South Cumbria Multi-Academy Trust

Terms and Conditions

Record of Processing Activities SCMAT

This record of processing activities describes how South Cumbria Multi-Academy Trust (SCMAT) processes personal data.

We recognise that Article 30 of the General Data Protection Regulation (GDPR) imposes documentation requirements on controllers and processors of data. This record is information that is confidential to the School but will be provided to supervisory authorities (such as the Information Commissioner’s Office) on request and as required by the GDPR.

Trust Details

South Cumbria Multi-Academy Trust
Address: c/o Furness College, Channelside, Barrow-in-Furness, LA14 2PJ
Telephone Number: 01229 825017
Website: www.scmat.org.uk

Data Controller Name: Kathryn Farrow
Data Controller Details: Channelside campus, Barrow-in-Furness, LA14 2PJ
Data Controller Email: kathryn.farrow@furness.ac.uk

Categories of Data Subjects

The School collect personal data from the following categories of data subjects: –

  • SCMAT employees and job applicants
  • SCMAT pupils and parents (past, current and future)
  • SCMAT vendors or suppliers

Categories of Personal Data

SCMAT collects the following categories of personal data about employees and job applicants: –

  • Personal information and contact details such as name, title, addresses, date of birth, marital status, phone numbers and personal email addresses;
  • Emergency contact information such as names, relationship, phone numbers and email addresses;
  • Information collected during the recruitment process that we retain during your employment including references, proof of right to work in the UK, application form, CV, qualifications;
  • Employment contract information such as start dates, hours worked, post, roles;
  • Education and training details;
  • Details of salary and benefits including payment details, payroll records, tax status information, national insurance number, pension and benefits information;
  • Details of any dependants;
  • Your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information;
  • Information in your sickness and absence records such as number of absences and reasons(including sensitive personal information regarding your physical and/or mental health);
  • Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs;
  • Criminal records information as required by law to enable you to work with children;
  • Your trade union membership;
  • Information on grievances raised by or involving you;
  • Information on conduct and/or other disciplinary issues involving you;
  • Details of your appraisals, performance reviews and capability issues;
  • Details of your time and attendance records;
  • Information about the use of our IT, communications and other systems, and other monitoring information;
  • Details of your use of business-related social media;
  • Images of staff captured by the School’s CCTV system;
  • Your use of public social media (only in very limited circumstances, to check specific risks for specific functions within the School, you will be notified separately if this is to occur); and
  • Details in references about you that we give to others.

SCMAT collects the following categories of personal data about pupils and parents: –

  • Personal information such as name, pupil number, date of birth, gender and contact information;
  • Emergency contact and family lifestyle information such as names, relationship, phone numbers and email addresses;
  • Characteristics (such as ethnicitiy, language, nationality, country of birth and free school meal eligibility);
  • Attendance details (such as sessions attended, number of absences and reasons for absence);
  • Financial details;
  • Performance and assessment information;
  • Behavioural information (including exclusions);
  • Special educational needs information;
  • Relevant medical information;
  • Special categories of personal data (including biometric data, ethnicity, relevant medical information, special educational needs information);
  • Images of pupils engaging in school activities, and images captured by the School’s CCTV system;

SCMAT collects the following categories of personal data about vendors and suppliers: –

  • Name and contact information;
  • Financial and payment details;

Purposes of Data Processing

SCMAT collects and processes personal data about employees and job applicants for the following purposes: –

  • To determine recruitment and selection decisions on prospective employees;
  • In order to carry out effective performance of the employees contract of employment and to maintain employment records;
  • To comply with regulatory requirements and good employment practice;
  • To carry out vetting and screening of applicants and current staff in accordance with regulatory and legislative requirements;
  • Enable the development of a comprehensive picture of the workforce and how it is deployed and managed;
  • To enable management and planning of the workforce, including accounting and auditing;
  • Personnel management including retention, sickness and attendance;
  • Performance reviews, managing performance and determining performance requirements;
  • In order to manage internal policy and procedure;
  • Human resources administration including pensions, payroll and benefits;
  • To determine qualifications for a particular job or task, including decisions about promotions;
  • Evidence for possible disciplinary or grievance processes;
  • Complying with legal obligations;
  • To monitor and manage staff access to our systems and facilities in order to protect our networks, the personal data of our employees and for the purposes of safeguarding;
  • Network and information security, including preventing unauthorised access to our computer network and communications systems and preventing malicious software distribution;
  • Education, training and development activities;
  • To monitor compliance with equal opportunities legislation;
  • Determinations about continued employment or engagement;
  • Arrangements for the termination of the working relationship;
  • Dealing with post-termination arrangements;
  • Health and safety obligations; and
  • Fraud.

