Privacy Notice – Pupils, Parents and Carers
Version 6 | August 2026
Review date: August 2027
Quick guide for pupils
We keep information about you so we can teach you, keep you safe, support you and run the College properly. Some information has to be collected by law.
We do not sell your personal information. We only use or share it when we have a lawful reason. You have rights over your information and, as you become able to understand those rights, you can exercise them yourself.
About this notice
This notice explains how The Hayling College collects, uses, stores and shares personal information about pupils, parents and carers.
It reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended, including the Data (Use and Access) Act 2025, and relevant law.
The Hayling College is the data controller. We decide why and how personal information is used and are responsible for using it lawfully, fairly, transparently and securely.
Data protection principles
We process personal information in accordance with the following principles:
- lawfulness, fairness and transparency;
- purpose limitation;
- data minimisation;
- accuracy;
- storage limitation;
- integrity and confidentiality; and
- accountability.
Information we may collect
We may collect and process:
- identity and contact details;
- parent/carer, emergency contact and family information;
- statutory characteristics such as sex, ethnicity, language and free-school-meal eligibility;
- attendance, absence and punctuality;
- curriculum, assessment, examination, achievement and destination information;
- behaviour, rewards, sanctions, suspensions and exclusions;
- SEND, disability, accessibility and support information;
- safeguarding, child-protection and pastoral information;
- health, medical, dietary and wellbeing information;
- images, photographs, audio/video recordings and CCTV;
- use of College IT, accounts, devices, networks, filtering and monitoring systems;
- financial/payment information where relevant;
- careers, work-experience and post-16 progression information;
- biometric information where an approved biometric system is used; and
- other information needed to provide education, safeguarding and support or meet legal duties.
Special category and criminal offence information
Some information needs extra protection, including health, disability, ethnicity, religion or philosophical belief, biometric identifiers and, where relevant, sexual orientation.
We may also process criminal offence information where the law permits or requires it. We use additional legal conditions and safeguards for this information.
Why we use information
We use personal information to:
- provide education, teaching, learning, home learning and enrichment;
- monitor progress, attainment, attendance, behaviour and educational needs;
- safeguard pupils and provide pastoral, medical and SEND support;
- communicate with families and manage admissions and transitions;
- administer examinations, careers, work experience and post-16 progression;
- meet statutory duties, including school census and attendance collections;
- manage funding, finance, catering, trips and clubs;
- maintain safe premises and systems, including CCTV, cyber security, filtering and monitoring;
- evaluate and improve College services; and
- manage complaints, legal claims, insurance and regulatory requirements.
Lawful bases
We do not rely on consent for most core education processing.
Our main Article 6 UK GDPR lawful bases are legal obligation and public task. In limited circumstances, we may also rely on vital interests, contract, legitimate interests or consent.
For special category information, we use an appropriate Article 9 and Data Protection Act 2018 condition.
How we collect information
Information comes from pupils and families and, where lawful, from previous schools, Hampshire County Council, the Department for Education, health and social-care professionals, safeguarding partners, examination bodies, careers providers and other organisations.
Who we share information with
Where appropriate and lawful, information may be shared with:
- Hampshire County Council and other local authorities where relevant;
- the Department for Education, including through statutory census and attendance collections;
- Ofsted and other regulators or public bodies where required;
- schools, colleges and education/training providers;
- examination and awarding organisations;
- NHS, health professionals, social care and safeguarding partners;
- police, courts, HMRC and other public authorities where lawful;
- youth support and careers services;
- professional advisers and insurers; and
- approved MIS, communications, safeguarding, IT, learning and assessment providers.
Current approved systems may include Arbor, Google Workspace/Google Classroom, Wonde, Sparx Maths, Sparx Science, Sparx Reader, GCSEPod, Languagenut, Unifrog, The Day and other approved platforms.
The exact processor list is maintained through the College's contracts and record of processing activities.
Youth support services
From age 13, information may be shared with Hampshire County Council and/or youth support services under section 507B of the Education Act 1996.
Parents/carers – or the pupil from age 16 – can object to information beyond the minimum identifiers being shared for youth-support purposes.
Department for Education and the National Pupil Database
We are required to provide information to the Department for Education through statutory collections.
The Department for Education uses this information for funding, accountability, policy, research and the education and wellbeing of children.
Some information is held in the National Pupil Database and may be shared lawfully under Department for Education controls.
Filtering and monitoring
To meet safeguarding and cyber-security duties, the College uses filtering and monitoring on College networks, accounts and devices.
This may record websites, searches, messages, files, device/network activity and safeguarding or security alerts.
Access is restricted to authorised staff and providers and is used proportionately for safeguarding, security and investigation.
Biometric information
Where the College uses automated biometric recognition, for example for catering, we follow the Protection of Freedoms Act 2012 and current Department for Education guidance.
Parents are notified, required consent arrangements apply, a pupil's objection overrides parental consent, and a reasonable alternative is available.
Automated decision-making
The College does not routinely make decisions about pupils with legal or similarly significant effects solely by automated means.
If this changes, we will identify a lawful basis, apply safeguards and provide appropriate information.
International transfers
Some approved providers may store or access information outside the UK.
Where this occurs, we use an appropriate UK transfer mechanism or other lawful safeguard.
Retention and security
We keep information only for as long as needed under our Data Retention Policy and retention schedule.
We use appropriate technical and organisational security measures and limit access according to role and business need.
Access to pupil information and educational records
Pupils have a right of access under data protection law.
Parents of pupils at maintained schools also have a separate right to access their child's educational record under education regulations, subject to applicable restrictions.
Requests can be made to admin@hayling.hants.sch.uk.
Your information rights
Which rights apply depends on the lawful basis and circumstances of the processing. These may include:
- the right to be informed;
- the right of access;
- the right to rectification;
- the right to erasure in certain circumstances;
- the right to restrict processing in certain circumstances;
- the right to object in certain circumstances;
- the right to data portability where applicable;
- rights relating to automated decision-making and profiling;
- the right to withdraw consent where consent is relied upon; and
- the right to complain about the use of your personal information.
Questions, concerns and data protection complaints
If you have a question or concern about how the College uses personal information, please contact:
The Hayling College
Email: admin@hayling.hants.sch.uk
Telephone: 023 9246 6241
For a formal complaint, please use the subject line “Data Protection Complaint”.
Under the Data (Use and Access) Act 2025, we will acknowledge a data protection complaint within 30 days, investigate it appropriately and respond without undue delay.
Data Protection Officer
The Hayling College's Data Protection Officer is Helen Cox.
She can be contacted through the College at admin@hayling.hants.sch.uk or on 023 9246 6241.
The College also receives specialist data protection support from Judicium Consulting Limited:
Email: dataservices@judicium.com
Telephone: 0345 548 7000 (option 1)
Website: www.judiciumeducation.co.uk
You also have the right to complain to the Information Commissioner's Office (ICO).
Keeping this notice current
We review this notice at least annually and sooner when processing changes significantly.
Significant changes will be brought to the attention of affected pupils, parents or carers.
Version 6 – August 2026
Next review: August 2027