Devon County Council (DCC) is collecting and or processing your personal data as a data controller under Data Protection Legislation and our Information Commissioner’s Office (ICO) registration number is Z6475582. This privacy notice concerns the processing of personal data that takes place by the Learner Services department within the Education Service.

Overview

DCC is committed to protecting your personal data in accordance with our responsibilities under data protection laws. This privacy notice explains how your personal data is processed and used by DCC, and for what purposes it is held.

DCC is responsible for the delivery of education support and improvement service. We work with academies, schools and settings, and other local authorities and with a range of regional and national bodies. We provide a single integrated service; this enables us to understand more fully the needs of customers and to deliver the best services to meet those needs in a coherent way.

This privacy notice tells you what to expect when DCC collects personal data. It applies to information we collect about:

Visitors to our website

We collect information about you on our website using forms, which could include:

personal data (such as title, full name, email, job title, local authority, telephone)
school information, such as establishment, registration code)

In these circumstances, we will inform individuals what we will use this information for, who it will be shared with and how long we will keep it. This information will feature on the web form being used to collect the information.

When someone visits our website we collect certain information about these visitors, such as IP addresses and details of the pages which these people have visited. This information does not allow us to identify individuals but helps us to ensure our website is structured in the most effective and user-friendly way.

Use of cookies

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

We use the cookies below as part of the operation of this website. You can read more about how we use cookies on our cookies page.

Links to other websites

Our website contains links to external websites. This privacy policy only applies to our website and services. If you use the links to visit external websites we encourage you to read their privacy notices.

Shop

When you register for an account on our shop we will collect:

personal data (such as title, full name, email address, job title, phone number)
school information, such as establishment name, postcode, roll numbers)

Your information will be used:

for administration and operational support for our eStore, website and eShop.
for billing information for invoicing of services
for administration, operational support and delivery of our products and services
to monitor and report on contract delivery progress
for marketing products and services that may be of interest to you and updates on our products and services including our Annual Service Level Agreement (SLA) Directory
to maintain the accuracy of information during the duration of the contract

This information may be shared with relevant internal teams including our Finance Team. It will not be shared externally. We will process your data as part of our contract with you and will store your details as part of our records. If you wish to close your account or remove your personal data or both, please contact us at educationsales@devon.gov.uk.

When you make a purchase from our online shop we will collect your personal data to fulfil your order. The information we collect includes:

personal data – title, full name, email address, phone number, school role
establishment information – school name, school address, postcode, Department for Education (DfE) number

If you choose to pay using a credit card we will also collect financial information such as the cardholder’s name, card type, card number, expiry date, and verification code.

We will use the information you provide to deliver the products you contract us to provide by ordering from the online shop. We will share relevant information with authorised internal teams, such as Finance. We will store the information for six years as part of our financial records. Your information will be used:

to administer the booking process of any courses you wish to attend
to provide you with information or services which you request from us or which we feel are of interest to you (where you have agreed to this)

We use a third party, Education Company, to supply and support our shop online service. We will not share your data with anyone else. We process your data as part of a contract with you.

Musical instrument hire

When you hire an instrument, we will collect personal data which could include:

personal data for the hire agreement – name, address, telephone number, email address
pupil information – pupil name, school, eligibility for free school meals or pupil premium

We will use these details as part of your contract with us and:

to set up the hire agreement
to arrange for the instrument to be prepared
to record your information on our database
for invoicing and other administrative purposes

We will store these details for as long as you have an instrument on hire, plus a further 12 months. Financial records will be stored for six years.

Learner Support services

Our Learner Support services include the following teams:

Children Missing Education.
Educational Psychology.
Elective Home Education.
Education Welfare.
Special Educational Needs and Disabilities.
Ethnic Minority Achievement.
Gypsy Roma and Traveller Achievement.

When we receive a request for support from these teams, we will collect information which could include the below categories:

Referrer personal data:

Name.
Position.
Educational setting.
Address.
Telephone number.
Email address.

Pupil personal data:

Name.
Home address.
Gender.
Date of birth.
Educational setting family details – parent or carer names and contact details, sibling names.

