Complaints Privacy Notice

 This Privacy Notice has been written to inform individuals who are contemplating making a complaint, are in the progress of making a complaint, or have previously made a complaint about what Lythe CEVC School does with your personal data as part of the school’s complaints process.

Who are we?

Lythe CEVC School is a ‘Data Controller’ as defined by Article 4 (7) of GDPR. This means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation.

The school has appointed Veritau Ltd to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the school is compliant with GDPR and to oversee data protection procedures. Veritau’s contact details are:

Schools Data Protection Officer

Veritau Ltd

County Hall

Racecourse Lane

Northallerton

DL7 8AL

schoolsDPO@veritau.co.uk

01609 53 2526

*Please ensure you include the name of the School in all correspondence with the DPO

 What information do we collect and why do we require it?

As school we are obliged to have a complaints procedure in place. As part of our complaints procedure we are required to process personal data. 

The personal data we collect about you includes:

• Personal identifiers (your name, address, contact details)
• Any relevant information we hold on School systems and databases,
• Any information you, or a party to the complaint, provides us with,
• Any information passed to us by any other organisation,
• Witness statements,
• Any relevant correspondence we have had with you or another party to the complaint – including internal correspondence about you,
• Any relevant video recording (including CCTV), audio recordings,  or images,
• Investigation interview notes.

Who do we obtain your information from?

Much of the information we process will be obtained directly from your complaint or from a complaint made by another individual. However, we may need to collect data about you from, but not necessarily limited to, the following organisations:

• Department of Education,
• The Local Authority,
• Our appointed Data Protection Officer
• Ofsted
• The Police and/or other Law Enforcement bodies
• Local Health and/or social care providers

Who do we share your personal data with?

According to our complaints procedure all complaints are handled by the Headteacher or Governors. However, Within the School we will disclose any relevant data to any individual (usually an employee or governor) that requires the data in order to complete the investigation, to administer the complaint, or to receive advice about how to handle a complaint.

The following organisations may also receive your data if allowed by law:

• Department of Education
• The Local Authority
• Our appointed Data Protection Officer
• Ofsted
• Information Commissioner’s Office
• Any other organisation and/or regulator when the School is legally required to disclose your information.

How long do we keep your personal data for?

Generally the school will keep personal data collected as part of the complaints process for six years upon closure of the complaint. This is to ensure that the School can demonstrate the complaint has been handled appropriately.

In some cases information gathered as part of a complaint investigation will need to be kept for longer than six years in accordance with various legislation. For example any complaints in relation to Looked after Children will be kept for 70 Years from closure of the file.

Do you transfer my data outside of the UK?

Generally the information that the school holds is all held within the UK. However, some information may be held on computer servers which are held outside of the UK. We will take all reasonable steps to ensure your data is not processed in a country that is not seen as ‘safe’ by the UK government. If we do need to send your data out of the EU it will ensure it has extra protection from loss or unauthorised access.

What is our lawful basis for processing your personal data?

The School is legally required to operate a relevant complaints procedure as per the

(Maintained Schools, VA Schools, VC Schools) Education Act 2002

As such the School relies on Article 6(1)(c) and Article 9(2)(g) of the GDPR to process your personal and special category data. This is in pursuance with Schedule 1, Part 2 (6)(2)(a) of the Data Protection Act 2018 – this means that the School can process your data as part of the official authority vested in us by the above legislation.

What rights do you have over your data?

Under GDPR, individuals have the following rights in relation to the processing of their personal data:

• to be informed about how we process your personal data. This notice fulfils this obligation
• to request access to your personal data that we hold, and be provided with a copy of it
• to request that your personal data is amended if inaccurate or incomplete
• to request that your personal data is erased where there is no compelling reason for its continued processing
• to request that the processing of your personal data is restricted
• to object to your personal data being processed

You can exercise any of these rights by contacting: Headteacher Mrs Lisa Armstrong

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO on the address provided above.

If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the school has handled your personal data. You can do so by contacting: