Services Privacy Policy

This Notice should be read in conjunction with our General Privacy Notice.

Our role in processing your data

We have developed the system that is used to generate your user accounts on behalf of the Data Controller. In this context we are the Data Processor. You should contact the appropriate Data Controller for more information on how they process your data. We are responsible for the processing of your data within our solution but have no authority or responsibility beyond that process.

How do we collect information from you?

Information is provided to us from the source Management Information System or an agreed external process. Examples of such Systems include SIMS, Bromcom, iSAMS etc.

What type of information is collected from you?

• MIS Details
• Name
• Address
• Year
• Date of birth.
• Attendance and Behaviour information
• Medical Information

How is your information used?

• Creation of User accounts as specified by the Data Controller (Microsoft 365, Google Workspace for Education, Active Directory, Apple School Manager etc.)
• Online Reporting of behaviour, attendance, school timetable, related to your role at the school (Parent, Staff, Pupil)

Lawfulness of Processing

We process information detailed in this Notice under the following lawful conditions:

• Performance of a Contract

Special Categories of Data

In the case of our online reporting tool we provide access to medical data of a Pupil to both the Parents of that Pupil and the Authorised Staff at the Data Controller. This is to ensure a timely and informed response in the event of a medical emergency.
Lawfulness of Processing Special Category Data

• Medical diagnosis, the provision of health or social care or treatment or the management of health or social care.

Lawfulness of Processing Special Category Data

Special category data is personal data that needs more protection because it is sensitive. In order to lawfully process such special category data, we must have both a lawful basis for the processing (Article 6 UK GDPR) and also a separate condition for processing (Article 9 UK GDPR).

• Our lawful basis for processing this data is to perform the contract we have with the Data Controller.
• The separate condition for processing this data is medical diagnosis, the provision of health or treatment, the provision of social care, or the management of health or social care.

Review of this Notice

We keep this Notice under review. This Notice was last updated in May 2023.