Privacy Policy

We take your privacy seriously, and therefore encourage you to read this statement carefully as it contains important information regarding: 

• Who we are
• What information we collect
• How and why we collect, store and share personal information
• Your rights in relation to your personal information
• How to contact us and supervisory authorities if you have a complaint

Who we are

Ysgol Y Garnedd is responsible for collecting and using personal information about pupils. We act as a data controller and process information in accordance with UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Personal information about pupils that we collect and use:

We may collect information such as: 

• Identification and contact details (name, date of birth, address, UPN, parent details and emergency contacts)
• Information about personal characteristics (ethnicity, language, nationality, eligibility for free school meals)
• Attendance, behaviour and achievement records
• Health information and medical needs (including allergies, medication and dietary requirements)
• Information about Additional Learning Needs (ALN), including information relating to more able and talented pupils
• Safeguarding information where appropriate (court orders, personal involvement and reports from social services and child protection services, relevant family background information)
• Behaviour information (exclusions and any provisions that have been put in place)
• Assessment and achievement information (statutory and non statutory test results, educational history, expected attainment levels, termly and annual reports)
• Timetable and classes attended (including instrumental music lessons)
• Child school meals information (payments and/or meal patterns)
• Photographic images and CCTV
• Consent details for trips, photographs and school activities
• Biometric information (fingerprints where applicable)

We collect and use pupil information in order to:

• Provide appropriate education and support to pupils
• Monitor progress and achievement
• Ensure pupil safety and wellbeing
• Manage attendance, behaviour and pastoral care
• Fulfil our legal and statutory duties
• Keep children safe (food allergies, emergency contact details, CCTV images)
• Meet statutory requirements for use with data collections, statutory inspections and audit purposes

We use biometric information to:

• Identify pupils securely and accurately when using the cashless system
• Manage school meal payments and usage efficiently
• Reduce the need for pupils to carry cash or identification cards

We may use your information for automated decision making, including profiling. This is where we make a decision about you automatically without human intervention. 

Under the General Data Protection Regulation (GDPR), the legal bases we rely on for processing pupil information are:

• Processing is necessary to comply with legal obligations to which the data controller is subject
• Processing is necessary for the performance of a task carried out in the public interest or for statutory duties
• Processing biometric information is based on consent and explicit consent (consent may be withdrawn at any time)

In addition, in relation to any special category data

• Processing is necessary for reasons of substantial public interest under relevant domestic or international law

The legal obligations for processing pupil information are:

• Education (School Information) (Wales) Regulations 2011
• Education (Pupil Information) (Wales) Regulations 2011
• Education (School Performance and Absence Targets) (Wales) Regulations 2011
• Education Reports (Headteacher Reports to Parents and Adult Pupils) (Wales) Regulations 2011
• General Data Protection Regulation (GDPR) and the Data Protection Act 2018
• Freedom of Information Act 2012
• Additional Learning Needs and Education Tribunal (Wales) Act 2018
• Government of Maintained Schools (Wales) Regulations 2005
• Social Services and Well-being Act 2014
• Equality Act 2010
• Regulatory Reform (Fire Safety) Order 2005 (PEEPS forms are completed and include details of any disabilities affecting a child/member of staff)

Collecting Pupil Information

We collect pupil information through registration forms when pupils start at the school and we receive some data through the Common Transfer File (CTF) if a child transfers to us from another school. 

Although most of the pupil information you provide to us is essential, some information will be provided on a voluntary basis.

To comply with data protection legislation, we will inform you whether you are required to provide specific information about a pupil or whether you have a choice in this matter.

Where information is provided on a voluntary basis, we will ask you for specific consent and give you the option to withdraw that consent at any time. 

Storing Pupil Data

Information is retained in accordance with the school's Data Protection Policy and Retention Periods. For further information about our retention periods, please request a copy of the Data Protection Policy from the Headteacher.

Biometric information is stored securely and is used only for the purpose of operating the cashless system. When a pupil leaves the school or consent is withdrawn, biometric data will be deleted in accordance with the school's retention and disposal procedures. 

Who may we share information with?

We may share relevant pupil information with organisations that support pupil education, wellbeing, safety and development.

We may also share information with companies and service providers that operate school systems, communication systems, safeguarding services, payment systems, digital learning platforms and administrative services on behalf of the school.

Information will only be shared where a legal basis, statutory obligation or valid consent exists, and only the information necessary for the specific purpose will be provided. 

Why we regularly share pupil information

We share pupil data with the Welsh Government on a statutory basis. We are required to share data for funding purposes and to monitor educational achievement.

We are required to collect data under the Education (Pupil Information) (Wales) Regulations 2011 and the Education (School Performance and Absence Targets) (Wales) Regulations 2011.

We are required to share information about our pupils with our Local Authority, Cyngor Gwynedd, and the Welsh Government under the Education (Pupil Information) (Wales) Regulations 2011. 

Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to the information we hold about them. To make a request for your personal information, or to request access to your child’s educational record, please contact the Headteacher:

Mrs Llinos Davies
Headteacher
Ysgol y Garnedd
Pennaeth@garnedd.ysgoliongwynedd.cymru

Your Rights:

Under data protection legislation, you have the right to:

• Access your personal information
• Request correction of inaccurate information
• Request restriction of processing in certain circumstances
• Object to processing in certain circumstances
• Make a complaint if you are dissatisfied with how we handle your information
• Withdraw consent where processing is based on consent
• Object to decisions made through automated means

If you have concerns about how we collect or use your personal data, we ask that you raise your concern with us first. If you are unhappy with the response, you may contact the Schools Data Protection Officer at SDDYsgolion@gwynedd.llyw.cymru or the Information Commissioner's Office (ICO) at https://ico.org.uk/concerns.

Complaints procedure regarding a Subject Access Request (SAR)

We are committed to handling information requests fairly, transparently and within statutory timescales.

If you are dissatisfied with:

• The way your request was handled
• The information provided
• A decision to refuse disclosure of information
• Delays in responding to your request; or
• Any other aspect of the school’s data protection practices relating to your request

You may submit a complaint to Headteacher/Schools Data Protection Officer in the first instance.

If you are unhappy with the response from the school or the Data Protection Officer, you have the right to make a complaint to the Information Commissioner’s Office (ICO) by visiting www.ico.org.uk or by calling 0303 123 1113.

Updating this privacy notice

This Privacy Notice will be reviewed regularly to ensure that it remains accurate and complies with data protection legislation. We therefore recommend that you revisit this information from time to time.

Last updated on 11.09.2026 

Contact

If you would like to discuss anything in this privacy notice, please contact one of the following:

Headteacher                            
Ysgol y Garnedd                
Pennaeth@garnedd.ysgoliongwynedd.cymru

Schools Data Protection Officer
SDDYsgolion@gwynedd.llyw.cymru