Privacy Notice



In accordance with the Data Protection Act 2018 and the General Data Protection Regulation individuals have the right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing privacy notices and this notice explains how we collect, store and use personal data about individuals at the school.


School Name: Cwmffrwdoer Primary School
Contact Details: Sarah Truelove
Privacy Notice Name: Cwmffrwdoer Privacy Notice


Data controller:

Headteacher:  Sarah Truelove

School Name: Cwmffrwdoer Primary School


  • Have we sourced your personal data, directly from you?

Data is collected from a variety of sources and these include the following:





Social Care

Families First

School Health

Torfaen County Borough Council



  • What information does the School collect about you?

The School collects and processes a range of information about you.


This includes

  • Personal identifiers and contacts (such as name, gender, date of birth, next of kin, unique pupil number, contact details, e-mail address and home address, school photograph, transport)
  • Characteristics (such as ethnicity, religion, language, free school meal eligibility and immigration status)
  • Safeguarding information (such as court orders, looked after children, young carers and professional involvement)
  • Special educational needs (including the needs and ranking)
  • Medical and administration (such as doctors information, child health, allergies, medication and dietary requirements)
  • Attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
  • Performance in internal and national assessments and examinations
  • Behavioural information (such as exclusions and any relevant alternative provision put in place)
  • School History



  • The School may collect this information in a variety of ways:


  • Verbally, electronically, via paper systems, 3rd parties
  • Pupils/families directly, (e.g. via registration forms at the start of the school year, school trip applications, etc.)
  • Social Services Directorate (if applicable)
  • Torfaen County Borough Council Education Directorate
  • This information has been shared with the school by a previous school attended by the pupil



We will store your data:



Paper Based


  • Why does the School process your personal data?


We process personal information about pupils and their families:

  • to support pupil learning
  • to monitor and report on pupil progress
  • to provide appropriate pastoral care
  • to assess the quality of our services
  • to keep children safe (food allergies, or emergency contact details)
  • to meet the statutory duties placed upon us for Welsh Government data collections
  • to administer trips and activities, catering and free school meal management


  • Special categories of personal data:

Race, ethnic origin, religion, general data, sexual orientation, social care records


We can process this category of data because:  


For the processing of personal data to be lawful, an Article 6 condition from the General Data Protection Regulation is required.  Mandatory school processing of pupil information is covered by the Article 6 condition – processing is necessary for compliance with a legal obligation to which the controller is subject and is contained within the Education Act 1996 and associated Welsh Government regulations.

Optional processing of personal data is covered by the Article 6 condition – explicit consent. If this is the case, you have the right to withdraw consent. Please contact the school for further information.

Data Protection legislation provides extra protection for certain classes of information called ‘special category’ personal data, which includes:

  • Physical or mental health or condition
  • Politics
  • Racial or ethnic origin
  • Religion or other beliefs of a similar nature
  • Sex life
  • Sexual orientation
  • Biometrics (where used for identification purposes)


  • Who has access to your data?

Internally with schools departments

Torfaen Council Departments

Educational establishments

Education Achievement Service (EAS)

Welsh Government Health Services

English Government Health Services

Health Authority for Health Care Programmes

 Police Services Ambulance Services

 Social Care

 Families First

Careers Wales

John Muir Project


Photography Companies

NRS Cashless Catering – biometerics (where used for identification purposes only) not all schools

 The school shares your data with third parties because – it is necessary to fulfil the obligations of the controller and data subject

Is the Data transferred out of the EEA?


  • How does the School protect data?

We have, and are developing further, internal policies to ensure the data it processes is not lost, accidentally destroyed, misused or disclosed. It is stored securely in paper form or if electronically will be password protected.  Furthermore data is not accessed by employees except in the performance of their duties.

Where the school engages third parties to process personal data on its behalf, they do so on the basis of written instructions. These third parties are also under a duty of confidentiality and are obliged to implement appropriate measures to ensure the security of data.


  • How long does the School keep your data?


The school will hold your personal data only for the period that is necessary and will follow organisational and Local Authority standards in this area.

We will keep your information in line with the school retention schedules

Pupil Records – until the pupil reaches the age of 25 years old

Google Classroom – 1 year following pupil’s departure

NRS Cashless Catering – until the pupil’s departure

Class charts – until the pupil’s departure

My Concern – until the pupil reaches the age of 25 years old

Evolve – 10 Years

CCTV – 14 Days



  • Are we making automated decisions/profiling with your data?



Your rights

You have a number of rights you can exercise:

  • access and obtain a copy of your data on request
  • require the Council to change incorrect or incomplete data
  • under certain circumstances you can require the Council to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
  • to know the period of time that the data will be stored for
  • the right to data portability
  • the right to withdraw your consent at any time
  • the right to lodge a complaint with a supervisory authority (Information Commissioners Office)
  • the consequences of if you fail to provide data to the Council
  • the existence of and automated decision-making, including profiling and the consequences of this for you.

If you would like to exercise any of these rights, please contact the Headteacher in writing who will respond within one calendar month.