Images protected by Greenhouse School Websites

St John's C of E Primary School

Website Privacy Policy 

St John’s C of E Primary School

Thank you for visiting our website (www.stjohns-primary.surrey.sch.uk). St John’s C of E Primary School considers the privacy of its website visitors and community members to be of paramount importance. This Policy sets out the basis on which any personal data provided to us by you, or received by us from third parties, will be collected, processed, and stored.

Please read this Policy carefully to understand our practices regarding your personal data and your rights under applicable data protection law.

We are St John’s C of E Primary School, the data controller of personal data provided to us, and we are registered as a data controller with the Information Commissioner’s Office (ICO).

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing data protection matters and addressing any queries you may have regarding this Policy. You can contact our Data Protection Officer at dpo@stjohnscofe.uk.

Summary

Full details are set out in the relevant sections of this Policy below, but in summary:

  • Direct Collection: We generally receive personal data directly from you when you communicate with us or use our website.

  • Third-Party Data: Personal data may occasionally be provided to us by third parties with whom you and the school share a operational relationship (e.g., local authorities, contracted service providers, or your employer).

  • Use of Data: We use your data to operate and improve our website, manage administrative operations, maintain appropriate school records, and fulfill our legal and statutory duties.

  • Data Sharing: We only share personal data with vetted third-party processors or as required by law. We never sell or share your data with third parties for marketing purposes.

  • Data Retention: We retain personal data only for as long as necessary to fulfill the specific purposes for which it was collected, or to meet statutory retention mandates.

  • Your Rights: You have clear legal rights under UK data protection law, including the right to request access, rectification, restriction, or erasure of your personal data.

  • Cookies: Our website uses cookies. Essential cookies are deployed automatically, while non-essential analytical and functionality cookies are set only with your explicit consent via our website cookie manager.

  • Exclusions: This Policy applies specifically to website visitors, general enquirers, and external partners. Separate Privacy Notices are provided to parents, pupils, staff, and governors explaining how their specific operational personal data is handled.

How We Use Personal Data

This section outlines the categories of personal data we collect, our purposes for processing, and the lawful bases under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

1. Personal Data We Obtain From You

  • Communications Data: If you contact us via email, telephone, website contact forms, or written correspondence, we process the details contained within those communications (e.g., contact information, role, nature of enquiry).

    • Purpose: To address your query, manage school operations, and maintain communication records.

    • Lawful Basis: Performance of a contract or preliminary steps (Article 6(1)(b) UK GDPR); Legitimate Interests (Article 6(1)(f) UK GDPR); or Public Task (Article 6(1)(e) UK GDPR).

  • Account and Operational Data: If you or your organization act as a supplier, contractor, or commercial partner, we process contact details, official correspondence, and administrative notes.

    • Purpose: Managing supply contracts, procurement, and ongoing administrative relationships.

    • Lawful Basis: Performance of a contract (Article 6(1)(b) UK GDPR); Legitimate Interests (Article 6(1)(f) UK GDPR).

  • Transaction Data: Information relating to payments made by or to you (e.g., bank details, invoices, purchase orders, payment reference numbers).

    • Purpose: Processing payments, accounting, auditing, and financial compliance.

    • Lawful Basis: Performance of a contract (Article 6(1)(b) UK GDPR); Legal Obligation (Article 6(1)(c) UK GDPR).

  • Visitor Data: If you visit our physical school premises, we may collect your name, vehicle registration number, contact number, organization, arrival/departure times, and purpose of visit.

    • Purpose: Safeguarding pupils and staff, maintaining health and safety records, and managing site access.

    • Lawful Basis: Public Task / Safeguarding (Article 6(1)(e) UK GDPR); Legal Obligation (Article 6(1)(c) UK GDPR).

  • CCTV Data: Our premises are monitored by Closed-Circuit Television (CCTV) systems. We process video footage and still images captured by these cameras.

    • Purpose: Ensuring physical safety, maintaining site security, preventing and detecting crime, and protecting school property.

    • Lawful Basis: Public Task (Article 6(1)(e) UK GDPR); Legitimate Interests (Article 6(1)(f) UK GDPR).

  • Technical Data: Information automatically gathered when you navigate our site, such as IP addresses, browser types, operating systems, referring URLs, and page interaction times.

    • Purpose: Maintaining network security, diagnosing server issues, and optimizing website user experience. Technical data is aggregated and anonymized where possible.

    • Lawful Basis: Legitimate Interests (Article 6(1)(f) UK GDPR) for necessary system administration; Consent (Article 6(1)(a) UK GDPR) for non-essential analytics cookies.

2. Personal Data We Obtain From Third Parties

Your personal data may occasionally be provided to us by external organizations, such as local authorities (e.g., Surrey County Council), government departments (e.g., Department for Education), or your employer (if collaborating with the school on a project). This data typically comprises contact details or administrative records processed under the relevant legal bases set out above.

