Pupil Privacy Notice - Upper Third and Above (12+)

Privacy Notice for Pupils Upper Third and above

How we use your information


This Notice helps you understand how and why we collect your personal information and what we do with it.  It also explains the decisions you can make about your own information. We are giving you this Notice because you are mature enough to make decisions about your personal information. If you have any questions about this, please ask your tutor to arrange a meeting with the Assistant Bursar.

What is "Personal Information"?

Personal information is that which identifies you as an individual. We hold information about you which includes information such as your name, date of birth and address as well as things like exam results, any medical details and your unique pupil number.  We may also record your religion or ethnic group.  CCTV, photos and video recordings of you are also personal information as well as vehicle details for those authorised to use our car parks.

How and Why do we Collect and Use Personal Information?

Our main reason for using your personal information is to provide you with an education. Below are examples of the different ways in which we use it and where it comes from.

  • Admissions forms give us lots of personal information. We also get information from you, your parents, your teachers and sometimes other pupils. Your old school also gave us information about you so that we can teach and care for you.
  • Where needed, we sometimes we get information from your doctors and other professionals so we can look after you.

We collect this information to help the College run properly, safely and to let others know what we do here.  Here are some examples:

  • We need to tell the appropriate teachers if you are allergic to something or have a health issue.
  • We might need to tell your teachers if you have learning needs or need extra help with some tasks. 
  • We may need to share information about your health and wellbeing with the Medical Centre, College Doctor or counsellor.
  • We use CCTV to make sure the College is safe. We do not use CCTV in private areas such as changing rooms. 
  • We record your attendance and if you have time away from the College, we record the reason(s) why.
  • We may need to give some of your information to the Government (e.g. the Department for Education).  Another example could be that we may need to tell the local authority that you attend the College or let them know if we have any concerns about your welfare.
  • We are legally required to provide the Department for Education with certain information about you and your classmates. 
  • We may need information about any legal matter which relates to you.  This is so we can safeguard your welfare and wellbeing and the other pupils at the College.
  • If you are from another country we have to make sure you have the right to study in the UK.  We might have to provide information to UK Visas and Immigration who are part of the Government.
  • Depending on where you go when you leave us, we may need to provide your information to other schools, colleges and universities or potential employers e.g. we may share information about your exam results and provide references.  We may need to pass on information which they need to look after you.
  • When you take public examinations (e.g. GCSEs) we will need to share information about you with examination boards.  For example, if you require extra time in your exams.
  • We are sometimes inspected to make sure that we are doing everything that we should to be a good College.  We may have to share your information with the inspectors to help them to carry out their job.
  • If someone makes a complaint about how the College has behaved we may need to use your information to deal with this appropriately e.g. if your parents complain that we have not looked after you properly.
  • We may need to share information with the police or our legal advisors if something goes wrong or to help with an inquiry e.g. if one of your classmates is injured at the College or if there is a burglary.
  • Occasionally we may use consultants, experts and other advisors to assist us in fulfilling our obligations and to help us run the College properly.  We might need to share your information with them if this is relevant to their work.
  • If you have misbehaved in a serious way and the police have become involved, we may need to use information about the action taken by them.
  • We may share some information with our insurance company to make sure we have the insurance cover that we need.
  • We may share your academic and (where fair) your behaviour records with your parents or education guardian so they can support your schooling.
  • We will only share your information with other people and organisations when we have a good reason to do so.  In exceptional circumstances, we may need to share it more widely than we would normally.
  • We will monitor your use of email, the Internet and mobile electronic devices.  This monitoring is sometimes carried out using computer software.  In certain circumstances we may look at the content of your communications (e.g. emails and text messages). We monitor and look at your use of technology to check that you and your classmates are not misbehaving, at risk of harm or for other good reasons.  More information about this is in the Acceptable Use of IT Policy.
  • We may take photographs or videos of you at events to use on social media, on our website, in printed or digital adverts (including social media adverts) or in other marketing communications.  This helps us show prospective parents and pupils what we provide and to promote the College.  We may seek specific consent before using a photograph or video recording of parents and pupils, where we consider that the use is more privacy intrusive. We may continue to use these photographs and videos after you have left.
  • Sometimes we use photographs and videos for teaching purposes, for example, to record a drama lesson. 

We publish our public examination results, sports fixtures and other news on the website and put articles and photographs in the local news to tell people about what we have been doing.  If you have concerns about us using photographs or videos of you, please ask your tutor to arrange a meeting with the Assistant Bursar.

  • We may keep details of your address when you leave so we can send you OS News (the Old Stortfordian alumni) and find out how you are getting on.  Further information on the OS can be found on the College website.
  • We sometimes use contractors to handle personal information on our behalf for example:
  • IT consultants who might access information about you when checking the security of our IT network.
  • We do use third party "cloud computing" services to store some information rather than the information being stored on hard drives located on the College site.

The majority of your Personal Data collected by us will mostly remain within the College and in all cases it will be handled only by people who need to know the information. Again, if you have any concerns about any of the above, just ask us.

Our Legal Grounds for Using Your Information.

This section contains legal and technical information about the legal grounds we are relying on when handling your information as described above. 

