Privacy, TSAT Trust

Privacy

The Thinking Schools Academy Trust respects your rights to confidentiality and privacy and is committed to compliance with the General Data Protection Regulation. This notice explains what personal data (information) we hold, how we collect it, how we use it and how we may share information.

Who are we?

The Thinking Schools Academy Trust collects, uses and is responsible for certain personal information about you. When we do so we are regulated under the UK General Data Protection Regulation, and we are responsible as ‘controller’ of that personal information for the purposes of those laws.

The contact details for our Data Protection Officer are:

Mrs J Coates
Data Protection Officer
The Thinking Schools Academy Trust
c/o Holcombe Campus,
Park Crescent,
Chatham,
Kent,
ME4 6NR

Telephone: +44 333 360 2000

Email: privacy@tsatrust.org.uk

In some cases, your data will be outsourced to a third-party processor; however, this will only be done with your consent, unless we have another legal basis to share your data. Where we outsource your data to a third-party processor, the same data protection standards that The Thinking Schools Academy Trust upholds are imposed on the processor.

Why do we collect and use your information?

The Thinking Schools Academy Trust holds the legal right to collect and use personal data relating to pupils and their families, and we may also receive information regarding them from their previous school, LA and/or the DfE. We collect and use personal data in order to meet legal requirements and legitimate interests set out in the UK GDPR and UK law, including those in relation to the following:

Article 6 and Article 9 of the GDPR;
Children Act 1989;
Education Act 1996; and
Regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.

Information about an individual collected by The Thinking Schools Academy Trust will only be used for the purpose for which it is provided. Personal information collected by The Thinking Schools Academy Trust will be processed and stored securely by The Thinking Schools Academy Trust and will be kept to a minimum. Information will only be retained for as long as is necessary to provide the requested service, following which the information will be disposed of securely.

If we need to collect special category (sensitive) personal information, we rely upon reasons of substantial public interest (equality of opportunity or treatment). If there is processing or sharing that relies on your consent, we will make this clear to you and ensure we seek your consent.

For more information about our collection and processing of information, please read our Data Protection policy, available from https://www.tsatrust.org.uk/policies/

Filtering and Monitoring of IT Systems

In line with our legal duties under Keeping Children Safe in Education (KCSiE), the Trust uses filtering and monitoring systems on all devices and networks provided for pupil and staff use. These systems are in place to:

safeguard children and young people,
promote the safe use of technology,
detect and prevent access to harmful, inappropriate, or illegal material, and
protect the security and integrity of our IT systems.

This monitoring may record information such as websites visited, search terms, attempts to access blocked content, and activity on Trust devices or accounts. Where monitoring identifies behaviour that gives cause for concern, this information may be shared with designated safeguarding staff, school leaders, IT providers, or, where legally required, external agencies such as the police.

The lawful bases we rely on for this processing are legal obligation (our statutory safeguarding duties) and public task (carrying out tasks in the public interest). Monitoring data is retained only for as long as necessary for these purposes and handled securely in line with our data protection and retention policies.

The Trust may also process personal data on the basis of Recognised Legitimate Interests (RLIs). These RLIs provide a clear lawful ground for certain activities without requiring a separate balancing test. Examples include sharing information with public bodies where necessary for them to carry out their official functions; safeguarding and protecting children and vulnerable individuals; ensuring the security and integrity of our IT systems; and preventing or detecting crime. Where we rely on RLIs, we will only process the minimum data required for the purpose, and we will continue to respect your rights and freedoms under data protection law.

Use of Artificial Intelligence (AI)

We may use Artificial Intelligence (AI) tools and systems to support the delivery of our services and improve efficiency. These tools are used in line with data protection legislation and our internal governance and risk management processes. Where AI tools process personal data, this is done under the principles of fairness, transparency, and accountability, and only where a lawful basis applies. We do not use AI for automated decision-making that has legal or similarly significant effects on individuals.

Information on Pupils and Alumni

When a Pupil joins The Thinking Schools Academy Trust, we use personal information that we gather in relation to the Pupil for various purposes. Information that we hold in relation to the pupil is known as “personal data”. This will include data that we obtain from the pupil directly and data about the pupil which we obtain from other people and organisations. We might also need to continue to hold a pupil’s personal data for a period of time after they have left the school. Anything that we do with your personal data is known as “processing”.

The Trust adheres to the Age-Appropriate Design Code (also known as the Children’s Code) and the fifteen principles enshrined within it. More information on this can be found within our Data Protection Policy.

