Privacy Notice

How we use your personal information:

This Privacy Notice provides information about the collection and processing of personal information by Ysgol Gymunedol Bancffosfelen.

Ysgol Gymunedol Bancffosfelen is the Data Controller for the use of personal data in this privacy notice.

Our address and contact details are as follows:

Ysgol Gymunedol Bancffosfelen

Bancffosfelen, Llanelli, Carmarthenshire, SA15 5DR

01269 870272

admin@bancffosfelen.ysgolccc.cymru

Our school collects information about pupils and their parents or legal guardians when they enrol at the school. Our school will also collect information at other key times during the school year as and when it is required or necessary to do so.

When a pupil joins our school from another school their personal information will be provided to us. Should a pupil leave our school or transfer to another secondary school, we will transfer the pupil’s personal information and that of any parents or legal guardians, to the new school.

Any personal or sensitive information you share with us will be used to provide your child with education services and any statutory duties the school is required to fulfil.

For Data Protection purposes, the processing of your personal data is necessary for the performance of a task carried out in the public interest, in the exercise of official authority vested in our school, vital interests of your child or a third party in emergency situations and the child’s or parent’s consent for photographs or images to be used in social media or our prospectus. Further details on this can be found below.

The categories of pupil information that we process include personal identifiers such as a name, unique pupil number, contact details and address as well as the following:

  • characteristics (such as ethnicity, biometric-data, language, and free school meal eligibility)
  • safeguarding information (such as court orders and professional involvement)
  • special educational needs (including the primary and additional needs)
  • medical and administration (such as doctors information, school nurse, child health, dental health, allergies, medication and dietary requirements)
  • attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
  • assessment and attainment (such as end key stage results and literacy/numeracy tests, post 16 courses enrolled for and any relevant results)
  • behavioural information (such as exclusions and any relevant alternative provision put in place)
  • Contact information for school trips/excursions (parent contact details, emergency contacts, passport details, health/medical information)

Why we collect and use personal information:

The personal data collected is essential, for the school to fulfil their official functions and meet legal requirements.

We collect and use pupil information, for the following purposes:

  • to support pupil learning 
  • to monitor and report on pupil attainment progress
  • to identify if your child is at risk from disengaging from their education 
  • to provide appropriate pastoral care 
  • to assess the quality of our services
  • to keep children safe (food allergies, or emergency contact details) 
  • to meet the statutory duties placed upon us for Welsh Government data collections

Under the General Data Protection Regulation (GDPR) and Data Protection Act 2018, the lawful bases under Article 6 which we rely on for processing pupil information are:

  • Because you have given your consent for us to do so. This would apply in instances such as taking photographs, using your voice in a video or school film or in our prospectus. We will ask always you for consent and you have the right to withdraw it at any time.
  • Because we have a legal obligation to process your personal data. This would apply for example if a court instructed us to provide your personal data.
  • Processing is necessary to protect your vital interests or another person. This would happen were there to be an emergency or urgent medical incident.
  • Because it is necessary for the performance of this public task to do so. This applies to the majority of the processing we do with your personal data and is because we have a statutory obligation to do so under the following legislation and Welsh Government Frameworks:
    • Local Government Act 2000 (Section 2)
    • The Government of Wales Act 2006 (Section 60)
    • Learning & Skills Act 2000 (Sections 33, 40, 138 & 140)
    • Education Act 2004 (Section 25)
    • SEN Code of Practice for Wales
    • Employment and Training Act 1973 (Sections 8, 9 & 10)
    • The Education (Information about Individual Pupils (Wales) Regulations 2007
    • Frameworks such as Youth Engagement and Progression Framework
  • Necessary for the purposes of legitimate interests to do so. This would apply in instances where we have not relied on any of the above but on balance it is in someone’s interest to process their personal data.

In addition to the above, we must have an additional lawful basis if we process any special category data.

Some types of personal data are more sensitive than others, and need more protection. This is classed as ‘special category data’ and could include information about your racial or ethnic origin, political opinions, religious or philosophical beliefs and the processing of genetic or biometric data, health, sexual orientation and related matters.

