Home > Privacy Policy

Privacy Policy

We take your privacy seriously, so we encourage you to read this policy carefully as it contains important information about:

  • Who we are
  • What information we collect
  • How and why we collect, store and share personal information
  • Your rights in relation to your personal information
  • How to contact us and supervisory authorities if you have a complaint

Who we are

Ysgol y Garnedd ('we') collects, uses and is responsible for certain personal information about you as a 'data controller'. In doing so, we are regulated by the General Data Protection Regulations which apply throughout the European Union (including the United Kingdom) and we are responsible as a 'data controller' for that personal information for the purposes of those laws.

Personal information about pupils that we collect and use:

  • Personal information and contacts to identify pupils (name, gender, date of birth, address, pupil unique number (UPN), email address, emergency contact details)
  • Characteristics (ethnicity, nationality, home language, eligibility of free school meals)
  • Lunch payments and the child's meal pattern
  • Safeguarding information (court orders, personal involvement and social and child protection services reports, relevant background information about the family)
  • Special educational needs (needs and site including 'More able and talented' knowledge)
  • Attendance (number of sessions attended, number of absences and reasons for absence)
  • Medical and administration (information about doctor, allergies, medication and dietary requirements)
  • Assessment and attainment (statutory and non-statutory test results, educational history, expected levels of achievement, seasonal and annual reports)
  • Information about behaviour (prohibitions and any provisions that have been put in place)
  • Timetable and classes attended (including musical instrument lessons)
  • Photographs (including CCTV images)
  • Permission for school trips and published photographs (including name of person who gave permission and date)
  • Details of who is allowed to collect a pupil from the school

We collect and use information about pupils for the following purposes:

  • To support the pupil's education
  • To monitor and report on the progress of the pupil's achievement
  • To provide appropriate pastoral care
  • To assess the quality of our services
  • To keep children safe (food allergies, emergency contact details, CCTV images)
  • To meet statutory requirements for use with data collection, statutory audits and audit purposes

We may use your information for automated decision-making, including profiling. This is where we automatically make a decision about you without human intervention.

Under the General Data Protection Regulation (GDPR), the legal bases we rely on to process information about pupils are:

  • Processing is necessary in order to comply with legal obligations to which the data controller is subject
  • Processing is necessary in order to protect the essential interests of the data subject or any other natural person.
  • Processing is necessary for the purpose of a task carried out in the public interest or following the arrival of the official authority of the data controller

In addition, associated with any special category data

  • Processing is necessary for the purposes of completing the implications and exercising specific rights that the controller or the data subject has which provides for appropriate safeguards for the fundamental rights and interests of the data subject
  • Processing is necessary to protect the essential interests of the data subject or another natural person where the data subject does not have the physical or legal capacity to give consent
  • Processing is necessary for archiving purposes in the public interest, scientific research, historical research or statistical purposes. This will be proportionate to the aim pursued, respecting the essence of the right to data protection and protecting the fundamental rights and interests of the data subject. 

The legal obligations for processing information about pupils are:

  • The Education (School Information) (Wales) Regulations 2011
  • The Education (Pupil Information) (Wales) Regulations 2011
  • The Education (School Performance and Absence Targets) (Wales) Regulations 2011
  • Education (Head of Parent and Adult Report) (Wales) Report 2011
  • Data Protection Act 1998
  • General Data Protection Regulation (GDPR) and Data Protection Act 2018
  • Freedom of Information Act 2012
  • Additional Learning Needs and the Educational Tribunal (Wales) Act 2018
  • The Government of Maintained Schools (Wales) Regulations 2005
  • Social Services and Well-being Act 2014
  • Equality Act 2010The (Fire Safety) Regulations 2005/ Regulatory Reform (Fire Safety) Order 2005 (PEEPS forms are completed and include details of any disabilities a child/member of staff has)

Gathering Pupils' Information

We collect information about pupils through enrolment forms as pupils start school and we receive some data through a Common Transfer File (CTF) if a child transfers to us from another school

While most pupil information you provide to us is essential, some information will be provided on a voluntary basis

In order to comply with data protection legislation, we will let you know whether you will be required to provide us with specific information about a pupil or if you have a choice in this.

If information is provided to us on a voluntary basis, we will ask you to give specific consent and give you the option to withdraw consent at any time.

Pupil Data Storage

We hold data about pupils securely for certain periods of time as shown in our retention period list. For more information about our retention periods, please visit the data protection policy on our website www.ysgolygarnedd.org.uk

Who we share information about pupils with

We regularly share information about pupils with:

  • Schools the pupil goes to when they leave us
  • Gwynedd Council, Local Authority, Education Office - SIMS Assistants, School Counsellor, Wellbeing Officer, Social Services, Leisure, Transport, Finance, Derwen, GwE, ALN & Inclusion Team
  • Betsi Cadwaladr University Health Board - school nurse, dentist, Camhs
  • Estyn
  • Police and youth offending team
  • Language Centres (when required)
  • Welsh Government
  • School Governing Body (where necessary)
  • Gwynedd IT – via SIMS (school information management system)

Agencies commissioned by us to provide services on our behalf

  • Welsh Government
  • Gwynedd IT
  • ESS – SIMS
  • SchoolGateway
  • Edufocus trwy Evolve
  • Google Drive
  • My Concern

Relevant companies that promote and administer our pupils' learning experiences

  • Welsh Government - via HwB
  • Bangor University
  • Urdd Gobaith Cymru
  • Google Classrooms
  • Seesaw
  • TT Rockstars
  • Darllen Co
  • Reading Eggs

Why we regularly share information about pupils

We do not share information about our pupils with anyone without permission, unless the law and our policies allow us to do so.

We share data about pupils with the Welsh Government on a statutory basis. Sharing data in this way underpins the school's finances and monitors educational attainment.

We are required to collect data under the Education (Pupil Information) (Wales) Regulations 2011 and the Education (School Performance and Absence Targets) (Wales) Regulations 2011.

We are required to share information about our pupils with our Local Authority, Gwynedd Council, and the Welsh Government under the Education (Pupil Information) (Wales) Regulations 2011

Request to access your personal data

Under data protection legislation, parents and pupils have the right to request access to the information we hold about them. To request your personal information, or request access to your child's educational record, please contact one of the following:

Head of School
Ysgol y Garnedd
Penrhos Road                                  
Bangor                                   
Gwynedd                                      
LL57 2LX 

Data Protection Officer
Gwynedd Council
Stryd y Castell                                  
Caernarfon                                   
Gwynedd                                      
LL55 1SH

You also have the right to:

  • Object to the processing of personal data which is likely to cause, or which causes, harm or distress
  • Prevent anything from being processed for direct marketing purposes
  • Opposing decisions made by automated means
  • Correct, Prevent, delete or destroy incorrect personal data in certain circumstances
  • Claiming compensation for the harm caused as a result of a breach of Data Protection regulations

If you have a concern about how we collect or use your personal data, we ask that you initially raise your concern with us. Alternatively, you can contact the Information Commissioner's Office (ICO) via https://ico.org.uk/concerns

Update this privacy notice

We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This version was last updated November, 2025

Contact

If you would like to discuss anything in this privacy notice, please contact one of the following: 

Head of School
Ysgol y Garnedd
Penrhos Road                                  
Bangor                                   
Gwynedd                                      
LL57 2LX 

Data Protection Officer
Gwynedd Council
Stryd y Castell                                  
Caernarfon                                   
Gwynedd                                      
LL55 1SH