Our legitimate interests

This means that we are using your information when this is necessary for our legitimate interests except when this would be unfair to you.  We rely on this ground for many of the ways in which it uses your information.

Specifically, the College has a legitimate interest in;

  • providing you with an education;
  • looking after you and your classmates;
  • providing references for you;
  • telling people about the College and what we do e.g. we may use photographs of you in our prospectus, on our website or in our social media;
  • monitoring the proper use of our IT and communications systems; and
  • improving the College e.g. if we want to raise money to build new buildings or to make sure that we are providing you and your classmates with a good schooling experience. 

Additionally, your personal information may be processed for the legitimate interests of others e.g. we may use information about you when investigating a complaint made by one of your fellow pupils. If you object to us using your information where we are relying on our legitimate interests as explained above, please let us know.

Our legal obligation

We might need to use your information in order to comply with a legal obligation e.g. to report a concern about your wellbeing to Children's Services.  We may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so.

Your vital interests

In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt). 

The public interest

The following are examples of when we use your information to perform tasks in the public interest:

  • Providing you with an education.
  • Safeguarding and promoting your welfare and the welfare of other children.
  • Facilitating the efficient operation of the College. 
  • Ensuring that we comply with all of our legal obligations.

If you object to us using your information when we are relying on this ground please ask your tutor to arrange a meeting with the Assistant Bursar.

We must also comply with an additional condition where we process special categories of personal information.   These special categories include personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic information, biometric information, health information and information about sex life or orientation. 

We believe there is a substantial public interest.

We are allowed to use special categories of personal information where we believe it is needed and there is a substantial public interest.  This is similar to "public interest" in the table above e.g. we may use special categories of information about you to provide you with an education to look after you and your classmates or when the College is inspected.

Our responsibilities with employment and social protection law

There may be times when we need to use your information because we are an employer (e.g. we employ your teachers).  Also, the College may use your information to comply with social protection law e.g. to look after you.

Your vital interests

In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt).

Legal claims

We are allowed to use your information if this is necessary in relation to legal claims.  For example, this allows us to share information with our legal advisors and insurers.

Medical purposes

This includes medical treatment and the management of healthcare services and providing Learning Support.

We may ask for your consent to use your information in certain ways.  If we ask for your consent to use your personal information, you can take it back at any time.  Any use we have made of your information before you withdraw your consent will still remain valid.

There are some limited circumstances where your request to withdraw consent can’t always be accepted. For example, where we have to comply with legal obligations to keep certain data to give to official authorities e.g. Department for Education, County Council. Please let us know if you would like to withdraw any consent that you have given. In some cases we will rely on more than one of the grounds above for a particular use of your information e.g. we may rely on legitimate interests and public interest grounds when using your information to look after you and your classmates.

Sending information to other countries.

We may send your information to countries which do not have the same level of protection for personal information as the UK.  For example, we may communicate with you by email when you are overseas (for example, when you are on holiday).

The EU has produced a list of countries which have adequate data protection rules.  The list can be found at https://ec.europa.eu/info/law/law-topic/data-protection_en. If the country that we are sending your information to is not on the list or, is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland) then, it might not have the same level of protection for personal information as the UK. 

We will provide you with details about the safeguards which we have in place outside of this Privacy Notice. If you have any questions about the safeguards that are in place please ask your tutor to arrange a meeting with the Assistant Bursar.

For How Long do we Keep Your Information?

We keep your information for as long as we need to in order to educate and look after you.  We will keep some information after you have left us e.g. so that we can find out what happened if you make a complaint.

In exceptional circumstances we may keep your information for a longer time than usual, but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.

We can keep information about you for a long time or even indefinitely if we need this for historical, research or statistical purposes.  For example, if we consider the information might be useful if someone wanted to write a book about the College. This table shows for how long we keep different types of information about you.

Type of information

Normal retention period or the criteria used to determine the retention period

Accidental and medical treatment records:

Date of birth plus 25 years.

Attendance records:

10 years from last entry and then 25 years from date of birth.

Exam results:

25 years from pupil leaving.

Pupil files e.g. reports, performance:

25 years from date of birth.

Safeguarding issues:


Educational Learning Needs records:

Date of birth plus up to 35 years.

UK Visa records:

25 years from date of birth.


25 years and then reviewed.

What decisions can you make about your information?

From May 2018 you will be able to make various decisions about your information.  Some of these are new rights whilst others build on existing ones.  Your rights are as follows:

  • If information is incorrect you can ask us to correct it.
  • You can also ask what information we hold about you and be provided with a copy. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.
  • You can ask us to delete the information that we hold about you in certain circumstances.  For example, where we no longer need the information.
  • You can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer.
  • Our use of information about you may be restricted in some cases.  For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.

Further information and guidance.

This Notice is to explain how we look after your personal information. If you have any questions of concerns, just ask your tutor to arrange a meeting with the Assistant Bursar. Alternatively, you can ask your parents to speak to us on your behalf if you prefer.

Please ask if you;

  • object to us using your information for marketing purposes e.g. to send you information about school events. We will stop using your information for marketing purposes if you tell us not to;
  • would like us to update the information we hold about you; or
  • you would prefer that certain information is kept confidential.

If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner's Office.