We may also collect some sensitive information about the pupil, including:

medical or health information
SEN requirements
information from other caseworkers involved with the pupil, such as assessments, reports, care plans, and risk assessments
ethnicity

We collect and use this information under the performance of a contract to enable us to:

carry out our obligations as part of a contract between us and the educational setting or LA.
support the pupil’s education
provide advice and support to the educational setting
provide reports and resources
monitor progress

We routinely share information with relevant services and organisations that are involved with the pupil, such as:

the local authority
schools and other education settings
health or medical professionals
Child and Adolescent Mental Health Services (CAMHS)
occupational therapists
portage
social care
advisory teachers
inclusion officers
careers advisers

We will store pupil files containing all information relevant to our involvement with them until the pupil reaches the age of 31, as per statutory guidelines.

Access to SEND support specialist advisory teams – Request for Access form

The information provided on this form will be used for purposes relating to the referral to the Special Educational Needs, Disability and Inclusion Advisory Service and may be shared with relevant services and organisations. It will not be processed or shared for any unrelated purpose. Where you are completing personal data for another individual, please provide that person with access to our privacy notice.

Child performance or exemption licences

We provide child performance or exemption licensing as a service, which forms part of our legal obligations. When you apply for a child performance or exemption licence for your event, we may collect personal data from the following categories:

Personal data (of the responsible person): Name, address, email address, telephone number.
Child information may include but is not limited to name, address, date of birth, email address, parent or carer details, and medical information.

The information will be used for:

safeguarding the wellbeing of the children performing
issuing the appropriate licence
updating our database

The information will be stored for a period of six months following the last date of performance.

Chaperone licences

We provide chaperone licensing as a service, which forms part of our legal obligations.

When you apply for a chaperone licence, the application form you complete will include the following categories of data:

Personal data: (such as title, full name, email, telephone number, address). You will also be required to apply for a Disclosure and Barring Service (DBS) check as part of the application and we will ask to see a copy of the certificate when you receive it.

We will use the information you supply to:

assess your suitability as a chaperone
perform admin functions in relation to your application
create your licence
update our database

Once created, your licence will be valid for a period of three years. Your details will be held by DCC for no longer than six months after the performance has taken place.

Child work permits

We issue child work permits. When you apply for a child work permit, we will collect the following categories of information:

Business information: Business name, address, email address, telephone number, along with name and job title of the person making the application.
Child information: Name, address, telephone number, date of birth, school, job title, hours to be worked, parent or carer name.

The information will be used to:

assess the suitability of workplace or position.
issue of work permit
update our database

We will store these details for a period of three years from the date of the permit being issued.

DfE UASC Project Carer Helpline

The DfE Unaccompanied asylum seeking children (UASC) Project Carer Helpline involves the Educational Psychology Team.

When we receive a request for support from this team, we will collect information which could include the below categories:

Referrer personal data:

Name of caller.
Position.
Name of social worker (if different).
Nature of concern.
Email address (if the query is received via the mailbox).

Pupil personal data:

Child or young person’s name (if disclosed).

We may also collect some sensitive information about the pupil, including, for example, SEN requirements.

We collect and use this information under the performance of a contract to enable us to provide advice and support to you.

We may share information with relevant services and organisations that are involved with the pupil, such as:

social care services
education service providers

Ethnic Minority and Traveller Achievement Service (EMTAS)

Some of our bilingual support teachers are employed through our local interpreter agency (Multilingua) so that we can cover the range of languages needed. These teachers are used to provide short-term induction support and report back directly to EMTAS.

School Governance Services

When you apply to become a school governor or clerk, we will collect the following information:

Personal data: Name, home address, email address, phone number, category of governor.
Establishment information: School name, school address.

This information will be stored on the DCC ONE database to maintain records of governors and clerks. The Governance Services Team will store information for the duration you are in post, and for the 12 months following, after which it will be deleted.

Limited contact information may be shared with teams including Finance, HR and the Head of Education and Learning. It will not be shared externally.

Outdoor Learning Services

When you book a trip to one of our outdoor learning centres, we will collect information to set up the agreement which may include the following:

Establishment details: Name and address, full name of visit leader, phone number, email address.

We may also collect personal data of any adults or children who will be participating in events during their visit (where applicable) for statutory reasons. This could include name, address, phone number, next of kin, and medical information.

This information will be stored for six years following the visit to comply with relevant legislation.