What information do we use about pupils?

Personal information (such as name, unique pupil number, addresses, Telephone and email contact details, Date of Birth, language, nationality, country of birth, photographs, video, and body worn camera images and free school meal eligibility).
Attendance information (such as sessions attended, number of absences and absence reasons).
Behavioural information (such as behaviour reports and exclusion information).
Assessment information (such as National curriculum assessment results).
Education details (such as details of previous/future schools).

We may also collect, hold, share and otherwise use some information about Pupils which is “special category personal data” and we will take extra care to make sure that this is kept safe:

Racial or ethnic origin;
Religious beliefs;
Special educational needs and disability information;
Medical / health information;
Genetic and biometric data;
Information relating to keeping pupils safe;
Sexual life;
Sexual orientation; and
Dietary requirements.

Where do we get this information from?

We get this information from:

The student;
The [parents/guardians/carers], and other children’s [parents/guardians/carers];
Our staff;
Previous schools or education providers; and
People from other organisations, including doctors or the local authority for example.

Why do we use this information?

We use this information for lots of reasons, including:

To make sure that we give you a good education and to support Pupils;
To make sure that we are able to address and support any educational, health or social needs Pupils may have;
To make sure everyone is treated fairly and equally;
To keep Pupils and everyone at the school safe and secure;
To deal with emergencies involving Pupils;
To celebrate Pupil’s achievements;
To support you to decide what to do after you leave school;
To support the primary, secondary and in-year admissions process;
To provide reports and additional information to your parents/carers;
To improve the education and services we provide;
To promote the Academy & The Thinking Schools Academy Trust: and
To document the work and history of the Academy & The Thinking Schools Academy Trust

Some of these things we have to do by law. Other things we do because we need to so that we can run the school.

Sometimes we need permission to use Pupil information. This includes taking pictures or videos of Pupils to be used on our website or in the newspaper. Before we do these things, we will ask pupils or, if necessary, parents/carers for permission.

We may also collect information about your future education, training, and career aspirations after you leave the school. This information is collected only where you choose to give your consent, and is used to help us understand student destinations, improve our careers education and support, and meet our responsibilities to track how well we prepare pupils for their next steps. You can withdraw your consent for this at any time by contacting us.

Why do we use special category personal data?

We may need to use the information about Pupils which is special (mentioned above) where there is a specific interest to do so, for example health and social care purposes or to provide you with equal opportunities and treatment. We will also use this information where Pupils have given us permission to do so.

There may also be circumstances where we need to use pupil information in relation to legal claims, or to protect Pupils’ vital interests and where Pupils are unable to provide their consent.

How long will we hold information in relation to our pupils?

We will hold information relating to you only for as long as necessary. How long we need to hold on to any information will depend on the type of information based on the Trust’s Records Management, Retention and Disposal policy, available from http://www.tsatrust.org.uk/policies/.

We may hold information relating to former pupils (alumni) beyond the standard retention periods, where legally permitted under the UK GDPR and the Data Protection Act 2018, for archiving and historical purposes (for example, to maintain a record of the school’s history or to keep in touch with alumni). Individuals still retain their rights under data protection law, including the rights of access, rectification, restriction and erasure, where these do not conflict with the lawful basis for archiving in the public interest.

Who will we share pupil information with?

We may share information about Pupils with:

Department for Education and the Education and Skills Funding Agency in compliance with legal obligations of the school to provide information about students and parents as part of statutory data collections;
Local Authority teams (including Kent, Medway, Portsmouth and Plymouth Councils) working to improve outcomes for children and young people;
Commissioned providers of Trust services (such as Local Authority or Trust services);
Schools or colleges that you attend after leaving us;
Local forums with schools and Local Authority representatives which support in-year fair access processes and support managed moves between schools;
Local multi-agency forums which provide SEND advice, support and guidance (such as Local Inclusion Forum Team (LIFT));
Subsidiaries and data processors, where necessary to provide essential systems and services required to ensure children continue to receive appropriate education provision, under contract to the Trust;
Other public organisations, where necessary, which may include Police, school nurses, doctors and mental health workers and the NHS;
Academies within our Trust, and local collaboration to enable the moderation of pupil assessment outcomes, to support collaborative working through joint analysis, and ensure children continue to receive appropriate education provision;
External moderators (teachers with recent relevant experience) of end of key stage assessments, to meet statutory requirements from the Standards & Testing Agency (STA);
Third-party providers of information services (such as education content providers or apps); and
Contracted providers of services (such as communication systems, school photographers and catering providers).

