Privacy Notice

Read our Child Friendly Privacy Notice for Pupils (PDF 261KB)

Fair Processing Notice

Your information is being collected by Bunscoill Ghaelgagh which is a data controller for the purposes of current Data Protection Legislation as applied in the Isle of Man.

Our websites contain links to other websites which you may find useful; when you follow these links, the websites should have their own privacy policy. Bunscoill Ghaelgagh cannot accept any responsibility or liability for the content of any personal data provided to them. We advise you to check these policies before you submit any personal data to these websites.

The Headteacher in the name of Bunscoill Ghaelgagh as Data controller

If you have any questions or comments on this Privacy Notice please contact the Data Controller, namely the Head Teacher at Main Road, St John's, Isle of Man IM4 3NA.

In addition to the information set out in the Department of Education, Sport and Culture’s (DESC) Privacy Notice, we may also collect the following information about your child as required by the Education Act 2001 and the Registration of Pupils Regulations 2016:

full legal name and where known, any former name or names;
gender;
date of birth;
unique pupil number;
ethnic group and by whom that information was provided;
first language;
date of admission to the school;
year group;
the address and postcode of the pupil's usual residence and any other properties at which the pupil is also known to reside on occasion;
the name and address of every person known to the school to be a parent of the pupil and at least one emergency contact telephone number;
the name and address of any other schools the pupil is known to have attended, if any, and in the case of guest registration, any other schools at which the pupil is registered;
full-time or part-time;
day pupil or boarder;
date of leaving the school;
usual mode of transport to and from school;
for any pupil who is known to the head teacher to be or to have been looked after by an appropriate organisation, the name of that organisation;
(where applicable) that the pupil has been found eligible for free school meals;
Attendance;
Medical information for the vital interests of children where appropriate;
Educational psychologists reports and supporting documents;
Academic achievements;
Skills and abilities;
Educational progress;
Special educational needs information;
Suspension information; and
Course information.

Should you have any enquiries or comments regarding this information, please contact the Data Protection Officer (DPO) for the Department of Education, Sport and Culture. By email DPO-DESC@gov.im or by post to Data Protection Officer, Thie Slieau Whallian, Foxdale Road, St John's, Isle of Man, IM4 3AS or by telephone on (01624) 685828.

How we will use the information we collect about you

Bunscoill Ghaelgagh may use your information to:

register your child at the school;
record attendance information;
produce an educational record containing:
- Information about your child
- Personal education plans
- Educational psychologist's reports and accompanying documents
produce a curricular record containing:
- Academic achievements;
- Skills and abilities; and
- Educational progress
produce a record of special educational needs and special needs provision, if appropriate detailing:
- The type of special need;
- A ranking of the special needs if there is more than one;
- The special needs provision being made; and
- Whether teaching is in a special education needs unit or elsewhere
record details of suspensions
produce a record of the studies undertaken;
help prevent and detect crime

Bunscoill Ghaelgagh has a statutory obligation to check and verify the data you provide to us on registration documents and on consent forms. This may include checks of publicly available information but in some cases, where it is necessary and relevant, the information you provide may be disclosed or shared with other organisations.

