Privacy Notice for Parents/Carers


Under data protection law, individuals have a right to be informed about how the School uses any Personal Data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their Personal Data.

This privacy notice explains how Thorverton Primary School, as part of Exe Valley Federation ('the School,' we', 'us' or 'our') collect, store and use Personal Data about pupils.

We are the ‘data controller’ for the purposes of data protection law.

Our details

We are:   Exe Valley Federation (Thorverton, Newton St Cyres, Cheriton Fitzpaine and Brampford Speke Primary Schools)

Address: Station Road

Newton St Cyres Primary School

Newton St Cyres




Information Commissioner's Office Registration Number: Z5250269

Our Data Protection Officer is: Dee Whitmore

And their contact details are

Address: Data Protection Officer Service

44 Tyndall Court




The Personal Data we hold

Personal Data that we may collect, use, store and share (when appropriate) about pupils includes, but is not restricted to:           

·       Name, contact details, contact preferences, date of birth, identification documents;

·       Parent/ carer contact details;

·       Information in connection with education (including but not limited to unique pupil number, results of internal

        assessments and externally set tests, post 16 learning information and other records);

·       Pupil and curricular records;

·       Characteristics, such as ethnic background, religion, first-language or special educational needs;

·       Free school meal eligibility;

·       Exclusion information and details of behavioral issues;

·       Details of any medical conditions, including physical and mental health, medications and dietary requirements;

·       Attendance information;

·       Safeguarding information;

·       Details of any support received, including care packages, plans and support providers;

·       Photographs;

·       CCTV images captured in School;

·       Any other personal data we will inform you of trom time to time.

We may also hold data about pupils that we have received from other organisations, including other schools, local authorities and the Department for Education.


Why we use this data

We use this data to:

·       Get in touch with parents/ carers when necessary;

·       Support pupil learning;

·       Monitor and report on pupil progress;

·       Provide appropriate pastoral care;

·       Protect pupil welfare;

·       Assess the quality of our services;

·       Ensure proper management of school trips and afterschool clubs and activities ;

·       Promote and protect health and safety;

·       Administer admissions waiting lists;

·       Carry out research;

·       Comply with the law regarding data sharing;

·       to meet the statutory duties placed upon us for DfE data collections;

In addition, Personal Data will be collected and/or processed for the purposes of relevant contracts for the provision of services which are paid for.  This may include but is not limited to:

·       the provision of music tuition;

·       school trips;

·       entering students for examinations.


Our lawful bases for processing personal data

We only collect and use pupils’ Personal Data when the law allows us to. Most commonly, we process it where:

·       We need to comply with a legal obligation;

·       We need it to perform an official task in the public interest (in order to provide pupils with an education and to offer extra-curricular activities);


Less commonly, we may also process pupils’ Personal Data in situations where:

·       We have obtained consent to use it in a certain way;

·       We need to protect the individual’s vital interests (or someone else’s interests).


Our lawful bases for processing ‘Special Category’ personal data

Special categories of data means Personal Data revealing:

·         racial or ethnic origin;

·         political opinions; religious or philosophical beliefs or trade union membership;

·         genetic or biometric data that uniquely identifies you;

·         data concerning your health, sex life or sexual orientation; or

·         data relating to criminal convictions or offences or related security measures

We process special categories of Personal Data where necessary under the following lawful bases:

·         Processing is necessary for substantial public interest in complying with legal obligations including under the Equality Act 2010;

·         Processing is necessary to protect the vital interests of the data subject or of another natural person and where safeguards are in place to ensure that this Personal Data is kept secure; 

·         The data subject has given explicit consent or a person with the lawful authority to exercise consent on the data subjects behalf;

·         Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

·         Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. 

Where we have obtained explicit consent to use pupils’ Personal Data, this consent can be withdrawn at any time. We will make this clear when we ask for consent and explain how consent can be withdrawn. If consent is the only legal basis for processing and has been given, then this may be revoked in which case the Personal Data will no longer collected/processed.

Some of the reasons listed above for collecting and using pupils’ Personal Data overlap, and there may be several grounds which justify our use of this data.


Automated decision making and/or profiling

The School does not use automated decision making and/or profiling in any of its processes and procedures.


Collecting Pupil’s personal data

We collect Pupil personal data from:

·         Application/admissions processes;

·         Common Transfer files;

·         Assessment and attainment processes;

·         Attendance (routine register twice a day)

·         Special Educational Needs and Disabilities (SEND) information

·         Parent Communications;

·         In addition, the School also uses CCTV cameras in and around the school site for security purposes and for the protection of staff, pupils and other stakeholders.

While the majority of information we collect about pupils is mandatory, there is some information that can be provided voluntarily.

Whenever we seek to collect information from you or your child, we make it clear whether providing it is mandatory or optional. If it is mandatory, we will explain the possible consequences of not complying.


Storage and Retention of Personal Data


A significant amount of personal data is stored electronically. Some information may also be stored as hard copy.