Additionally, sometimes we need to share information to others, based on the type of study:

Aged 14+ qualifications – If you enrol for post-14 qualifications, the Learning Records Service will give us a pupil’s unique learner number (ULN) for you and may also give us details about your previous study or qualifications;

Pupils aged 16+ – We are required to provide additional pupil information to Local Authority to fulfil their responsibilities in relation to the education or training of 13-19-year-olds under section 507B of the Education Act 1996, including:

Intended destinations of pupils in Year 11 moving into Year 12;
Course offers for pupils in Year 11 moving into Year 12 (September Guarantee);
Careers advice and guidance; and
Youth support services.

Information for Parents/Carers

As a parent or carer of a student within The Thinking Schools Academy Trust, during your child’s time with us, we will gather and use information relating to you. Information that we hold in relation to individuals is known as their “personal data”. This will include data that we obtain from you directly and data about you that we obtain from other people and organisations. We might also need to continue to hold your personal data for a period of time after your child has left The Thinking Schools Academy Trust. Anything that we do with an individual’s personal data is known as “processing”.

What information do we process in relation to you?

We may collect, hold, share and otherwise use the following information about you:

Personal information (such as name, address, home and mobile numbers, personal email address, emergency contact details and relationship marital status).
Financial details (such as bank account or credit card details), and other financial details such as eligibility for free school meals or other financial assistance.
CCTV and body worn camera footage and images obtained when you attend one of our locations or sites.
Your relationship to your child, including any Court orders that may be in place.

We may also collect, hold, share and otherwise use some information about you which is special “special category personal data”, including:

gender;
age;
ethnic group;
sex or sexual orientation;
religious or similar beliefs;
information about health; and
genetic information and biometric data.

Where do we get your personal data from?

We will obtain an amount of your personal data from you, by way of information gathering exercises at appropriate times such as when your child joins The Thinking Schools Academy Trust, and when you attend The Thinking Schools Academy Trust, site and are captured by our CCTV and body worn camera systems.

We may also obtain information about you from other sources. This might include information from the local authorities or other professionals or bodies, including a Court, which might raise concerns in relation to your child.

Why do we use your personal data?

We will process your personal data for the following reasons:

Where we are required by law, including:
- To provide reports and other information required by law in relation to the performance of your child;
- To raise or address any concerns about safeguarding;
- To Government agencies including the police;
- To obtain relevant funding for the school; and
- To provide or obtain additional services including advice and/or support for your family.
Where the law otherwise allows us to process the personal data as part of our functions as The Thinking Schools Academy Trust, or we are carrying out a task in the public interest, including:
- To confirm your identity;
- To communicate matters relating to The Thinking Schools Academy Trust to you;
- To safeguard you, our pupils and other individuals;
- To enable payments to be made by you to The Thinking Schools Academy Trust;
- To ensure the safety of individuals within the sites and premises of The Thinking Schools Academy Trust;
- To aid in the prevention and detection of crime on The Thinking Schools Academy Trust sites; and
- To conduct research about your opinion of current services, improve our services or of potential new services that may be offered.
Where we otherwise have your consent

Whilst the majority of processing of personal data we hold about you will not require your consent; we will inform you if your consent is required and seek that consent before any processing takes place.

Why do we use special category personal data?

We may process special category personal data in relation to you for the following reasons:

Where the processing is necessary for reasons of substantial public interest, including for purposes of equality of opportunity and treatment, where this is in accordance with our Data Protection Policy;
Where the processing is necessary in order to ensure your health and safety on The Thinking Schools Academy Trust sites, including making reasonable adjustments for any disabilities you may have; and
Where we otherwise have your explicit written consent.

There may also be circumstances where we need to use your information in relation to legal claims, or to protect your vital interests or those of your child, and where it is not possible to seek your consent.

Failure to provide this information

If you fail to provide information to us, we may be prevented from complying with our legal obligations.

How long will we hold your personal data for?

Who will we share your personal data with?