Under the General Data Protection Regulation (GDPR) and Data Protection Act 2018, the lawful bases under Article 9 which we rely on for processing pupil information are:

  • Because you have given your explicit consent to do so
  • Because it is necessary for us to carry out our specific obligations as data controller to do so
  • Because it is necessary to protect your or someone else’s vital interests to do so. This would happen in cases where you are physically or legally incapable of giving consent;
  • Because it is data you have already placed in the public domain yourself
  • Because it relates to a legal claim to do so, for example this would happen where a court has instructed us to do so
  • Because it is in the public interest to do so under the following legislation and Welsh Government Frameworks (as listed above).
  • Because it is necessary for archiving purposes in public interest, scientific or historical research or statistical purposes to do so.

How we collect personal information:

We collect pupil and personal information via:

  • Registration forms at the start of the school year
  • Common Transfer Files (CTF) or secure file transfer from previous school
  • Documents specific to school trips / activities

Pupil data is essential for the schools’ operational use. Whilst the majority of pupil and personal information you provide to us is mandatory, some of it requested on a voluntary basis. In order to comply with the data protection legislation, we will inform you at the point of collection, whether you are required to provide certain personal information to us or if you have a choice in this and we would need consent.

How we store pupil data:

We hold pupil data securely for the set amount of time shown in our data retention schedule. For more information on our data retention schedule and how we keep your data safe, please refer to:

Education Records, School Reports and the Common Transfer System – the keeping, disposal, disclosure and transfer of pupil information. National Assembly for Wales Circular No: 18/2006 (https://gov.wales/sites/default/files/publications/2018-03/educational-records-school-reports-and-the-common-transfer-system-the-keeping-disposal-disclosure-and-transfer-of-pupil-information.pdf)

The school stores its data securely and adheres to principles outlined in the following policies:

  • Data Protection Policy
  • IT Security Policy (delete as applicable)
  • CCTV Policy (delete as applicable)
  • Retention Schedule (delete as applicable)

Further information can be obtained from the school.

Who & why we share pupil information  

We routinely share pupil and personal information with:

  • Schools that the pupils attend after leaving us
  • Our Local Authority and Health Board
  • School Nursing Service
  • Youth support services
  • Welsh Government
  • Colleges of Further Education and Work Based Trainers after pupils leave us
  • Examination Bodies
  • Careers Wales
  • The Learning Record Service for learners age 14 years and over (to generate a Unique Learner Number (ULN) and a Personal Learning Record. Further details of how your information is processed and shared can be found at http://www.learningrecordsservice.org.uk/learnparent/.

Welsh Government

Welsh Government collects personal data from educational settings and local authorities via various statutory data collections. The School has a legal duty to share certain information about pupils with the Welsh Assembly Government as part of what is called the Pupil Level Annual Schools Census (PLASC). We lawfully share this data under Sections 29, 537A and 538 of the Education Act (1996). Further Information is available at: https://gov.wales/pupil-level-annual-school-census-plasc

All data is transferred securely and held by Welsh Government under a combination of software and hardware controls, which meet the current government security policy framework. 

Requesting access to your personal data & your rights

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact:

  1. The School
  2. The School’s Data Protection Officer – schooldpo@carmarthenshire.gov.uk

You also have the right to:

  • be informed about how we use your personal data and who it is shared with
  • access your information (see above section)
  • object to processing of personal data that is likely to cause, or is causing, damage or distress
  • prevent processing for the purpose of direct marketing
  • object to decisions being taken by automated means
  • in certain circumstances, have inaccurate personal data rectified, restricted or erased. This is only in certain circumstances.

Complaints or Queries

Ysgol Gymunedol Bancffosfelen endeavours to meet the highest standards when collecting and using personal information.  For this reason, we take any complaints we receive about this seriously. We encourage anyone to bring to our attention if they believe that our collection or use of their information is unfair, misleading or inappropriate. 

This privacy notice does not provide exhaustive detail of all aspects of our collection and use of personal information. However, we are happy to provide any additional information or explanation if needed. Any requests for this should be sent to the DPO at the address above:

If you wish to make a complaint about the way we have used or processed your personal information, you can contact the Information Commissioner’s Office as the statutory body which oversees data protection law, their contact details are provided below for you.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Email: casework@ico.org.uk             Telephone No: 0303 123 1113

We will keep this privacy notice under review.