Privacy Notice

Wray Endowed Primary School

Date of policy: October 2026
Review date: October 2027

1. Introduction

Wray Endowed Primary School is committed to protecting the privacy and security of personal information.

This privacy notice explains how we collect, use, store and share personal information about pupils, parents and carers, prospective pupils, staff, governors, volunteers and other individuals who interact with the school.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation.

This notice should be read alongside the school’s Data Protection Policy and other relevant school policies.

We will review this privacy notice at least annually and whenever there is a significant change to the way we process personal information.

2. Who are we?

For the personal information covered by this notice, the school’s data controller is:

Wray Endowed Primary School
School Lane
Wray
Lancashire
01524 221337
[email protected]

As a maintained school, Lancashire County Council may also process personal information for functions for which the Council is the data controller.

Lancashire County Council’s privacy notice is available on its website.

3. Our Data Protection Officer

The school has access to a Data Protection Officer (DPO).

Data Protection Officer: Headteacher
Email: [email protected]

If you have questions about how the school uses your personal information, you can contact the school or our Data Protection Officer.

4. What personal information do we collect?

Depending on your relationship with the school, we may collect and use information including:

Pupils

  • Name, address and contact details
  • Date of birth and gender
  • Admission and attendance information
  • Parent/carer and emergency contact details
  • Academic and assessment information
  • Special educational needs and disability information
  • Behaviour and safeguarding information
  • Medical and health information where appropriate
  • Photographs and video recordings
  • Information relating to trips, clubs and activities
  • Information required for examinations and statutory assessments
  • Information required for the provision of education and pupil support

Parents and carers

  • Names and contact details
  • Relationship to the pupil
  • Emergency contact information
  • Information required to support the education and welfare of a child
  • Information relating to communications with the school

Staff and volunteers

  • Name and contact details
  • Employment and recruitment information
  • Qualifications and professional information
  • Payroll and financial information
  • Attendance and absence information
  • DBS and safeguarding information where applicable
  • Performance and training information
  • Health information where necessary
  • Information required for safer recruitment

Governors and other school personnel

  • Contact details
  • Role and appointment information
  • Training and qualification information
  • Declarations of interests
  • Attendance information
  • Information required for governance and statutory reporting

5. Why do we use personal information?

We use personal information to:

  • Provide education and support to pupils
  • Safeguard pupils and promote their welfare
  • Monitor attendance and manage absence
  • Support pupils with special educational needs and disabilities
  • Assess and report on pupil progress
  • Communicate with parents, carers and families
  • Administer admissions and transfers
  • Organise school trips, clubs and activities
  • Manage staff, volunteers and governors
  • Meet our legal and statutory obligations
  • Comply with safeguarding requirements
  • Manage school finances and administration
  • Respond to complaints and enquiries
  • Maintain school records
  • Meet reporting requirements to the Department for Education, Lancashire County Council and other relevant bodies
  • Support public health, emergency planning and other statutory functions where required
  • Protect the health and safety of pupils, staff and visitors

6. Our lawful bases for using personal information

Under data protection legislation, we must have a lawful basis for processing personal information.

Depending on the circumstances, the school may rely on:

  • Legal obligation – where the law requires us to process information.
  • Public task – where processing is necessary for us to carry out our functions in the public interest or under official authority.
  • Contract – where processing is necessary to enter into or perform a contract.
  • Vital interests – where processing is necessary to protect someone’s life.
  • Consent – where we have specifically asked for permission and consent is the appropriate lawful basis.
  • Legitimate interests – where applicable and where those interests are not overridden by the rights and interests of the individual.

We will not rely on consent where another lawful basis is more appropriate.

Where we process special category information, such as health information, we will also identify an appropriate additional condition under data protection law.

7. Special category and safeguarding information

Some information requires additional protection. This can include:

  • Health information
  • Disability and special educational needs information
  • Racial or ethnic information
  • Religious or philosophical beliefs
  • Information relating to safeguarding
  • Information relating to criminal allegations or offences

We only process this information where permitted by law and where appropriate safeguards are in place.

Safeguarding information may need to be shared without consent where this is necessary to protect a child or another person, or where the law requires us to do so.

8. Who do we share information with?

We may share personal information with organisations where there is a lawful basis for doing so.