We routinely share information about you with:

Department for Education and the Education and Skills Funding Agency in compliance with legal obligations of the school to provide information about students and parents as part of statutory data collections;
Local Authority teams (including Kent, Medway, Portsmouth and Plymouth Councils) working to improve outcomes for children and young people;
Commissioned providers of Trust services (such as Local Authority or Trust services);
Future schools or colleges your child attends after leaving us;
Local forums with schools and Local Authority representatives which support in-year fair access processes and support managed moves between schools;
Local multi-agency forums which provide SEND advice, support and guidance (such as Local Inclusion Forum Team (LIFT));
Subsidiaries and data processors, where necessary to provide essential systems and services required to ensure children continue to receive appropriate education provision, under contract to the Trust;
Other public organisations, where necessary, which may include Police, school nurses, doctors and mental health workers and the NHS;
Third-party providers of information services (such as payment processing providers to enable payments); and
Contracted providers of services (such as communication systems, school photographers and catering providers);

The Department for Education may share information that we are required to provide to them with other organisations. For further information about the Department’s data sharing process, please visit: https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data.

Contact details for the Department can be found at https://www.gov.uk/contact-dfe.

Local authorities may share information that we are required to provide to them with other organisations.

Information for our Workforce

When you work at The Thinking Schools Academy Trust, we will use information that we gather in relation to you for various purposes. Information that we hold in relation to individuals is known as their “personal data”. This will include data that we obtain from the individual directly and data about the individual that we obtain from other people and organisations. We might also need to continue to hold an individual’s personal data for a period of time after they have left the school. Anything that we do with an individual’s personal data is known as “processing”.

What information do we process in relation to our workforce?

We will collect, hold, share or otherwise use the following information about our workforce:

Personal information (such as name, address, home and mobile numbers, personal email address, employee or teacher number, national insurance number, and emergency contact details).
Contract information (such as start dates, hours worked, post, roles and salary information, bank/building society details).
Work absence information (such as number of absences and reasons (including information regarding physical and/or mental health), holiday records).
Qualifications / training courses attended and, where relevant, subjects taught (such as training record).
Performance information (such as appraisals and performance reviews, performance measures including performance management/improvement plans, disciplinary or grievance records).
Other information (such as pension arrangements (and all information included in these necessary to administer them), time and attendance records, information in applications made for other posts within the school, criminal records information (including the results of Disclosure and Barring Service (DBS) checks), details in references the school receives or provides to other organisations, CCTV and body worn camera footage and images).
Photographic and video images.

We may also collect, hold, share and otherwise use some information about you which is “special category personal data”, including:

gender;
age;
ethnic group;
religious or similar beliefs;
political opinions;
trade union membership;
information about health; and
genetic information and biometric data.

Collection of Equality, Diversity, and Inclusion (EDI) Data:

As part of our commitment to fostering a diverse and inclusive workplace, we actively collect Equality, Diversity, and Inclusion (EDI) data from our staff and governors only where consent is given. This may include information on race, ethnicity, gender, disability status, sexual orientation, religion, and other protected characteristics.

This data is collected to:

Promote and monitor diversity, equality, and inclusion within our organization.
Enhance workplace policies and initiatives that support all employees

Where do we get information from about our workforce?

Whilst the majority of the personal data you provide to the Trust is mandatory, some is provided on a voluntary basis. When collecting data, the Trust will inform you whether you are required to provide this data or if your consent is needed.

However, we may also obtain information from tax and regulatory authorities such as HMRC, previous employers, your trade union, the DBS, our insurance benefit administrators, consultants and other professionals we may engage, recruitment or vetting agencies, other members of staff, students or their parents, and publicly available resources including online sources. In addition, we may obtain information from automated monitoring of our websites and other technical systems such as our computer networks and systems, CCTV, body worn camera and access control systems, communications systems, remote access systems, email and instant messaging systems, intranet and internet facilities, telephones, voicemail and mobile phone records.

Why do we use this information?

We will process the personal data of our workforce for the following reasons:

Where we are required by law, including:
- To comply with the law regarding data sharing;
- To comply with specific employment law requirements, including our obligations as an employer under employment protection and health and safety legislation, and under statutory codes of practice such as those issued by ACAS; and
- To comply with legal requirements in relation to equalities and non-discrimination.
Where we are required by any contract with our workforce, such as employment contracts, including:
- To make payments to our workforce, such as salary payments;
- To deduct tax and National Insurance contributions;
- To make a decision about recruitment; and
- To check individuals are legally entitled to work in the UK.
Administering employment contracts;
Conducting performance reviews;
Making decisions about salary and compensation;
Liaising with pension providers;
Where the law otherwise allows us to process the personal data, or we are carrying out a task in the public interest, including:
- To enable the development of a comprehensive picture of the workforce and how it is deployed;
- To inform the development of recruitment and retention policies;
- To safeguard our pupils and other individuals;
- To ensure safe working practices; and
- In the interests of ensuring equal opportunities and treatment.
To conduct research about your opinion of current services, improve our services or of potential new services that may be offered;
To promote the work of The Thinking Schools Academy Trust;
To document the work and history of the Academy & The Thinking Schools Academy Trust; or
Where we otherwise have the consent of the individual.

