DaTA Protection & Privacy policy
This Data Protection Policy serves as a comprehensive framework for our company to ensure that all personal data handled within the business environment is managed in a manner that complies with all relevant data protection laws.
We are committed to fostering a culture of data protection and privacy, recognising the importance of safeguarding personal information. This policy outlines our approach to collecting, processing, storing, and sharing data, ensuring that rights and freedoms are respected.
· Key Objectives of the Policy:
- Transparency: We aim to communicate clearly how and why personal data is collected and used, ensuring that individuals are informed and can exercise their rights.
- Data Integrity and Security: We implement robust security measures to protect personal information from unauthorised access, loss, or misuse.
- Compliance: We adhere to all legal and regulatory requirements related to data protection, including conducting regular audits and training staff on best practices.
- Rights of Individuals: We empower individuals to understand their rights regarding their personal data, including the right to access, rectify, and delete their information upon request.
This policy is an essential element of our commitment to creating a safe and secure business environment. It is reviewed annually or as needed to accommodate changes in legislation.
This policy meets our obligations under the UK General Data Protection Regulation (UK GDPR) – the EU GDPR was incorporated into UK legislation, with some amendments, by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020
Data Protection Act 2018 (DPA 2018). It is based on guidance published by the Information Commissioner’s Office (ICO) on the UK GDPR
Scope: which personal and special category data are held?
Ian Stokes Education Ltd will only ask schools to share (and schools should only provide) data which are required for Ian Stokes Education Ltd to deliver those services which have been specifically requested by the school. These services typically include the analysis of pupil performance and contextual data, and the delivery of training in the use and understanding of pupil performance data.
Depending on the services the school has commissioned Ian Stokes Education Ltd to provide, the following personal and special category data may be held by Ian Stokes Education Ltd:
Personal Data
Details of which pupils are on-roll
Current and prior attainment data for each of the key stages covered by your school
Pupil absence information
Pupil information from School Census
Pupil estimates, targets & assessments
Information on allocation of pupils to pupil groups
Pupil address information (home postcode)
Special Category Data
Ethnicity & Language
SEND Information
When commissioning Ian Stokes Education Ltd to supply services which involves the sharing of personal data, a Data Processing Agreement will be drafted and signed by both parties. This agreement will specify the data to be shared and the purposes for which it is used.
Ian Stokes Education Ltd also holds information on its customers. This information is limited to:
Contact details, including job title.
Sharing: does any personal data held by Ian Stokes Education Ltd flow onto anywhere else?
Ian Stokes Education Ltd will not share or transfer any personal data to third parties. Ian Stokes Education Ltd will not share customer information with third party organisations unless specifically requested or agreed by the customer. Ian Stokes Education Ltd may seek permission from the customer to use feedback provided by customers, for the purpose of testimonials, references and marketing.
Retention: What is Ian Stokes Education Ltd’s data retention policy?
Pupil & school data
All pupil & school data provided to Ian Stokes Education Ltd by the school will be deleted no longer than 6 months after end of the financial year in which the data processing agreement between Ian Stokes Education Ltd and the school was signed.
If a school agrees a new data processing agrement with Ian Stokes Education Ltd, existing pupil data will be retained for the duration of this and successive agreement, for a maximum of 5 years.
Customer data
Historic customer data, including contact details and job title, will be retained for a maximum of 5 years.
Access: how can a school access their information held by Ian Stokes Education Ltd?
Pupil & school data: Any pupil or school data provided to Ian Stokes Education Ltd by the school should also be retained in the school’s own systems and there should be no need to access these data via Ian Stokes Education Ltd. However, if a school does wish to receive copies of any data held by Ian Stokes Education Ltd, this should be requested in writing. All requests for information will be responded to within 5 working days.
Customer data: A school can request a copy of its customer data, in writing. All requests for information will be responded to within 5 working days.
Security: How does Ian Stokes Education Ltd ensure the security of the personal data it holds?
What recognised standards are in place?
All electronic pupil and school data held by Ian Stokes Education Ltd are stored only on physical media, secured by industry-standard encryption software (e.g. BitLocker).Ian Stokes Education Ltd does not store personal data on remote, cloud-based servers (such as Microsoft One Drive or Google Drive). All pupil and school data (stored on computer devices or on paper) are held securely on site in a locked safe. Data are transferred between Ian Stokes Education Ltd to schools via secure email with end-to-end encryption. Ian Stokes Education Ltd will not include personal data in an unencrypted email. Any personal data transferred via email will be in the form of a secure, encrypted attachment. Schools should not send personal data to Ian Stokes Education Ltd in an unencrypted email or an unencrypted email attachment.
The first point of contact for individuals whose data is processed by Ian Stokes Education Ltd is Ian Stokes. However, individuals may contact the DPO direct if the need arises. The DPO is first point of contact for the ICO.
Full details of the DPO’s responsibilities are set out in the Service Level Agreement. Our DPO is Richard Lewis-Ogden and is contactable via email at DPO@bywaterkent.co.uk
Ian Stokes Education Ltd is registered with the Information Commissioner’s Office (reference ZA233413) and has paid the required data protection fee.