Disclosures of Your Personal Data

We do not sell, rent, or trade personal data. We may share personal data with trusted third parties strictly for the operational purposes described in this policy, including:

  • IT & Hosting Service Providers: Suppliers hosting our web servers, cloud storage, database applications, and communication tools.

  • Professional Advisers & Auditors: Legal counsel, data protection consultants, financial auditors, and accountants bound by professional duties of confidentiality.

  • Government Bodies & Statutory Authorities: Local authorities, the Department for Education (DfE), Ofsted, law enforcement, or health authorities where required by statutory law or safeguarding duties.

All third-party data processors act under contract and are required to implement strict technical and organizational security measures in line with UK GDPR requirements.

International Data Transfers

Where personal data is transferred to service providers or cloud systems located outside the United Kingdom, we ensure that adequate protection mechanisms are in place prior to any processing. Transfers outside the UK will only occur:

  1. To countries recognized by the UK Government as providing an adequate level of data protection (UK Adequacy Regulations);

  2. Under standard data protection clauses approved for UK use (such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses); or

  3. Under an officially recognized adequacy bridge mechanism, such as the UK Extension to the EU-US Data Privacy Framework.

You may request further information regarding international transfer safeguards by contacting our DPO.

Data Security and Retention

Data Security

We have implemented technical and organizational security measures to prevent unauthorized access, alteration, disclosure, loss, or destruction of personal data. Access to personal data is restricted to authorized staff and contractors who require it for operational duties.

In the event of a confirmed or suspected personal data breach, we will follow established breach management protocols and notify affected individuals and the ICO where legally required.

Data Retention

Personal data is retained only for as long as necessary to fulfill the operational purpose for which it was collected, or to satisfy legal, accounting, statutory, or safeguarding retention schedules (guided by the Information and Records Management Society Toolkit for Schools):

  • Enquiry Communications: Retained for approximately 12 months following resolution before secure deletion.

  • Financial & Transaction Data: Retained for 6 financial years plus the current financial year in compliance with UK tax and audit legislation.

  • CCTV Footage: Retained for a maximum of 30 days before automatic overwriting, unless required for an ongoing investigation or legal claim.

  • Anonymized Technical Data: Retained indefinitely for trend analysis as it contains no identifiable personal data.

Your Legal Rights Under UK Data Protection Law

Under the UK GDPR and Data Protection Act 2018, you possess the following rights regarding your personal data:

  • Right of Access (Subject Access Request): Request access to the personal data we hold about you and receive copies of that data along with processing details.

  • Right to Rectification: Request correction of inaccurate personal data or completion of incomplete records.

  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no legal requirement or compelling reason for its continued processing.

  • Right to Restrict Processing: Request the suspension of personal data processing under specific legal conditions (e.g., while data accuracy is verified).

  • Right to Object: Object to processing based on Legitimate Interests or Public Task grounds, unless we demonstrate compelling legal reasons to continue.

  • Right to Data Portability: Request the transfer of your personal data to you or a third party in a structured, machine-readable format (applicable where processing relies on contract or consent).

  • Right to Withdraw Consent: Where processing is based on consent (e.g., non-essential website cookies), you may withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, please submit a written request to our Data Protection Officer at dpo@stjohnscofe.uk.

Complaints

If you believe that our handling of your personal data infringes data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

About Cookies

A cookie is a small text file stored on your browser or device by a website. Cookies help recognize your browser, improve site usability, and gather performance analytics.

Under the Privacy and Electronic Communications Regulations (PECR), strictly necessary cookies may be set automatically. All non-essential cookies require your explicit prior opt-in consent.

Categories of Cookies We Use

  1. Strictly Necessary Cookies (Always Active): Essential for the fundamental operational features of our website, such as site security, page navigation, and access to secure areas. Consent is not required for these cookies under PECR.

  2. Analytical / Performance Cookies (Consent Required): Collect aggregated, pseudonymous statistics on how visitors navigate the site (e.g., page views, visit duration). These help us improve website functionality.

  3. Functionality Cookies (Consent Required): Remember choices you make (such as preferred language or regional settings) to offer an enhanced, personalized experience.

Managing Cookie Preferences

  • Website Cookie Preferences: When you first visit our site, a cookie banner allows you to Accept or Reject non-essential analytical and functionality cookies, or customize your preferences. You can update your choices at any time via the cookie settings link on our website.

  • Browser Control: You can also configure your web browser to block or delete cookies. Visit www.aboutcookies.org or your browser’s official help documentation for instructions. Please note that disabling essential cookies may impact website functionality.

Third-Party Links

Our website may contain links to external third-party websites, applications, or embedded services (e.g., educational platforms, payment portals, or social media networks). This Privacy Policy applies solely to our website. We are not responsible for the privacy practices, cookie deployment, or content of third-party platforms. We encourage you to read the privacy policies of any linked website you visit.

Changes to This Policy

We review and update this Privacy Policy periodically to reflect changes in our legal obligations, technology, or operational practices. Any material updates will be published on this page with a revised date stamp.

Last updated: October 2026

                                

↑