The majority of processing of personal data for our workforce does not require consent, however, we will inform individuals if their consent is required and seek that consent before any processing takes place.

Why do we use special category personal data?

We may process special category personal data of our workforce for the following reasons:

To carry out our legal obligations in relation to employment law, where this is in accordance with our Data Protection Policy;
Where the processing is necessary for reasons of substantial public interest, including for purposes of equality of opportunity and treatment, where this is in accordance with our Data Protection Policy;
For the purposes of preventative or occupational medicine in order to assess an individual’s working capacity and/ or the need for reasonable adjustments; and
Where we otherwise have an individual’s explicit written consent – subject to the restriction set out above on the use of consent in an employment relationship.

There may also be circumstances where we need to use your information in relation to legal claims, or to protect your vital interests and where you are unable to provide your consent.

Failure to provide this information

If our workforce fails to provide information to us then this may result in us being unable to perform the employment contract, or we may be prevented from complying with our legal obligations.

How long will we hold information in relation to our workforce?

Who we share workforce personal information with?

Department for Education (DfE) on a statutory basis for workforce policy monitoring, evaluation, and links to school funding / expenditure and the assessment educational attainment;
Commissioned providers of Trust services (such as Local Authority or Trust services);
Professional advisors including legal, human resources, health and safety, and communications consultants;
Subsidiaries and data processors, where necessary to provide essential systems and services required to ensure children continue to receive appropriate education provision, under contract to the Trust;
Other public organisations, where necessary, which may include Police, school nurses, doctors and mental health workers and the NHS;
Academies within our Trust, and local collaboration to enable the moderation of pupil assessment outcomes, to support collaborative working through joint analysis, and ensure children continue to receive appropriate education provision;
External moderators (teachers with recent relevant experience) of end of key stage assessments, to meet statutory requirements from the Standards & Testing Agency (STA);
Third-party providers of information services (such as payroll, online application and human resource systems); and
Contracted providers of services (such as school photographers and catering providers).

Contact details for the Department can be found at https://www.gov.uk/contact-dfe.

Information for Applicants

As part of your application to join The Thinking Schools Academy Trust, we will gather and use information relating to you. Information that we hold in relation to individuals is known as their “personal data”. This will include data that we obtain from you directly and data about you that we obtain from other people and organisations. We might also need to continue to hold an individual’s personal data for a period of time after the recruitment process, even if you are unsuccessful. Anything that we do with an individual’s personal data is known as “processing”.

What information do we process during your application process?

We may collect, hold, share and otherwise use the following information about you during your application process.

Up to and including shortlisting stage:

Your name and contact details (i.e., address, home and mobile phone numbers, email address);
Details of your qualifications, training, experience, duties, employment history (including job titles, salary, relevant dates and working hours), details of driving licence (if relevant for role), membership of professional bodies and interests;
Your racial or ethnic origin;
Details of your referees;
Whether you are related to any member of our workforce; and;
Details of any support or assistance you may need to assist you at the interview because of a disability.

Following shortlisting stage, and prior to making a final decision

Information about your previous academic and/or employment history, including details of any conduct, grievance or performance issues, appraisals, time and attendance, from references obtained about you from previous employers and/or education providers*;
Confirmation of your academic and professional qualifications (including seeing a copy of certificates) *;
Relevant disclosure information regarding your criminal record*;
Conformation via the DBS process, regarding your criminal record, in criminal records certificates (CRCs) and enhanced criminal records certificates (ECRCs), whether you are barred from working in regulated activity*;
Your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information*;
Medical check to indicate fitness to work*;
A copy of your driving licence (or other appropriate documentation as listed on the Home Office list) *;
If you are a teacher, we will check the National College of Teaching and Leadership (“NCTL”) Teachers Services about your teacher status, whether you are subject to a prohibition from teaching order and any other relevant checks (for example Section 128 direction for management posts) *; and
Equal opportunities’ monitoring data.
Online searches including social media presence of shortlisted applicants

Shortlisted candidates are required to declare any relevant convictions, adult cautions or other matters which may affect their suitability to work with children. As a result of amendments to the Rehabilitation of Offenders Act 1974 (exceptions order 1975) in 2013 and 2020, some minor offences are protected (filtered) and should not be disclosed to potential employers, and employers cannot take these offences into account. If candidates are unsure whether they need to disclose criminal information, they should seek legal advice before providing this data

You are required (by law or in order to enter into your contract of employment) to provide the categories of information marked (*) above to us to enable us to verify your right to work and suitability for the position. Without providing us with this information, or if the information is not satisfactory, then we will not be able to proceed with any offer of employment.

