Devon County Council (DCC) is collecting and/or processing your personal data as a Data Controller under as UK General Data Protection Regulations and our ICO registration number is Z6475582.

This privacy notice concerns the processing of personal data that takes place when DCC is buying alternative education provision services for children and young people.

Alternative education provision is defined by the Department for Education as education arranged by local authorities for pupils who, because of exclusion, illness or other reasons would not otherwise receive suitable education; education arranged by schools on a fixed period exclusion; and pupils being directed by schools to off-site provision to improve their behaviour.

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

We will notify you of any changes to this privacy notice

This privacy notice was last updated 21 May 2024. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current data protection legislation. Any queries relating to this privacy notice please contact the Data Protection Officer.

What information are we collecting or processing?

We may collect, store or otherwise process information about you which may include:

Details of your organisation. For example, name, trading status, registration details.
Insurance certificates and types of insurance held.
The kinds of checks and processes in place within the organisation. For example, for staff, vehicle use, to ensure fire safety and health and safety within your organisation.
Copies of your policies, and practices.
Information about your staffing team, including those working directly and/ or indirectly with children and young people. For example, training that has been supported and provided and qualifications they may hold.
Information about individual children and young people you are supporting for Devon County Council. For example, individual records held, the hours they are accessing, provision available and progress and/ or outcomes being achieved.
How you are currently working with the Council including how you receive payment for services.

Purpose of collecting or processing your personal data

DCC may need to collect or otherwise process your personal data so that we can:

Respond to our statutory duties ensuring children and young people are safe and their welfare is being protected.
Ensure our children and young people are receiving services which are supporting their identified needs.
Ensure our children and young people are receiving services which are enabling them to continue to learn and achieve outcomes.
Use any feedback received to also shape and support our approach for the future as part of our wider improvement and development within Children’s Services.

The legal basis for us collecting your personal data

Section 19 of the Education Act 1996 creates a legal duty on Local Education Authorities to make arrangements for provision of suitable education at school or otherwise than at school for those children of compulsory school age who, by reason of illness, exclusion from school or otherwise, may not for any period receive suitable education unless such arrangements are made for them.

DCC considers that the personal data processing outlined within this privacy notice, is necessary for the discharge of this statutory duty. On this basis, we contend that the processing is lawful on the grounds that Article 6(1)(e) of the UK General Data Protection Regulation (GDPR) applies.

The processing of any special category data that is necessary under this privacy notice, is also lawful on the basis of Article 9(2)(g) of the UK GDPR.

Recipients or categories of recipients that we may share your personal data with

When processing your personal data, it may be necessary for us to share personal data with third-party organisations such as:

The child’s parent or the young person.
Other professionals, where for example safeguarding concerns are raised.
Devon NHS Integrated Care Board (ICB).

If we feel that it is necessary to share your personal data with professionals to ensure you or someone you work with is safeguarded from harm, we rely upon the provisions of the Safeguarding Vulnerable Groups Act 2006 and Children Act 1989 & 2004. Where it is necessary to share medical or social care information for these purposes, we rely upon article 9(2)(h) of the General Data Protection Regulation (information necessary for medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems).

We may also need to share some personal data about you, so that we can support third party organisations to discharge their regulatory requirements. This includes organisations such as:-

The data protection regulator (the Information Commissioner’s Office)
The Care Quality Commission
Ofsted
The Department for Education.

We may also share information to enable us to comply with court orders and other legal obligations. If this is necessary, we will only share the minimum amount of personal data needed for this purpose.

International transfers

The data collected will not be subject to International Transfer.

How long will we hold your personal data?

Devon County Council will retain your personal data for the purposes outlined in this privacy notice for no longer than is necessary and in accordance with our corporate retention schedule.

Your data protection rights

Under Data Protection Legislation, you have the right to obtain a copy of their personal records held by us, this is called a Subject Access Request (SAR).

Details of how to make a request can be found here.

Further details on your rights under data protection legislation and how to exercise them, are available here.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our
Data Protection Officer.

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the Data Protection Regulations.
Contact details are below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email: casework@ico.org.uk

Automated decisions

The intended processing of personal data will not make use of technology that will make decisions about any individuals by automated means.