Newly Qualified Teacher (NQT) Services

During an NQT induction period at a school that operates as their appropriate body, there is a statutory requirement for the NQT, NQT mentor or tutor and headteacher to be registered with us through our online provider NQT Manager who are legally obliged to hold these records.

As part of this service we will collect:

NQT personal data – name, email address, date of birth, school, Teacher Reference Number (TRN) and performance assessments
tutor personal data – name, email address and school
headteacher name, email address and school

We will use this information to:

maintain our database of NQTs
record NQT details on the DfE secure portal
maintain records as specified by the DfE as the NQT appropriate body

We will share this information with the DfE as per the statutory guidance for the process. The information will not be shared or processed for any other purpose.

The information will be kept for six years following the completion of the NQT year as is required by the DfE. Following this period it will be securely disposed of.

In accordance with DCC’s data protection requirements please find a link to the NQT Manager privacy statement in addition to this privacy statement.

GDPR Data Protection Service

As part of our outsourced Data Protection Officer Service or help desk service, we only handle personal data upon written instructions from the data controller and any collection or use of that information, is limited to the purpose of providing the service to our customer.

We do not share your data with other organisations, unless required to do so for contractual, regulatory or law enforcement purposes.

Headteacher recruitment

We manage the process of headteacher recruitment for maintained schools in Devon. When you apply for a headteacher position, we will collect a number of categories of data from you including:

Personal data: name, address, date of birth, address, email address, telephone numbers, NI number, qualifications, DfE teacher reference number, union and professional association membership.
Employment information: current and previous roles held, salary.
Diversity information: disability information, ethnic group.

We will also collect details of any convictions, cautions or formal warnings as part of our safer recruitment process.

The information we collect will be used for:

updating our records and database
selection of candidates for shortlisting
inviting candidates for interview
arranging employment contract (successful candidates only)

Your information will be shared with relevant stakeholders, which could include:

the school governing body
the interview panel
DCC Human Resources (HR ONE)
school improvement officers and advisers
DCC Head of Education and Learning or representatives or both

We will retain your details for the following periods:

Appointed candidates: for the duration of serving post, plus an additional six years.
Unsuccessful candidates: for 12 months following the end of the recruitment process.

Schools data collection

DCC performs a statutory data collection on an annual basis. The data we collect from schools may include the following:

Pupil information: Full name, date of birth, postcode, school attended, unique pupil number, gender, results.

The purpose of collecting this data is to:

comply with statutory requirements
compile performance statistics for school tables

The information will be:

shared with the DfE
uploaded to Nexus online portal
returned to school to check it matches with their expectations

We will retain your personal data for only as long as it necessary and in line with our organisation’s record retention schedules.

Schools moderation

DCC performs school moderation on 25% of maintained schools and 25% of academies annually. As part of this process, we will collect information from schools relating to each class, which may include:

Pupil information: Full name, date of birth, postcode, school attended, unique pupil number, gender, results.

We will use identified pupil information:

to comply with statutory requirements
to ensure appropriate assessment levels are used
in the creation of moderation school visit notes

The information may be:

shared with the Standards and Testing Agency (sponsored by the Department for Education).
returned to school (as a pseudonymised visit report)

We will retain your personal data for only as long as it necessary and in line with our organisation’s record retention schedules.

School statistical data

To fulfil our reporting obligations DCC may collect personal data from a number of agencies including:

other local education authorities
the DfE – national pupil database

The information we collect could include the below categories:

Personal data: Full name, date of birth, postcode, school attended, unique pupil number, gender, results.

In addition, the following sensitive information may also be collected: SEN requirements, religion, ethnicity, financially related information, such as eligibility for free school meals or pupil premium.

We will use this information to:

provide statistical data reports on school or pupil performance
update DCC’s education database

We will retain your personal data for only as long as it necessary and in line with our organisation’s record retention schedules.

Schools Library Service

When you request a service from our Schools Library Team (either as part of a subscription or as a non-subscriber) we will collect some personal data relating to your request which could include:

personal data – name, email address and telephone number
establishment information – school name, county and local authority

The information collected will be used as part of our contract with you to:

provide you with the requested service, for example, topic box, book exchange
record any loans or returns on our library management database

We will store your details for as long as you have items on loan from us.