SCMAT collects and processes personal data (including special category data) about pupils and parents for the following purposes: –

  • For the purposes of pupil selection (and to confirm the identity of prospective pupils and their parents);
  • To provide education services and extra-curricular activities to pupils, and monitoring pupils’ progress and educational needs;
  • To derive statistics which inform decisions such as the funding of schools
  • To assess performance and to set targets for schools;
  • To safeguard pupils’ welfare and provide appropriate pastoral (and where necessary medical) care;
  • To give and receive information and references about past, current and prospective pupils, and to provide references to potential employers of past pupils;
  • In order to manage internal policy and procedure;
  • To enable pupils to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils of SCMAT;
  • For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as diversity or gender pay gap analysis);
  • For legal and regulatory purposes (for example child protection, diversity monitoring and health and safety) and to comply with its legal obligations and duties of care;
  • To enable relevant authorities to monitor the schools’ performance and to intervene or assist with incidents as appropriate;
  • To monitor (as appropriate) use of SCMAT’s IT and communications systems in accordance with the schools’ IT security policy;
  • To make use of photographic images of pupils in school publications, on the schools’ websites and (where appropriate) on the schools’ social media channels;
  • For security purposes, including CCTV in accordance with the schools’ CCTV policy; and
  • Where otherwise reasonably necessary for the schools’ purposes, including to obtain appropriate professional advice and insurance for the school.
  • For biometrics to be used at lunchtime and to use the photocopiers.

SCMAT collects and processes personal data about vendors and suppliers for the following purposes: –

  • To obtain products and services;
  • To enable those suppliers to provide services to the Schools’ to enable them to carry out employment and education based functions;
  • For supplier administration and management including evaluation potential suppliers and accounts management;

Categories of Personal Data Recipients

SCMAT discloses personal data to the following categories of recipients: –

  • the Department for Education (DfE) – on a statutory basis under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013;
  • Ofsted;
  • Youth support services – under section 507B of the Education Act 1996, to enable them to provide information regarding training and careers as part of the education or training of 13-19 year olds;
  • other schools within the Trust;
  • Other Schools that pupils have attended/will attend;
  • NHS;
  • Welfare services (such as social services);
  • Law enforcement officials such as police, HMRC;
  • LADO;
  • Training providers;
  • Professional advisors such as lawyers and consultants;
  • Support services (including HR support, insurance, IT support, information security, pensions and payroll);
  • The local authority;
  • Occupational Health;
  • DBS; and
  • Recruitment and supply agencies.

SCMAT ensure that reasons for sharing data with those organisations are in accordance with the GDPR and put in place appropriate safeguards for any personal data transfers.

Personal Data Retention Periods

Except as otherwise permitted or required by applicable law or regulation, SCMAT only retains personal data for as long as necessary to fulfil the purposes they collected it for, as required to satisfy any legal, accounting or reporting obligations, or as necessary to resolve disputes.

To determine the appropriate retention period for personal data, SCMAT considers the amount, nature, and sensitivity of personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for processing the personal data, whether we can fulfil the purposes of processing by other means and any applicable legal requirements.

SCMAT typically retains personal data for 6 years subject to any exceptional circumstances or to comply with laws or regulations that require a specific retention period.

Technical and Organisational Security Measures

SCMAT has implemented the following technical and organisational security measures to protect personal data: –

  • Encryption of personal data (including the use of secure passwords);
  • Segregation personal data from other networks;
  • Access control and user authentication;
  • Employee training on data protection and information security;
  • Written information security policies and procedures;
  • Impact assessments and evaluation of risks to personal data;

Changes to This Record Of Processing Activities

SCMAT reserves the right to amend this record of processing activities from time to time consistent with the GDPR and other applicable data protection requirements including ICO guidance.

South Cumbria Multi-Academy Trust
South Cumbria Multi-Academy Trust
South Cumbria Multi-Academy Trust
c/o Chetwynde School Croslands
Rating Lane, Barrow-in-Furness
Cumbria LA13 0NY

Company number 13414087 registered in England.
Tel: 01229 824 210
Email: info@scmat.org.uk
South Cumbria Multi-Academy Trust