These may include:

  • Lancashire County Council
  • Department for Education
  • Ofsted
  • NHS and healthcare professionals
  • School nursing services
  • Education and specialist support services
  • Social care and children’s services
  • Police and other emergency services
  • Other schools when pupils transfer
  • Examination and assessment bodies
  • Professional advisers and auditors
  • School management and information-system providers
  • IT and software providers acting on our behalf
  • Breakfast clubs, after-school clubs and activity providers where appropriate
  • Other organisations where sharing is required or permitted by law

We will only share information where there is a lawful basis and will take appropriate steps to protect the information.

9. Information shared with the Department for Education

Schools are required to provide certain information to the Department for Education and other government bodies through statutory data collections.

This can include information about pupils, parents or carers, staff, attendance, assessment and other information required by law.

The Department for Education may use information collected from schools for purposes including funding, monitoring education policy, research and school accountability.

Further information about how the Department for Education processes personal information can be found in its published privacy notices.

10. Lancashire County Council

Lancashire County Council processes personal information in connection with a range of education and children’s services.

Where Lancashire County Council is the data controller for particular processing, its own privacy notice will apply.

Lancashire County Council’s privacy notice can be found on its website:

https://www.lancashire.gov.uk/council/transparency/access-to-information/privacy-notice

11. How we protect personal information

We take appropriate technical and organisational measures to protect personal information against:

  • Unauthorised access
  • Loss
  • Destruction
  • Accidental disclosure
  • Unauthorised alteration
  • Other forms of inappropriate processing

Access to personal information is limited to people who have a legitimate need to access it.

Staff receive appropriate information and training about data protection and information security.

12. How long do we keep personal information?

We retain information only for as long as it is necessary and in accordance with applicable legal, regulatory and organisational requirements.

The school follows appropriate retention schedules and procedures for the secure disposal of information when it is no longer required.

Some education, safeguarding, personnel and financial records must be retained for specific periods because of legal or statutory requirements.

13. Children’s privacy

Children have rights in relation to their personal information.

We will explain privacy and data protection to pupils in an age-appropriate way and encourage them to understand how their information is used.

Where appropriate, pupils may exercise their own data protection rights. The circumstances will depend on the child’s age, understanding and the nature of the request.

14. Photographs and video

The school may take photographs and make video recordings for purposes connected with education, school activities, safeguarding, communication and promoting the school.

Where consent is required, we will obtain it appropriately.

Some photographs or recordings may be published on the school’s website, newsletters or other school communication channels in accordance with our policies and the permissions in place.

We will not assume that consent is required where another lawful basis applies.

15. Subject Access Requests

You have the right to request access to personal information that the school holds about you.

This is known as a Subject Access Request (SAR).

Requests should be made to:

[email protected]

or in writing to:

Wray with Botton Endowed Primary School
School Lane
Wray
Lancashire
LA2 8QE

16. Online services and filtering and monitoring

The school uses information technology and online services to support education and administration.

The school may process information relating to pupils’ use of school systems where necessary for safeguarding, security, education and the effective operation of school IT systems.

The school operates appropriate filtering and monitoring arrangements in accordance with its safeguarding responsibilities.

17. Your data protection rights

Depending on the circumstances, individuals have rights under data protection law, including:

  • The right to be informed about how personal information is used
  • The right to request access to personal information
  • The right to request correction of inaccurate information
  • The right to request erasure in certain circumstances
  • The right to request restriction of processing in certain circumstances
  • The right to object to processing in certain circumstances
  • The right to data portability in certain circumstances
  • Rights relating to automated decision-making and profiling where applicable

Not all rights apply in every situation. Some rights are subject to legal exemptions.

We may need to verify your identity before providing information.

18. If you have a concern

If you have a concern about the way the school is handling your personal information, please contact the school or our Data Protection Officer in the first instance.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk/

19. Data breaches

The school has procedures for identifying, managing and responding to personal data breaches.

If you believe that your personal information has been lost, disclosed incorrectly or otherwise compromised, please contact the school as soon as possible.

20. Changes to this privacy notice

We will review this privacy notice at least annually and whenever there is a significant change to the way we process personal information.

The latest version will be published on the school website.

Last reviewed: October 2026

Next review: October 2027