If you are employed by us, the information we collect may be included on our Single Central Record. In this scenario, the data we collect, process, hold and share about you during your time with us, will be covered in the workforce section of this privacy notice.

Where do we get information from during your application process?

Depending on the position that you have applied for, we may collect this information from you, your referees (details of whom you will have provided), your education provider, any relevant professional body, the Disclosure and Barring Service (DBS), NCTL and the Home Office, during the recruitment process.

Why do we use this information?

We will process your personal data during your application process for the purpose of complying with legal obligations, carrying out tasks which are in the public interest, and taking steps with a view to entering into an employment contract with you. This includes:

to assess your suitability for the role you are applying for;
to take steps to enter into a contract with you;
to check that you are eligible to work in the United Kingdom or that you are not prohibited from teaching; and
so that we are able to monitor applications for posts in the Trust to ensure that we are fulfilling our obligations under the public-sector equality duty under the Equality Act 2010.

How long will we hold information in relation to your application?

We will hold information relating to your application only for as long as necessary. If you are successful then how long we need to hold on to any information will depend on type of information. For further detail please see our Retention and Destruction Policy.

If you are unsuccessful, we will hold your personal data only for six months, after which time it is securely deleted.

Who will we share information with about your application?

We will not share information gathered during your application process with third parties, other than professional advisors such as legal, human resources, occupational advisors.

Information for Visitors, Guests and Online Services Users

When you visit one of our locations, or schools, and/or use our online services we may need to gather and use information relating to you. Information that we hold in relation to individuals is known as their “personal data”. This will include data that we obtain from you directly and data about you that we obtain from other people and organisations. We might also need to continue to hold an individual’s personal data for a period of time after the visit, or session has ended. Anything that we do with an individual’s personal data is known as “processing”.

What information do we process in relation to you?

We will collect, hold, share and otherwise use the following information about you:

Personal information (such as name, address, home and mobile numbers, personal email address, IP addresses)
Anonymous demographic information (such as browser type, domain names, access times, device information, geographic location, referring web site addresses and accessed web addresses);
Financial details (such as bank account or credit card details), and other financial details;
CCTV and body worn camera footage and images obtained when you attend one of our locations or sites; and
Your relationship to a child, or member of our workforce.

Where do we get your personal data from?

We will obtain an amount of your personal data from you when you visit one of our locations or sites through the sign-in and safeguarding procedures and when you are captured by our CCTV and body worn camera systems.

If you place a telephone call to The Thinking Schools Academy Trust then we will obtain your telephone number and through the call any personal data you provide.

We may also obtain information about you from our websites, online services and communication systems, including personal data supplied by your computer, user account(s), and other information provided by you through the process of using the systems and services.

Why do we use your personal data?

We will process your personal data for the following reasons:

Where we are required by law, including:
- To provide reports and other information required by law;
- To raise or address any concerns about safeguarding; and
- To ensure network and information security.
Where the law otherwise allows us to process the personal data as part of our functions as The Thinking Schools Academy Trust, or we are carrying out a task in the public interest, including:
- To confirm your identity;
- To respond to requests or communications;
- To communicate matters relating to The Thinking Schools Academy Trust to you; and
- To safeguard you, our pupils and other individuals.
To enable payments to be made by you to The Thinking Schools Academy Trust;
To ensure the safety of individuals within the sites and premises of The Thinking Schools Academy Trust;
To aid in the prevention and detection of crime on The Thinking Schools Academy Trust site;
To allow you to access protected content;
To conduct research about your opinion of current services, improve our services or of potential new services that may be offered; and
Where we otherwise have your consent.

How long will we hold your personal data for?

We will hold information relating to you only for as long as necessary. How long we need to hold on to any information will depend on the type of information based on our Records Management, Retention and Disposal policy, available from http://www.tsatrust.org.uk/policies/.

Who will we share your personal data with?

We routinely share information about you with:

Commissioned providers of Trust services (such as Local Authority or Trust services);
Subsidiaries and data processors, where necessary to provide essential systems and services required to ensure children continue to receive appropriate education provision, under contract to the Trust;
Other public organisations, where necessary, which may include Police, school nurses, doctors and mental health workers and the NHS;
Third-party providers of information services (such as payment processing providers to enable payments); and
Contracted providers of services (such as communication systems, school photographers and catering providers).

