Privacy Notice

How we use student information 

Hailsham Community College, Academy Trust processes personal information about its students and is a ‘data controller’ for the purposes of Data Protection legislation. We collect information from you and may receive information about you from your previous school and the Learning Records Service. If you are enrolling for post-14 qualifications, the Learning Records Service will give us your unique learner number (ULN) and may also give us details of any learning you have done in the past or any qualifications you have.  

The categories of student information that we collect, hold and share includes, but is not restricted to: 

  • Personal information (such as name, unique student number and address) 
  • Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility) 
  • Attendance information (such as sessions attended, number of absences and absence reasons) 
  • Where applicable medical information, including physical and mental health, behavioural and SEN information 
  • Individual photographs and CCTV images captured in school  
  • Assessment information 
  • Post 16 learning information 

We may also hold data about students that we have received from other organisations, including other schools, local authorities, and the Department for Education 

Why we collect and use this information 

We use the student data: 

  • to support student learning 
  • to monitor and report on student progress 
  • to provide pastoral care 
  • to keep children safe (food allergies, or emergency contact details) 
  • to assess the quality of our services 
  • to safeguard students 
  • administer admissions waiting lists and appeals  
  • to meet the statutory duties placed upon us 

The lawful basis on which we use this information 

Under the General Data Protection Regulation (GDPR), the school is required to identify a valid lawful basis for each processing activity involving personal data. We only collect and use students’ personal data when the law allows us to. Most commonly, we process it where:  

  • We need to comply with a legal obligation 
  • Where we need to perform official tasks in the public interest  

Less commonly, we may also process students’ personal data in situations where:  

  • We have obtained consent to use it in a certain way 
  • We need to protect the individual’s vital interests (or someone else’s interests)  

As a school, we also collect and use special category data, both to provide education and comply with our legal obligations. We have therefore identified additional lawful bases from 

Article 9 of the GDPR. Most commonly, we process special category data where: 

  • We have gained explicit consent for the processing. 
  • Processing is necessary for reasons of substantial public interest. 

Where we have asked for consent to use student data you can withdraw consent at any time by emailing 

Some of the reasons listed above for collecting and using students’ personal data overlap, and there may be several grounds which justify our use of this data.  

How we collect student information 

We collect student information via registration forms at the start of the school year, Common Transfer File (CTF) or secure file transfer from previous school. 

Student data is essential for the schools’ operational use. Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain student information to us or if you have a choice in this. 

Storing Student data 

We hold personal information about students while they are attending our college. We may also keep it beyond their attendance at our college if this is necessary to comply with our legal obligations 

We hold student data for 25 years from date of birth, in line with our Retention Policy 

Who we share student information with 

We do not share information about students with any third party without consent unless the law and our policies allow us to do so.  

Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about students with: 

  • schools that the student’s attend after leaving us 
  • our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and exclusions 
  • the Department for Education (DfE)  
  • school communication services (e.g. ParentPay, Edulink, MyConcern) 
  • data systems (e.g. CAPITA SIMS, FFT Aspire, ALPS and UCAS Progress) 
  • catering (Edwards and Ward Ltd) 
  • where applicable, school health authorities, Social Services, police, courts, and tribunals  
  • our regulator Ofsted 
  • educators and examining bodies  
  • professional advisers and consultants  
  • online educational services (e.g. Mathswatch, Doddle, Firefly) 
  • cloud based systems (e.g. Microsoft – Office 365) 

Why we share student information 

We do not share information about our students with anyone without consent unless the law and our policies allow us to do so. 

We share students’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring. 

We are required to share information about our students with the (DfE) under regulation 5 of The Education (Information About Individual Students) (England) Regulations 2013. 

All data is transferred securely and held by DfE under a combination of software and hardware controls, which meet the current government security policy framework. 

For more information, please see ‘How government uses your data’ section. 

Youth support services 

Students aged 13+  

Once our students reach the age of 13, we also pass student information to our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19-year olds under section 507B of the Education Act 1996.  

This enables them to provide services as follows: 

  • youth support services 
  • careers advisers 

A parent or carer can ask that only their child’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the child / student once he/she reaches the age 16.  

Data is securely transferred to the youth support service via encrypted email and is stored 

securely and held for the agreed retention period. 

Students aged 16+  

We will also share certain information about students aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996. 

This enables them to provide services as follows:  

  • post-16 education and training providers 
  • youth support services 
  • careers advisers 

Data is securely transferred to the youth support service via encrypted email and is stored 

securely and held for the agreed retention period. 

For more information about services for young people, please visit our local authority website.  

Requesting access to your personal data 

Under data protection legislation, parents and students have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact  

You also have the right to: 

  • ask us for access to information about you that we hold. 
  • have your personal data rectified, if it is inaccurate or incomplete. 
  • request the deletion or removal of personal data where there is no compelling reason for its continued processing. 
  • request we restrict the processing of your personal data (i.e. permitting its storage but no further processing). 
  • object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics. 
  • not be subject to decisions based purely on automated processing where it produces legal or similarly significant effect on you. 

If you have a concern about the way we are collecting or using your personal data, we ask that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at 

For further information on how to request access to personal information held centrally by DfE, please see the ‘How Government uses your data’ section. 

Withdrawal of consent and the right to lodge a complaint  

Where we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, we ask that you raise your concern with us in the first instance ( Alternatively, you can contact the Information Commissioner’s Office. 

  • Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

Last updated 

We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This version was last updated on 19 February 2020 

Data Protection Officer  

Roger Simmons;; mobile 07704 838 512 

However, please contact the school in the first instance if you have a query about this privacy notice or how your information is used, by emailing: 

The National Student Database (NPD (National Pupil Database)) 

Much of the data about students in England goes on to be held in the National Student Database (NPD). 

The NPD is owned and managed by the Department for Education and holds information about students in schools in England. It supplies invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department.  

It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.  

We are required by law, to provide information about our students to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Students) (England) Regulations 2013. 

To find out more about the NPD, go to

Sharing by the Department 

The law allows the Department to share information about our students from the NPD with certain third parties, including: 

  • schools and local authorities 
  • researchers 
  • organisations connected with promoting the education or wellbeing of children in England 
  • other government departments and agencies 
  • organisations fighting or identifying crime 

For more information about the department’s NPD data sharing process, please visit:  

Organisations fighting or identifying crime may use their legal powers to contact DfE to request access to individual level information relevant to detecting that crime. Whilst numbers fluctuate slightly over time, DfE typically supplies data on around 600 students per year to the Home Office and roughly 1 per year to the Police. 

For information about which organisations the department has provided student information, (and for which project) or to access a monthly breakdown of data share volumes with home Office and the Police please visit the following website 

How Government uses your data 

The student data that we lawfully share with the DfE through data collections: 

  • underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school. 
  • informs ‘short term’ education policy monitoring and school accountability and intervention (for example, school GCSE results or Student Progress measures). 
  • supports ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school) 

Data collection requirements 

To find out more about the data collection requirements placed on us by the Department for Education (for example, via the school census) go to