Employee Privacy Notice

  This privacy notice has been written to inform prospective, current, and former employees of Lythe School about how and why we process their personal data.

Who are we?

Lythe School is a ‘Data Controller’ as defined by Article 4 (7) of GDPR. This means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation.

Employees of voluntary controlled and community schools are considered to be employees of the local authority and therefore both the School and North Yorkshire County Council are considered to be joint data controllers in regards to employee data.

The school has appointed Veritau Ltd to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the school is compliant with GDPR and to oversee data protection procedures. Veritau’s contact details are:

Information Governance     

Veritau Ltd

County Hall

Racecourse Lane

Northallerton

DL7 8AL

 schoolsDPO@veritau.co.uk

01609 53 2526  

What information do we collect and why do we need it?

The School and the Local Authority require your personal information, and sometimes your special category data, in order to fulfil requirements set out in both your employment contract and by employment legislation.

To find out more about what information we collect, why we collect it, and what our lawful basis is then please see the Employment Privacy Notices on the Local Authority’s website:

Delete/Add as appropriate

North Yorkshire County Council  

City of York Council

East Riding of Yorkshire County Council

Hartlepool Borough Council

Redcar and Cleveland Borough Council

Doncaster Council

Cumbria County Council

Newcastle Council

Photographs

We will seek your consent to use your photo on our website. Please note that you can withdraw this consent at any time.

Who has access to your personal data in the School?

Your information will only be made available to those who need it to do their job in relation to your employment. This includes your line manager(s), the business manager, and relevant administrative staff.

Please see the Council Privacy Notices to see who in the Council has access to your personal data.

Your name, job title, work email address, telephone number and photograph will be available in your personnel file and on SIMS, which are accessible to the Head Teacher and the school Secretary.

Who do we share your personal data with?

Please see the Council employee privacy notices to find out more about who the School and Council may share your data with.

We have duties under the Freedom of Information Act 2000 to disclose information we hold unless there is a very good reason to withhold it. Therefore we may disclose your name and work email address publicly in response to a request if we are required to do so.

The school also has a specific duty (section 537A of the Education Act 1996) to share your information with the Department of Education for the purpose of the annual school census.

How long do we keep your personal data for?

Lythe School will keep your data in line with our Information Policy. Most of the information we process about you will be determined by statutory obligations. Any personal information which we are not required by law to retain will only be kept for as long as is necessary to fulfil our organisational needs.

Do we transfer your data outside of the UK?

Generally the information that the school holds is all held within the UK. However, some information may be held on computer servers which are held outside of the UK. We will take all reasonable steps to ensure your data is not processed in a country that is not seen as ‘safe’ by the UK government. If we do need to send your data out of the European Economic Area it will ensure it has extra protection from loss or unauthorised access.

What rights do you have over your data?

Under GDPR, individuals have the following rights in relation to the processing of their personal data:

• to be informed about how we process your personal data. This notice fulfils this obligation
• to request access to your personal data that we hold, and be provided with a copy of it
• to request that your personal data is amended if inaccurate or incomplete
• to request that your personal data is erased where there is no compelling reason for its continued processing
• to request that the processing of your personal data is restricted
• to object to your personal data being processed

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO on the address provided above.

If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the school has handled your personal data. You can do so by contacting:

First Contact Team

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow Cheshire

SK9 5AF

casework@ico.org.uk  // 0303 123 1113