Information for Users

We collect data to operate effectively and provide you the best experiences with products and services. We collect and use personal data in order to meet legal requirements and legitimate interests set out in the GDPR and UK law. You provide some of this data directly, such as when you sign up for our services, login to our websites or systems, including using our wireless networks or administer your accounts.

We will obtain an amount of your personal data from you when you visit one of our locations or sites through the sign-in and safety procedures and when you are captured by our CCTV and body worn camera systems.

If you place a telephone call or submit an enquiry via email or one of our website forms, we will receive your telephone number or email address or IP address, as well as any personal data you provide during the interaction.

We may also obtain information about you from our websites, online services and communication systems, including personal data supplied by your computer, and other information provided by you through the process of using the systems and services.

We may also obtain data from third parties. We protect data obtained from third parties according to the practices described in this statement, plus any additional restrictions imposed by the source of the data. These third-party sources vary over time, but have included:

Other organisations within our business;
Social networks when you follow/contact one of our social profiles;
Partners with which we offer co-branded services or engage in joint marketing activities;

In some cases, your data will be outsourced to a third-party processor; however, this will only be done with your consent, unless we have another legal basis to share your data. If we do outsource your data to a third-party processor, the same data protection standards that we uphold are imposed on the processor.

Information about an individual collected by TSAT will only be used for the purpose for which it is provided. Personal information collected by TSAT will be processed and stored securely by TSAT and will be kept to a minimum. Information will only be retained for as long as is necessary to provide the requested service, following which the information will be disposed of securely.

Personal data we collect

The data we collect depends on the context of your interactions with us, and the products and services you use. The data we collect can include the following:

Personal information (such as name, addresses, telephone and email contact details, date of birth, language, nationality, country of birth, photographs, video, IP addresses and other similar personal data).
Biometric information, when using our catering, (fingerprints)
Authentication information (such as passwords, password hints and similar security information used for authentication and account access).
Anonymous demographic information (such as browser type, domain names, access times, device information, geographic location, referring web site addresses and accessed web addresses);
Payment data (such as bank account or credit card details including and the security codes), and other financial details;
CCTV and body worn camera footage and images obtained when you attend one of our locations or sites; and
Usage data (such as the devices or services you use).

We may also collect, hold, share and otherwise use some information about you which is “special category personal data “, including:

gender;
Medical information, disabilities and allergies
biometric data.

Why do we use your personal data?

We will process your personal data for the following reasons:

To provide you with access to the products or services that you have requested from Us;
Where we are required by law, including to comply with legal requirements in relation to equalities non-discrimination;
For Contact & Communication including allowing Us to communicate with you and personalise our communications with you. For example, we may contact you by phone, SMS, email or other means to provide you with information about the products / services that We offer, to inform you about incomplete sign-up processes, to invite you to provide feedback, or to send you our newsletters;
Where we are required by through our agreements with you to collect or make payments;
For the operation of our business to develop aggregate analysis and business intelligence that enable Us to operate, protect, make informed decisions and report on the performance of our business;
To conduct research about your opinion of current services, improve our services or of potential new services that may be offered; and
Where we otherwise have your consent.

Why do we use special category personal data?

We may process special category personal data in relation to you for the following reasons:

Where the processing is necessary in order to ensure your health and safety when on Our sites, including making reasonable adjustments for any disabilities and allergies you may have; and
Where we otherwise have your explicit written consent.

There may also be circumstances where we need to use your information in relation to legal claims, or to protect your vital interests and where it is not possible to seek your consent.

Failure to provide this information

If you fail to provide information requested by Us, then we may not be able to provide you with access to the products or services requested, and We may be prevented from complying with our legal obligations.

How long will we hold your personal data for?

We will hold information relating to you only for as long as necessary. How long we need to hold on to any information will depend on the type of information we hold and the reasons which it was collected.

When you share your information with Us via one of our forms, you may be asked to opt whether you would like to receive communications from TSAT. All emails* we send will provide the option for you to unsubscribe from receiving marketing/informational communications. We may still contact you by email or phone in the event of emergency, or if there is important information related to the provision of the products or services you receive from Us.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Requesting access to your personal data

We will not disclose information without your consent unless the law and our policies allow us to do so. We may need to disclose information where there is a legitimate reason for disclosure (such as a court order) but we will ensure that we always comply with the General Data Protection Regulation. Any information about you that we pass to a third party will be held securely by that party, in accordance with the General Data Protection Regulation, and used only to provide services or information you have requested.

