STAR ACADEMIES PRIVACY POLICY
WHO PROCESSES YOUR INFORMATION?
Star Academies is the Data Controller of the personal information you provide to us. This means it determines the purposes for which, and the manner in which, any personal data relating to students and course participants is to be processed.
The Head of Governance and Corporate Services is our Data Protection Officer. The Data Protection Officer’s role is to oversee and monitor our data processing practices. If you have any queries regarding anything in this privacy notice, please write to:
Head of Governance and Corporate Services Data Protection Officer
Star Academies Shadsworth Road Blackburn, BB1 2HT
or email [email protected]
Where necessary, third parties may process personal information. Where this is required, Star Academies places data protection requirements on third party processors to ensure data is processed in line with privacy rights.
WHY DO WE NEED YOUR INFORMATION?
Star Academies has the legal requirement and a legitimate interest to collect and process personal data relating to those who enrol on our courses.
We process personal data in order to meet the safeguarding requirements set out in UK employment and childcare law, including those in relation to the following:
• Funding Agreements and contracts with the Department for Education (DfE)
• Legal and statutory framework
• Safeguarding Vulnerable Groups Act 2006
• The guidance “Keeping Children Safe in Education”
• The Childcare (Disqualification) Regulations 2009
Personal data is also processed to assist in the running of Star Academies and Star Institute for the following reasons:
• to facilitate safer recruitment, as part of our safeguarding obligations towards pupils;
• to enable us to establish relevant and required experience and qualifications;
• to support professional development;
• to inform the development of Star Academies’ policies;
• to enable equalities monitoring;
• to ensure that appropriate access arrangements can be provided for students or participants that require them;
• to allow better financial modelling and planning;
• to assess the quality of our services; and
• to comply with the law regarding data sharing.
INFORMATION THAT WE COLLECT, PROCESS, HOLD AND SHARE INCLUDES:
• personal information (i.e. name, address, employee or teacher reference number, national insurance number);
• characteristics (i.e. age, gender);
• special categories of data (i.e. ethnicity, biometrics, health);
• cctv images;
• photographs and video recordings;
• copies of right to work documentation;
• employment records, including work history, job titles, training history and professional memberships;
• education history (i.e. schools and universities/colleges attended);
• qualifications;
• funding information;
• references;
• assessment information; and
• relevant medical information.
THE LAWFUL BASIS ON WHICH WE PROCESS THIS INFORMATION
• Article 6 1(b) of the GDPR which allows processing that is necessary for the performance of a contract;
• Article 6 1(c) of the GDPR which allows processing that is necessary to comply with a legal obligation;
• Article 6 1(e) of the GDPR which allows processing that is carried out in the public interest;
• Article 9 2(b) of the GDPR which allows the processing of special category data that is necessary for carrying out obligations in the fields of employment and social security and social protection law;
• Article 9 2(g) of the GDPR which allows the processing of special category data that is necessary for reasons of substantial public interest;
• Article 9 2(j) of the GDPR which allows the processing of special category data when it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Star Academies maintains Records of Processing that identify the lawful basis on which personal information is processed.
COLLECTING INFORMATION
Whilst the majority of information that you provide to us is mandatory, some of it is provided on a voluntary basis. In order to comply with data protection legislation, we will inform you when your consent is required. Personal data may be obtained and processed from third parties where the law requires us to do so.
STORING INFORMATION
Personal data is stored in line with our Records Management Policy. In accordance with data protection legislation, it is only retained for as long as necessary to fulfil the purposes for which it was obtained, and not kept indefinitely.
DATA TRANSFERRED OUTSIDE THE EU
Processors that we use may transfer, and hold, personal data outside of the EU. We will ensure that organisations who process personal data on our behalf only transfer data to countries that the EU deems as having adequate levels of protection in place. Processors that transfer data to the United States must be covered by the EU-US Privacy Shield. If a processor is found to be transferring data to a country that does not have adequate protections, or to an organisation that is not covered by the EU-US Privacy Shield, we will terminate our contract/subscription.
WHO WE SHARE DATA WITH
We do not share information about students or participants with anyone without consent unless the law and our policies allow us to do so. We share information with the following:
• Local Authorities
• Department for Education (DfE)
• Student Loans Company
• Funding Providers (Bursary Services and Scholarship Providers)
• Delivery partners (e.g. University of Cumbria and Manchester Metropolitan University)
• Teaching Regulation Agency (formerly the National College for Teaching and Leadership)
• Office of the Independent Adjudicator (OIA)
• Police
• Social Services
• Payroll providers
• External Examiners
• Course Tutors
• Occupational health and wellbeing providers
• Schools
• Management Information Systems (e.g. Capita SIMS, NQT Manager, Safeguarding and accident reporting systems)
• Print Management Software providers
• Providers of visitor management and access control systems
• Providers of online learning resources
• Providers of financial management software
• Photography and design agencies
WHAT ARE YOUR RIGHTS?
As the data subject, you have specific rights in relation to the processing of your data. You have a legal right to:
• Request access to the personal data that Star Academies holds.
• Request that your personal data is amended if it is inaccurate or incomplete.
• Request that your personal data is erased where there is no legal basis for its continued processing.
• Request that the processing of your personal data is restricted.
• Object to your personal data being processed if it is likely to cause, or is causing, damage or distress.
Requests must be submitted in writing to the Data Protection Officer (contact details above). Star Academies also has a Subject Access Request Form that may be obtained from Star Institute. Star Academies will consider all requests in line with your legal rights and our legal obligations.
Where the processing of your data is based on your explicit consent, you have the right to withdraw your consent at any time. This will not affect any personal data that has been processed prior to withdrawing consent.
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with the Data Protection Officer in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns