Privacy Notice

Shoreham College is a registered charity and company and our official name is Kennedy Independent School Trust Limited. Our registered charity number is 307045 and our company number is 875915. This Privacy Notice provides detailed information about how we process personal data and is intended to cover the activities of Shoreham College, the Old Shorehamers’ Association and the Parents’ Association. We may update this Privacy Notice from time to time, however any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable. If you have questions regarding your personal data or its use, please contact our Privacy Officer, Clare Doran, on This email address is being protected from spambots. You need JavaScript enabled to view it., by telephone on 01273 592681 or by post at Shoreham College, St Julian’s Lane, Shoreham-by-Sea, West Sussex, BN43 6YW.

This Privacy Notice applies in addition to our terms and conditions and relevant policies, including:

any contract between the College and its staff or the parents of pupils;
the College’s policy on Taking, Storing and Using Images of Children and the CCTV policy;
the College’s safeguarding, pastoral or health and safety policies, including as to how concerns or incidents are recorded;
the College’s retention guidelines; and
the College’s IT policies, including its e-safety policy, data protection policy and mobile device policy.

Types of personal data we process

We process personal data about prospective, current and past pupils and their parents; staff, governors, suppliers and contractors; supporters and other individuals connected to or visiting the College. The types of data processed by the College may include:

names, date of birth, addresses, telephone numbers, e-mail addresses and other contact details;
car details (about those who use our car parking facilities);
bank details and other financial information e.g. about parents (or others) who pay fees to the College, and any anti-money laundering information we are required to collect by law;
past, present and prospective pupils' academic, disciplinary, admissions and attendance records (including information about any special needs) as well as examination scripts and marks;
personnel files, in connection with academics, employment or safeguarding;
nationality and other immigration status information (e.g. right to work/study) including copies of passport information;
where appropriate, information about individuals' health and welfare and contact details for their next of kin;
references given or received by the College, and relevant information provided by previous educational establishments and/or other professionals or organisations working with pupils;
correspondence with and concerning staff, pupils and parents; past and present; and
images of pupils (and occasionally other individuals) engaging in College activities (in accordance with our Taking, Storing and Using Images of Children policy) and images captured by our CCTV system (in accordance with our CCTV policy).

Why we need to process personal data

In order to carry out our ordinary duties as an independent school, we need to process a wide range of personal data about individuals as part of daily operations. Some of this activity we will need to carry out in order to fulfil our legal rights, duties or obligations, including those under a contract with our staff, or parents of our pupils. Other uses of personal data will be made in accordance with our legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals and provided it does not involve special or sensitive types of data. We expect that the following uses will fall within the category of ‘legitimate interests’:

the selection and admission of pupils, to confirm the identity of prospective pupils and their parents, and retain a record if appropriate for the purposes of future applications or openings;
the provision of education to pupils (including where such services are provided remotely) including the administration of the curriculum and timetable; the provision of online educational resources; monitoring pupil progress and special educational needs and reporting on the same internally and to parents; administration of pupils’ entries to public examinations and other assessments including MidYIS and GL Assessments; reporting upon and publishing the results or achievements of pupils at the College;
the provision of educational support and related services to pupils and parents, including the maintenance of discipline; provision of careers and library services; administration of sports fixtures and teams; extra-curricular activities such as school plays, musical education and educational visits;
the safeguarding of pupils’ welfare and provision of pastoral care, welfare and health care services by College staff;
to monitor (as appropriate) use of the College’s IT and communications systems in accordance with the College’s IT policies;
to maintain relationships with members of the Old Shorehamers’ Association, the Parents’ Association and the school community, including direct marketing or fundraising activity;
the promotion of the College through its own website, social media channels, the prospectus and other publications;
the provision and receipt of references for past, current and prospective pupils, including relating to outstanding fees or payment history to and from any educational institution that the pupil attended, or where it is proposed they attend; and to provide references to potential employers of past pupils;
compliance with legislation and regulation including the preparation of information for inspections by the ISI and JCQ, so they may monitor the College’s performance and intervene or assist with incidents as appropriate; and the submission of annual census information;
operational management including the administration of invoices, fees and accounts; the management of the College’s property, security and safety arrangements (including the use of CCTV); management planning and forecasting; research and statistical analysis; and the maintenance of historic archives;
staff administration including recruitment, payroll, pensions and sick leave; review and appraisal of staff performance; conduct of any grievance, capability or disciplinary procedures; the maintenance of appropriate personnel records for current and former staff; and the provision of references;
use of photographic images of pupils in College publications, including the prospectus, the College website and social media channels, in accordance with our Taking, Storing and Using Images of Children policy;
to carry out or cooperate with any complaints, disciplinary or investigation process; and to obtain appropriate professional advice and insurance for the College where reasonably necessary.

Special Category Personal Data

In addition, we will on occasion need to process special category personal data (concerning health, ethnicity, religion or sexual life) or criminal records information (when carrying out DBS checks) in accordance with rights and duties imposed by law, including as regards safeguarding and employment, or from time to time by explicit consent where required. These reasons will include:

To safeguard pupils’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency, incident or accident, including by disclosing details of an individual's medical condition or other relevant information where it is in the individual's interests to do so: for example for medical advice, for social protection, safeguarding, and cooperation with police or social services, for insurance purposes or to caterers or organisers of school trips who need to be made aware of dietary or medical needs;
To comply with public health requirements in respect of Covid-19 (or similar) testing: including managing on-site testing and/or processing the results of tests taken by pupils or other members of the school community, and sharing this information with relevant health authorities;
To provide educational services in the context of any special educational needs of a pupil;
In connection with employment of its staff e.g. DBS checks, welfare, union membership or pension plans;
As part of any school or external complaints, disciplinary or investigation process that involves such data, for example if there are SEND, health or safeguarding elements; or
For legal and regulatory purposes (for example child protection, diversity monitoring, health and safety and immigration/visa sponsorship compliance) and to comply with its legal obligations and duties of care.

Collecting, handling and sharing personal data

We collect most of the personal data we process directly from the individual (or in the case of pupils, from their parents). In some cases we collect data from third parties, for example previous schools, referees, the DBS, the local authority or other professionals or authorities working with an individual. For the most part, personal data collected by us will remain within the College and will be processed only by appropriate members of staff, for the purposes for which the data was provided.On occasion we will need to share personal information with third parties such as professional advisers (e.g. lawyers, insurers, PR advisers and accountants); relevant authorities (e.g. HMRC, Department for Education, CAFCASS, local authorities, relevant public health/NHS bodies, Department for Work and Pensions or the police); regulatory bodies (e.g. Exam Boards, DBS, National College for Teaching and Leadership, Teacher Regulation Agency, Independent Schools Inspectorate, Independent Schools Council and the Charity Commission), appropriate contractors, such as visiting music teachers and online educational and assessment providers and Stage 3 complaints panels, which will include independent panel members.

Particularly strict rules of access apply in the context of “special category” data, most notably medical records; and pastoral or safeguarding files.

Medical data: We need to process such information to comply with statutory duties and to keep pupils and others safe, but we will ensure only authorised staff can access information on a need-to-know basis. This may include wider dissemination if needed for school trips or for catering purposes. Express consent will be sought where appropriate. However, a certain amount of any SEND pupil’s relevant information will need to be provided to staff more widely in the context of providing the necessary care and education that the pupil requires.

Safeguarding data. Staff, pupils and parents are reminded that the school is under duties imposed by law and statutory guidance (including Keeping Children Safe in Education (KCSIE)) to record or report incidents and concerns that arise or are reported to it, in some cases regardless of whether they are proven, if they meet a certain threshold of seriousness in their nature or regularity. This is likely to include file notes on personnel or safeguarding files, low-level concerns records kept about adults, and in some cases referrals to relevant authorities such as the LADO or police. KCSIE also requires that, whenever a child leaves the school to join another school or college, his or her child protection file is promptly provided to the new organisation. The school will retain a copy in accordance with its retention policy for material related to safeguarding matters.

Some of our processing activity is carried out on our behalf by third parties, such as our IT systems, however this is always subject to contractual assurances that personal data will be kept securely and only in accordance with our specific directions. The College may transfer personal information outside the United Kingdom but only on the basis that the organisation receiving the information has provided assurances that adequate safeguards are in place.

How long we keep personal data

We retain personal data securely and only for a legitimate and lawful reason and only for as long as necessary or required by law. We have adopted records retention guidelines which set out the time period for which different categories of data are kept. If you have any specific queries about our record retention periods, or wish to request that your personal data is considered for erasure, please contact the Privacy Officer, Clare Doran, on This email address is being protected from spambots. You need JavaScript enabled to view it. or by post at Shoreham College, St Julian’s Lane, Shoreham-by-Sea, West Sussex, BN43 6YW. Please bear in mind that we will often have lawful and necessary reasons to hold onto some personal data, even following such a request. A limited and reasonable amount of information may also be kept for historical archiving purposes and even where you have requested that we no longer keep in touch with you, we will need to keep a record of the fact in order to fulfil your wishes.

Keeping in touch and supporting the school

We will use the contact details of parents and past pupils to keep them updated about the activities of the College, the Parent’s Association and the Old Shorehamers’ Association, which will include sending updates and newsletters by email and by post. These communications may also be sent in order to promote and raise funds for the College and, where appropriate, other worthy causes. Should you wish to limit or object to any such use, or would like further information, please contact the Privacy Officer, Clare Doran, on This email address is being protected from spambots. You need JavaScript enabled to view it. or by post at Shoreham College, St Julian’s Lane, Shoreham-by-sea, West Sussex, BN43 6YW.

Your rights

You have the following rights:

to obtain access to, and copies of, the personal data that we hold about you;
to require us to correct the personal data we hold about you if it is incorrect;
to require us (in certain circumstances) to erase your personal data;
to request that we restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller;
to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. The school will endeavour to respond to any such requests as soon as is reasonably practicable and in any event within statutory time-limits (which is generally one month, but actually fulfilling more complex or multiple requests, e.g. those involving third party information, may take 1-2 months longer). If you would like to access or amend your personal data, or would like it to be transferred to another person or organisation, or have some other objection to how your personal data is used, please put your request in writing to the Privacy Officer, Clare Doran,Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. The school will endeavour to respond to any such requests as soon as is reasonably practicable and in any event within statutory time-limits (which is generally one month, but actually fulfilling more complex or multiple requests, e.g. those involving third party information, may take 1-2 months longer). If you would like to access or amend your personal data, or would like it to be transferred to another person or organisation, or have some other objection to how your personal data is used, please put your request in writing to the Privacy Officer, Clare Doran,on This email address is being protected from spambots. You need JavaScript enabled to view it. or by post at Shoreham College, St Julian’s Lane, Shoreham-by-Sea, West Sussex, BN43 6YW.

You should be aware that UK-GDPR rights (including the right of access) are limited to your own personal data, and certain data is exempt. This will include information which identifies other individuals, or information which is subject to legal privilege (for example legal advice given to or sought by the school, or documents prepared in connection with a legal action, or where a duty of confidence is owed by a legal adviser). We are also not required to disclose any pupil examination scripts (or other information consisting solely of pupil test answers, potentially including mock exam scripts or other types of exams / tests used to assess performance – although markers’ comments may still be disclosable if they constitute pupil personal data). We are also not required to provide examination or other test marks ahead of their ordinary publication date, nor share any confidential reference held by the school that was (or will be) given for the purposes of the education, training, appointment or employment of any individual. These exemptions necessarily apply also in the context of teacher-assessed grades, where required in the absence of formal public examinations due to pandemic conditions.

Pupil data

The rights under data protection law belong to the individual to whom the data relates. However, in the case of pupils, we will often rely on parental consent to process personal data relating to pupils (if consent is required) unless, given the nature of the use of data in question and the pupil’s age, it is more appropriate to rely on the pupil’s consent. In general, we will assume that pupils’ consent is not required for ordinary disclosure of their personal data to their parents, in accordance with the parent contract and this Privacy Notice (e.g. for the purposes of keeping parents informed about the pupil’s activities, progress and behaviour and in the interests of the pupil’s welfare). That is unless, in our opinion, there is a good reason to do otherwise. However, where a pupil seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, we may be under an obligation to maintain confidentiality unless, in our opinion, there is a good reason to do otherwise; for example where the College believes disclosure will be in the best interests of the pupil or other pupils, or is required by law.

Pupils can make subject access requests for their own personal data, provided that, in the reasonable opinion of the College, they have sufficient maturity to understand the request they are making. This will depend on both the child and the personal data requested, including any relevant circumstances at home, however as a general rule those pupils aged 13 years and above will be deemed to have sufficient maturity. A person with parental responsibility will generally be entitled to make a subject access request on behalf of pupils, but the law still considers the information to be the child’s. A pupil of any age may ask a parent or other representative to make a subject access request on their behalf, however, for older pupils the parents making the request may need to evidence their child’s authority for the specific request. Requests not considered in the child’s best interests may sometimes be refused. It should be clearly understood that the rules on subject access are not the sole basis on which information requests are handled.

Parents may not have a statutory right to information, but they and others will often have a legitimate interest or expectation in receiving certain information about pupils without their consent. The school may consider there are lawful grounds for sharing with or without reference to that pupil. Parents will in general receive educational and pastoral updates about their children, in accordance with the Parent Contract. Where parents are separated, we will in most cases aim to provide the same information to each person with parental responsibility, but may need to factor in all the circumstances including the express wishes of the child, court orders, or pastoral issues.

Data Accuracy and Security

We will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must please notify the College on 01273 592681 or by email on This email address is being protected from spambots. You need JavaScript enabled to view it. of any significant changes to important information, such as your contact details. An individual has the right to request that any out-of-date, irrelevant or inaccurate information about them is erased or corrected (subject to certain exemptions and limitations under Data Protection Law): please see above for details of why the school may need to process your data and who you may contact if you disagree.

We will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to school systems. All staff and governors will be made aware of this policy and their duties under data protection law.

Complaints

If you believe that we have not complied with this Privacy Notice, or acted otherwise than in accordance with data protection law, then you should utilise the College’s Complaints Procedure which is available on the Shoreham College website. The complaint should be made directly to the Privacy Officer. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with the College before involving the regulator.

click here for an easy to print PDF version