Data stored and accessed electronically is done so in accordance with the School’s Data Security Policy

Hard copy data is stored and accessed in accordance with the School’s Data Security Policy


We will only retain personal data for as long as necessary to fulfil the purposes we collected it for, and in accordance with retention periods outlined in The Information Management Toolkit for Schools


Data Sharing

We routinely share pupil information with:

·         our Local Authority;

·         a pupil’s home Local Authority (if different);

·         the Department for Education (DfE);

·         Ofsted;

·         NHS/School Nurse Service;



From time to time, we may also share pupil information with other stakeholders and organisations including:

·         School governors / trustees;

·         Law enforcement agencies;

·         NHS health professionals; educational psychologists;

·         Education Welfare Officers;

·         Courts, if ordered to do so;

·         The Teaching Regulation Authority;

·         Prevent teams in accordance with the Prevent Duty on Schools;

·         Other schools, for example, if we are negotiating a managed move or the pupil is moving on to another school;

·         Our legal advisors;

·         Our auditors;

·         Our insurance providers / the Risk Protection Arrangement;

·         Contracted Professional advisers and consultants



Third Party Suppliers


We also share limited personal data with third party service providers who require access to data in order to perform contracted services. These service providers include:


·       School Comms;

·       SIMS;

·       Babcock LDP;

The above listed third party suppliers will process data on our behalf.  Therefore, we investigate these third-party suppliers to ensure their compliance with Relevant Data Protection Laws and specify their obligations in written contracts


National Pupil Database

We are required by law to provide information about pupils to the Department for Education as part of statutory data collections such as the school census.

Some of this information is then stored in the National Pupil Database (NPD), which is owned and managed by the Department and provides evidence on school performance to inform research. The law that allows this is the Education (Information about Individual Pupils) (England) Regulations 2013.

The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.

The Department for Education may share information from the NPD with other organisations which promote children’s education or wellbeing in England. Such organisations must agree to strict terms and conditions about how they will use the data.

For more information, see the Department’s webpage on how it collects and shares research data.

You can also contact the Department for Education with any further questions about the NPD.





Transferring data internationally

We do not routinely share data with organisations outside the EEA. 


We will not transfer personal data outside the European Economic Area (EEA) unless such transfer complies with the GDPR. This means that we cannot transfer any personal data outside the EEA unless:

·         The EU Commission has decided that another country or international organisation ensures an adequate level of protection for personal data

·         One of the derogations in the GDPR applies (including if an individual explicitly consents to the proposed transfer).


Parents and pupils’ rights regarding Personal Data

Individuals have a right to make a ‘subject access request’ to gain access to personal information that the School holds about them.

Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 13), or where the child has provided consent.

Parents also have the right to make a subject access request with respect to any Personal Data the School holds about them.

If you make a subject access request, and if we do hold information about you or your child, we will:

·       Give you a description of it

·       Tell you why we are holding and processing it, and how long we will keep it for

·       Explain where we got it from, if not from you or your child

·       Tell you who it has been, or will be, shared with

·       Let you know whether any automated decision-making is being applied to the data, and any consequences of this

·       Give you a copy of the information in an intelligible form


Individuals also have the right for their personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a Subject Access Request (SAR), please contact the School through the usual channels.

We will aim to respond to SARs within 30 days of receipt of a valid request.  If responding to your request will take longer than a month, or we consider that an exception applies, then we will let you know as soon as possible. 


Other rights

Under data protection law, individuals have certain rights regarding how their Personal Data is used and kept safe, including the right to:

·       Be informed about the collection and use of your Personal Data

·       Access your Personal Data (please see above)

·       Object to the use of Personal Data if it would cause, or is causing, damage or distress

·       Prevent it being used to send direct marketing

·       Object to decisions being taken by automated means (by a computer or machine, rather than by a person)

·       In certain circumstances, have inaccurate Personal Data corrected, deleted or destroyed, or restrict processing

·       To receive your Personal Data in a format that can be transferred. We will normally supply Personal Data in the form of e-mails or other mainstream software files. 

·       Claim compensation for damages caused by a breach of the data protection regulations

To exercise any of these rights, please contact our data protection officer.


How to contact us

We take any concerns about our collection and use of personal information very seriously. If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance by emailing

If you have concerns that we are not able to resolve to your satisfaction you can contact our Data Protection Officer courtesy of the Federation Business Manager at:


Mrs Heidi Last

Chertion Fitzpaine Primary School

Cheriton Fitzpaine


EX17 4AN


Alternatively, you can register a concern with the Information Commissioner’s Office:

·       Report a concern online at

·       Call 0303 123 1113

·       ICO Email:

·       Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF


Changes to this notice

Any changes we make to this notice in the future will be posted on our website and, where appropriate, notified to you by e-mail.  Please check back frequently to see any updates or changes.


This privacy policy was last updated on 10th September 2018


This notice is based on the Department for Education’s model privacy notice for the school workforce, amended to reflect the way we use data in this school.



Exe Valley Federation
Cheriton Fitzpaine Primary School

Cheriton Fitzpaine,
Devon EX17 4AN

01363 866456
Newton St Cyres Primary School

Station Road
Newton St Cyres

01392 851267
Thorverton C of E Primary School

School Lane,
Devon EX5 5NR

01392 860374