Privacy Policy - Cardinal Heenan

Cardinal Heenan High School is the Data Controller of the personal information you provide to us. This means we determine the purposes for which, and the manner in which, any personal data relating to pupils and their families is to be processed. The Headteacher acts as a representative for the school with regard to its data responsibilities.

In some cases, your data will be outsourced to a third party processor who provides a service to us. Where the school outsources data to a third party processor, the same data protection standards that the school upholds are imposed on the processor.

Mr R Lewis-Ogden is the Data Protection Officer for this school. His role is to oversee and monitor the school’s data protection procedures, and to ensure they are compliant with the GDPR. The Data Protection Officer can be contacted at: DPO@bywaterkent.co.uk

What is this Privacy Notice for?

The notice sets out the different areas where user privacy is concerned and outlines the obligations and requirements of the users and the school. The aim of the notice is to give pupils, parents and carers an insight into how information about pupils is used at our school and how our websites work.

This privacy notice explains how we collect, use, share, and protect personal information about our pupils and their families.

The relevant legislation governing data privacy in the UK is:

The Data Protection Act 2018
The UK General Data Protection Regulation (UK GDPR)
The Data (Use and Access) Act 2025 (DUUA)

Categories of pupil information we process

The categories of pupil/family information that we process include:

Personal identifiers and contacts (such as name, unique pupil number, contact details, and address)
Characteristics (such as ethnicity, language, and pupil premium/free school meal eligibility)
Safeguarding information (such as court orders and professional involvement)
Special educational needs (including specific needs and rankings)
Medical and administration (such as doctors’ information, child health, dental health, allergies, medication, and dietary requirements)
Attendance records (such as sessions attended, number of absences, absence reasons, and previous schools attended)
Assessment and attainment (such as key stage 1 and phonics results)
Behavioural information (records of incidents and exclusions, and relevant alternative provision)
Biometric data (such as fingerprint for lunch payments)
Next of kin information
Emergency contact information
Admissions information
Photographs
CCTV images captured in school
Transport to school information

This list is not exhaustive; please see our data processing map (Record of Processing Activities – RoPA) for the current list.

Why We Collect and Use Pupil and Family Information

Safeguard pupils
Support pupil learning, assessment, and special educational needs as appropriate.
Monitor and report on pupil progress and equality of opportunity
Provide appropriate pastoral and safeguarding care
Allocate the correct teaching resource
Provide appropriate additional support
Assess the quality of our services
Provide a service such as cash free catering
To keep children safe (e.g., food allergies or emergency contact details) and safeguard in accordance with our responsibilities under Keeping Children Safe in Education (KCSiE).
Administer admissions waiting lists
Provide information to families about events and activities at the school
Administer and protect public funds
Hold emergency contacts for each child
To meet the statutory duties placed upon us for the Department for Education (DfE) data collections and health services.

Lawful Bases for Processing Personal Data

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing pupil information include:

Article 6 (1) (c): Processing is necessary for compliance with a legal obligation to which the controller is subject.
Article 6 (1) (e): Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
For special category data, we rely on:
- Article 9 (2) (a): The data subject has given explicit consent to the processing for specified purposes.
- Article 9 (2) (c): To protect the vital interests of the individual.
- Article 9 (2) (f): Legitimate purposes involving legal claims.
- Article 9 (2) (i): Required for purposes of public health.

Storing Pupil/Family Data

We hold pupil data securely for the time specified in our data retention schedule. We have adopted the Information and Records Management Society (IRMS) recommendations. For more information, please see the Data Protection Policy and the IRMS Toolkit for schools.

Storing pupil data

We follow legislation on how long we should hold pupil data in school in line with our Record Management and Data Handling Policies.

In accordance with the GDPR, the school does not store personal data indefinitely; data is only stored for as long as is necessary to complete the task for which it was originally collected.

We comply with the GDPR strict terms and conditions covering the confidentiality and handling of the data, security arrangements and use of the data.

Who do we share pupil/family information with?

We routinely share pupil information with:

Schools that the pupils attend after leaving us.
Our local authority.
Youth support services (pupils aged 13+).
Cardinal Heenan High School Governors
The Department for Education (DfE).
The Diocese of Leeds
School Nursing Service
NHS services and medical providers abroad when on overseas trips
Police forces, courts and tribunals
Pupils’ family and representative
Educators and examining bodies
Selected partners to benefit educational attainment/provide a service which we have contracted them for
Targeted and family support services.
The Police.
Courts and the Children and Family Court Advisory and Support Service (Cafcass).
Service providers (such as Data Protection, HR, and IT support services where appropriate).

Why we share pupil information

We do not share information about our pupils without consent unless the law and our policies allow us to do so. For example, we must share pupil information in accordance with the Education (Pupil Information) (England) Regulations 2005 and Keeping Children Safe in Education statutory guidance.

We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.

We share certain data with 3rd party suppliers who provide a service to us. All our suppliers follow GDPR data processing regulations.

Youth support services

What is different about pupils aged 13+?

For pupils aged 13+, we pass pupil information to our local authority and/or provider of youth support services. This enables them to provide services related to education and training for 13-19-year-olds.
This enables them to provide services as follows:

• youth support services
• careers advisers

A parent / guardian can request that only their child’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the child / pupil once he/she reaches the age 16.

For more information about services for young people, please visit our local authority website.

Withdrawal of Consent and the Right to Lodge a Complaint

Where we process personal data based on consent, you have the right to withdraw that consent. If you have a concern about the way we are collecting or using your personal data, you should raise your concern with the headteacher or our Data Protection Officer at DPO@bywaterkent.co.uk in the first instance.

Data Retention

We will hold pupil data securely for the duration specified in our data retention schedule, following the IRMS guidelines.

Right to access

Parents and pupils have the right to request access to information about them that we hold. To make a request, please contact the School Business Manager or our Data Protection Officer via email at DPO@bywaterkent.co.uk.

DfE Data Collection requirements

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to: https://www.gov.uk/education/data-collection-and-censuses-for-schools

The National Pupil Database (NPD)

Much of the data about pupils in England goes on to be held in the National Pupil Database (NPD). The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies. To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information .

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

conducting research or analysis
producing statistics
providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

who is requesting the data
the purpose for which it is required
the level and sensitivity of data requested: and
the arrangements in place to store and handle the data

For more information, follow the link below:
https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data
To contact DfE: https://www.gov.uk/contact-dfe

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received

Data sharing security

To be granted access to pupil information, organisations must comply with GDPR strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
We will not without your express consent provide your personal information to any third parties for the purpose of direct marketing.

What are your Rights?

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact the Headteacher.

You also have the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress
prevent processing for the purpose of direct marketing
object to decisions being taken by automated means
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
claim compensation for damages caused by a breach of the Data Protection regulations

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with the headteacher or our Data Protection Officer at DPO@bywaterkent.co.uk in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/

Resources & Further Information

Data Protection Officer

If you would like to discuss anything in this privacy notice, please contact our Data Protection Officer at DPO@bywaterkent.co.uk
Cardinal Heenan High School, Tongue Lane, Leeds, LS6 4QE Tel: 0113 8873240

Privacy Policy Changes

Although most changes are likely to be minor, the school may change its Privacy Policy from time to time at the sole discretion of the school.

Contact Details

Cardinal Heenan High School
Tongue Lane
Leeds
LS6 4QE

Tel: 0113 8873240
Email: info@cardinalheenan.com
Fax: 0113 2940320

Last Updated

This version was last updated in November 2025.

Privacy Policy.