Survey data

We may invite you to take part in surveys to provide us with feedback on our services, event planning or other subjects. We use a third-party service (SmartSurvey) for our survey functionality. SmartSurvey is a UK-based company that has been carefully selected and is fully compliant with all relevant data protection legislation.

Depending on the survey presented, we may ask you to provide personal data which could include but is not limited to:

name
job title
establishment
email address
telephone number

When we collect this information it could be used to:

record your preferences relating to an event (where relevant)
contact you relating to your comments (if appropriate)
identify trends or statistics
review and improve the performance of our events or services
collect information as part of a statutory audit that DCC is required to undertake

We may share the data with:

third parties involved with an event, such as venues or catering services (where appropriate)
relevant teams or services internal to DCC

We will not share or process your information for any other purposes. We will delete all personal data no later than two years from the closing date of the survey.

Marketing

What information do we collect and where does it come from?

We collect:

personal data (such as title, full name, email, job title, local authority, telephone)
school information (such as establishment, registration code)

when you:

register on our website
subscribe to our newsletters
complete an online form or opt in to receive marketing information or both
provide information using paper forms when you visit our exhibition stands at
events

We also collect information when you voluntarily complete customer surveys, provide feedback and participate in any competitions we promote.

Occasionally we buy marketing information from legitimate list brokers who collect school contact information from school websites made public.

How do we use your data?

We use personal data to:

keep you updated and send you information about our existing and new services
give you access to web content
send emails to individuals or schools with whom we want to develop or maintain a business relationship in accordance with applicable marketing laws

We will not process personal data for any further processing other than the purpose it was obtained for. We want to communicate with you in a way that meets your needs and requests. Depending on the preferences you have already expressed, we might communicate with you by post, telephone, email or text.

Where you have consented to receive marketing materials, we will send you information about products and services which may be of interest to you and updates on our products and services including our Annual Service Level Agreement (SLA) Directory.

If you have consented to receive marketing, you can opt out or update your preferences at any time using the unsubscribe or update your preferences link on the marketing email.

Who do we share your information with?

Newzapp – our email broadcast provider that enables us to send high-quality bulk emails to subscribers – information shared includes the name of recipient, job title and email address.
Design or print and fulfilment suppliers who act on our behalf to print and send out hard copying direct mailings to customers or subscribers such as service directories and new product flyers. The company used is Pollards Print, Exeter, who are a procurement-approved supplier. Information shared includes the name of recipient, job title, school name and full postal address.

How long do we keep your data?

We will keep it permanently unless you ask us not to. If you wish to be removed from any or all of our email newsletter mailing lists you can unsubscribe using the link at the bottom of the email or by contacting us at educationsales@devon.gov.uk.

Information security

DCC takes information safety seriously and as such we ensure your data is stored and processed using appropriate technical and organisational methods to ensure we comply with all relevant data protection legislation.

Where we share data with external parties, all transfers of data are completed using secure methods to mitigate against the risk of any data being accessed by unauthorised persons.

Any third-party suppliers are carefully checked to ensure they have appropriate security measures in place before we share or store any data with them.

Who else do we share your information with?

In addition to any specific information provided at the point of data collection or elsewhere in this notice, we may disclose your personal data to others in the following circumstances or for the following purposes or both:

Where we are required to do so by the courts or to comply with other legal, statutory or regulatory obligations or both including accounting and taxation requirements.
To prevent and/or detect crime.
For audit and debt collection.
For credit reference purposes (where applicable).

Your rights

Under data protection legislation you have the right to request access to information we hold about you.

Under Data Protection Legislation, you have the right to obtain a copy of their personal records held by us, this is called a subject access request (SAR).

Details of how to make a SAR can be found here.

Further details on your rights under data protection legislation and how to exercise them.

DCC will never sell your data. We will also never share your data with anyone to use for their own purposes unless disclosure is permitted or required by law.

Any breach of Data Protection Legislation will be reported to the DCC Data Protection Officer in accordance with the Council’s data protection policy.

Changes to policy

This privacy notice was updated in July 2022 and we will publish any changes we make to it.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the Data Protection Regulations. Contact details are below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email casework@ico.org.uk

Automated decisions

DCC will not make automated decisions about you or your family as part of any of the services listed in this privacy notice.