archive.
Deletion is permanent and complete. After deletion, The EverLearner Ltd retains no personal data for the user.


Yes

Evolve

more information

Data Shared: Name, contact details, trip information and risk assessments

Sharing Basis: Public interest + official authority of the DC

Security Protocols:
Advanced firewalls, enterprise-level virus protection on all servers, HTTPS encryption for all communication between our servers and users, regular data backup, username/password/PIN to control access, failed log-in attempt logging, automatic suspicious activity detection and logging

Server/Data Location: UK

Retention Period: Current year + 6 years


No

Google

Data Shared: No personal information should be stored on Google servers by staff apart from a name, class grouping, email address and information regarding work completed or to be completed

Sharing Basis: Public interest + official authority of the DC

Security Protocols: Google adheres to several self regulatory frameworks, including the EU-US Privacy Shield arrangement.

Access Conditions: No

Teacher Access: Limited to areas set up by staff such as Google Classrooms and shared areas

Server/Data Location: Worldwide including the US

Retention Period: DOB + 21 years or 3 years since the last log on


No

Guild

Data Shared: Name, DOB. School information

Retention Period: Public information


Yes

ItsLearning

Data Shared: Name, class, school work

Sharing Basis: Public interest + official authority of the DC

Security Protocols: Username and password

Access Conditions: No

Teacher Access: Yes

Server/Data Location: EEA

Retention Period: End of Use + 12 months


No

Junior Achievement

more information

Data Shared: Name. class, year group

Security Protocols:
Hold your information securely to maintain safety of your personal information. Your information whether public or private will never be sold, exchanged, transferred, or given to another company for any reason whatsoever, other than for the purpose of delivering purchased products or vetting of volunteers

Retention Period: Until after event


Yes

Kahoot

Data Shared: Name, Email address, user name, google analytics identifiers

Security Protocols: Reasonable organizational, technical and administrative measures

Access Conditions: Supervised

Teacher Access: Yes

Server/Data Location: Worldwide

Retention Period: End of use + 12 months


Yes

Language link / Speech

more information

Data Shared: Name, DOB. email & telephone number of school

Security Protocols: Encryption, access restriction and physical security

Teacher Access: Yes

Server/Data Location: EEA

Retention Period: 3 years


No

Lucid - GL Assessment

more information

Data Shared:
Internet protocol (IP) address used to connect your computer to the Internet, login, e-mail address, password, computer and platform. Student information including gender and age. Student information including observations about students’ performance in tests, the
environment during tests and any other relevant information, for example, any illness
of a student prior to or during the testing. Student information including ethnic and socio-economic information.

Security Protocols: The GL Education Group complies fully with the ISO/IEC 270013 (3
ISO/IEC 27001 Certificate Number GB18430)
international standard
regarding data security management, the highest standard in industry specifically for data
security

Server/Data Location: UK and EEA

Retention Period: DOB + 25 years


Yes

MyMaths

more information

Data Shared: Name, email address

Security Protocols: Appropriate and suitable safeguards and technical measures are in place to protect your personal data

Access Conditions: Supervised

Teacher Access: Yes

Server/Data Location: Worldwide

Retention Period: End of use + 12 months


Yes

Padlet

Data Shared: Anonymous

Security Protocols: Account information is protected by a password for privacy and security — teacher info.

Access Conditions: Supervised

Teacher Access: Yes

Server/Data Location: US

Retention Period: At end of session


Yes

Quesmedia Sites

more information

Data Shared: Website activity, website form submissions and user content.

Sharing Basis: To provide public website services for our school

Security Protocols:
Sites are served over HTTPS using TLS to provide both secure server–server and server–client communication. Accounts are protected from brute force attacks with rate limiting and automated account locking. Passwords are one-way encrypted using bcrypt before being stored and are required to satisfy strong password rules to ensure high-entropy.

Access Conditions: None

Teacher Access: Limited to data provided within the CMS

Server/Data Location: United Kingdom (EEA)

Retention Period: Please view the more information link for data retention policies.