Under the General Data Protection Regulation, you have rights which you can exercise free of charge which allow you to:

Know what we are doing with your information and why we are doing it;
Ask to see what information we hold about you (Subject Access Requests);
Ask us to correct any mistakes in the information we hold about you;
Object to direct marketing;
Make a complaint to the Information Commissioners Office; and
Withdraw consent (if applicable).

Depending on our reason for using your information you may also be entitled to:

Ask us to delete information we hold about you;
Have your information transferred electronically to yourself or to another organisation;
Object to decisions being made that significantly affect you;
Object to how we are using your information;
Stop us using your information in certain ways; and
Ask us to correct data we hold have about you.

To make a request for your personal information, contact our Data Protection Officer:

Mrs J Coates
Data Protection Officer
The Thinking Schools Academy Trust
c/o Holcombe Campus,
Park Crescent,
Chatham,
Kent,
ME4 6NR

Telephone: +44 333 360 2000

Email: privacy@tsatrust.org.uk

We will always seek to comply with your request however we may be required to hold or use your information to comply with legal duties. Please note: your request may delay or prevent us delivering a service to you.

For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioners Office (ICO) on individuals’ rights under the General Data Protection Regulation.

If you have a concern about the way The Thinking Schools Academy Trust is collecting, retaining or using your personal data, you can raise a complaint to the Data Protection Officer of The Thinking Schools Academy Trust on the above contact details. If you are unsatisfied with the response to your complaint, you are able to raise a concern with the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

Further information about Department of Education (DfE) Use

The DfE collects and processes personal data relating to those employed by schools (including Multi Academy Trusts) and local authorities that work in state funded schools (including all maintained schools, all academies and free schools and all special schools including Pupil Referral Units and Alternative Provision). All state funded schools are required to make a census submission because it is a statutory return under sections 113 and 114 of the Education Act 2005.

To find out more about the data collection requirements placed on us by the Department for Education including the data that we share with them, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

The department may share information about school employees with third parties who promote the education or well-being of children or the effective deployment of school staff in England by:

conducting research or analysis;
producing statistics; and
providing information, advice or guidance.

The department has robust processes in place to ensure that the confidentiality of personal data is maintained and there are stringent controls in place regarding access to it and its use. Decisions on whether DfE releases personal data to third parties are subject to a strict approval process and based on a detailed assessment of:

who is requesting the data;
the purpose for which it is required;
the level and sensitivity of data requested; and
the arrangements in place to securely store and handle the data.

To be granted access to school workforce information, organisations must comply with its strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

To contact the department: https://www.gov.uk/contact-dfe

The National Pupil Database (NPD)

The NPD is owned and managed by the DfE and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the DfE. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

The DfE may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

conducting research or analysis;
producing statistics; and
providing information, advice or guidance.

The DfE has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

who is requesting the data;
the purpose for which it is required;
the level and sensitivity of data requested: and
the arrangements in place to store and handle the data.

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

Changes to our privacy notice

The Thinking Schools Academy Trust keeps the use of personal data under review.

This notice was updated on 14 May 2018.

This notice was amended on 27 January 2021 to incorporate the Covid 19 Privacy Notice

This notice was amended on 4 February 2021 to incorporate the process for raising a complaint to the DPO and ICO, changes to reflect the UK leaving the EEA and changes to incorporate the 2020 amendments to the Rehabilitation of Offenders Act 1974.

This notice was amended on 15 November 2021 to incorporate the age-appropriate design code/children’s code statement.

This notice was amended on 21 July 2022 to incorporate the changes to Keeping Children Safe in Education (KCSiE) 2022 regarding internet searches on applicants.

This notice was amended on 06 December 2023 to incorporate the use of body worn cameras used in some Trust locations.

This notice was amended in April 2025 to incorporate the collection of EDI data for our staff and governors on a consent basis only.

This notice was amended in September 2025 to incorporate the use of filtering and monitoring in line with Keeping Children Safe in Education and retention of alumni information

This notice was amended in November 2025 to incorporate the collection of pupil data relating to career aspirations.

This notice was amended in December 2025 to remove Covid 19 information.

This notice was amended in February 2026 to incorporate the use of Artificial Intelligence (AI) tools and systems and the use of Recognised Legitimate Interests as a lawful basis for sharing data.