No

Ramsey Commissioners Daffodil competition

Data Shared: Name, school, class

Security Protocols: Email to Commissioners

Retention Period: Winners info published in press


Yes

RIDDOR

more information

Data Shared: Name, age,gender, school, address, phone number, injury

Server/Data Location: IOM

Retention Period: DOB +25 years


No

Rotary Club

Data Shared: Name, class, year group.

Security Protocols: Email to Rotary Club

Retention Period: After being used


Yes

SIMS

Data Shared: Pupil record

Sharing Basis: Public interest + official authority of the DC

Security Protocols: Secure servers hosted within Government data centre. Secure connections from within approved areas of Government. Teachers access via secure VPN from approved device only.

Server/Data Location: EEA

Retention Period: DOB + 25 years


No

Socrative

Data Shared: First name and Class

Security Protocols: We protect your login information and the transmission of data using Secure Socket Layer (SSL) technology.

Access Conditions: Supervised

Teacher Access: Yes

Server/Data Location: USA

Retention Period: Until Childs Leaves school


Yes

Sumdog

more information

Data Shared: child's name, date of birth, school, class and year group.  Educational progress data. Analytics data. Teacher contact info

Security Protocols:
Information is encrypted using SSL.  Therefore, transfers of information from the European Union to the USA are done in such a way as to ensure an adequate level of protection such as by using the EU-US privacy shield or another appropriate safeguard, such as the model contract clauses approved by the European Commission
Password protection of accounts. Sumdog assert that they put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, they say they limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

Teacher Access: Yes

Server/Data Location: US

Retention Period: Upon leaving school


Yes

Twitter

more information

Data Shared: Photos, names, achievements, event details, location, IP address

Server/Data Location: Worldwide

Retention Period: Public


Yes

Venture Centre

more information

Data Shared: Name, age, DOB, gender, address, medical info

Server/Data Location: Paper copy

Retention Period: Shredded after visit


Yes

Youtube

more information

Data Shared: Image or voice, Name

Access Conditions: Supervised and unsupervised

Server/Data Location: Worldwide


Yes

For more specific details about retention periods see the Department’s retention schedule

Information obtained or disclosed by third parties will not be used for any other purpose other than supporting the delivery of teaching and learning.

Failure to provide information may impact on support in school, the quality of teaching and learning and in achievement in examinations.

Protecting your information

Ramsey Grammar School will:

  • keep your information safe and secure in compliance;
  • only use and disclose your information as detailed above where necessary
  • Retain the information for no longer than is necessary and your information wll be permanently deleted once the timeframes set out below have been reached (there will need to be an authorisation process, to dispose of this in line with our Records Management Policy and retention periods as outlined below (unless there is an over-riding reason to retain this information).

Transfer of Information outside the EEA

Apps and services that are used in school may require data to be stored on servers outside of the EEA. Information sent to these will be limited and are as detailed above.

More Information

You can find out more information including:

  • Looking at the Isle of Man Government Privacy Policy here https://www.gov.im/about-this-site/privacy-notice/ [Accessed 16/1/18]
  • Contacting our Data Protection Officer who is: Andrew Shipley, DPO. Hamilton House, Peel Road. Douglas. IM1 5EZ. Tel 685828. Email DPO-DESC@gov.im
  • Asking to see your information or making a complaint if you feel that your information is not being handled by contacting the Headteacher as Data Controller for Ramsey Grammar School
  • Making a subject access request which is a request for all of the personal data we hold about you.
  • Obtaining this information in large print, braille, or in an alternative language.

Your rights

You have a right to access your personal data to ensure that it is accurate, and to request that it is rectified, blocked, erased or destroyed if it is inaccurate.

To make any request relating to your data held by us, please contact the Data Protection Officer for the Department of Education, Sport and Culture who is: Andrew Shipley, DPO. Hamilton House, Peel Road. Douglas. IM1 5EZ. Tel 685828. Email DPO-DESC@gov.im

If you are not satisfied with the response you receive, you may also complain to the Information Commissioner, whose details can be found on www.inforights.im, or the relevant supervisory authority. You may have a right to other remedies.