How we will share the information we collect about you

App or Service	Details	Consent Required
Arbor more information	Data Shared: Pupil record Sharing Basis: Public interest + official authority of the DC Security Protocols: Arbor uses bank-grade, end-to-end, 256bit SSL encryption to ensure only the authorised user can see school data. Student data is NEVER shared with third parties without a schools’ consent. Each user is issued with a unique and secure password, with permission-based access ensuring that they can only view the data relevant to them. No data is stored on any device, and Arbor automatically logs out after a period of inactivity. Arbor is a Data Processor and abides by all of the terms of the Data Protection Act 1998. Arbor are also registered with the UK Government on the G-Cloud VII framework, a Government framework which audits the security of cloud-based providers to ensure they meet government standards. Arbor products have also been approved by the Department for Education list for cloud suppliers. Server/Data Location: EEA Retention Period: DOB + 25 years	No
Book creator more information	Data Shared: name, email address, a password and the school name Security Protocols: All information collected through Book Creator is stored in Google Cloud. Reasonable steps to protect personal data when it is transferred to Google Cloud, and Google participates in the EU-U.S. Privacy Shield arrangement. This means it safeguards your personal data appropriately. In addition, Google has entered into model contract clauses with Book Creator which offer further safeguards. Access Conditions: Supervised Teacher Access: Yes Server/Data Location: US	Yes
DESC Attendance	Data Shared: Name, School, Attendance data if less than 80% Sharing Basis: Public interest + official authority of the DC Security Protocols: Secure access or information sent by email password protected Server/Data Location: EEA Retention Period: As needed while resolving issues	No
Empowering Education International Limited (EEIL) more information	Data Shared: May include fields such as: title, first name, last name, position, contact information, location data, ID data, opinions, comments, viewpoints, discussions, student academic data, self-evaluation data, career intentions, disability, ethnicity/race, medical (health or learning difficulty) goods and services provided, and internet protocol address. Please note that Ethnicity/Race and Medical (Heath or Learning Difficulty) data are special category data and adequate safeguards are in place to address them. Sharing Basis: Public interest + official authority of the DC Security Protocols: Tribal’s internal and customer hosting services are outsourced to our business partners (AWS, Microsoft and Rackspace) as applicable to the software services required. All three companies IT infrastructure is designed and managed in alignment with security best practices. Their compliance with international and industry-specific IT security standards is detailed in a series of control definition reports. Access Conditions: No Teacher Access: No Server/Data Location: UK Retention Period: Any personal data provided to EEIL will only be retained for the duration of the EEIL engagement with DESC.	No
Evolve more information	Data Shared: Name, contact details, trip information and risk assessments Sharing Basis: Public interest + official authority of the DC Security Protocols: Advanced firewalls, enterprise-level virus protection on all servers, HTTPS encryption for all communication between our servers and users, regular data backup, username/password/PIN to control access, failed log-in attempt logging, automatic suspicious activity detection and logging Server/Data Location: UK Retention Period: Current year + 6 years	No
Google	Data Shared: No personal information should be stored on Google servers by staff apart from a name, class grouping, email address and information regarding work completed or to be completed Sharing Basis: Public interest + official authority of the DC Security Protocols: Google adheres to several self regulatory frameworks, including the EU-US Privacy Shield arrangement. Access Conditions: No Teacher Access: Limited to areas set up by staff such as Google Classrooms and shared areas Server/Data Location: Worldwide including the US Retention Period: DOB + 21 years or 3 years since the last log on	Yes
ItsLearning	Data Shared: Name, class, school work Sharing Basis: Public interest + official authority of the DC Security Protocols: Username and password Access Conditions: No Teacher Access: Yes Server/Data Location: EEA Retention Period: End of Use + 12 months	No
Microsoft Teams	Data Shared: Census data: AppName, DeviceModel, OSName, OSVersion, UserLanguage, UserID, DeviceID. Census data DOES NOT contain any information that identifies your organisation or users. Usage data: includes information such as number of calls made, number of IMs sent or received, number of meetings joined, frequency of features used and stability issues. Usage data DOES NOT contain any information that identifies users. Anyone in a team can see all members of a team, including guests Sharing Basis: Public interest to assist with remote education during period of school closures. Security Protocols: Teams enforces team-wide and organization-wide two-factor authentication, single sign-on through Active Directory, and encryption of data in transit and at rest. Files are stored in SharePoint and are backed by SharePoint encryption. Access Conditions: Supervised and unsupervised. Teacher Access: Yes Server/Data Location: EEA Retention Period: August after pupil leaves school	No
Quesmedia Sites more information	Data Shared: Website activity, website form submissions and user content. Sharing Basis: To provide public website services for our school Security Protocols: Sites are served over HTTPS using TLS to provide both secure server–server and server–client communication. Accounts are protected from brute force attacks with rate limiting and automated account locking. Passwords are one-way encrypted using bcrypt before being stored and are required to satisfy strong password rules to ensure high-entropy. Access Conditions: None Teacher Access: Limited to data provided within the CMS Server/Data Location: United Kingdom (EEA) Retention Period: Please view the more information link for data retention policies.	No
RIDDOR more information	Data Shared: Name, age,gender, school, address, phone number, injury Server/Data Location: IOM Retention Period: DOB +25 years	No
Transition between primary and secondary school	Data Shared: Transition activities / work done in transition lessons / pupil record Sharing Basis: In the public interest and official authority of the data controller. Security Protocols: Emails on secure servers; for ‘online.sch.im’ a google service self regulatory frameworks, including the EU-US Privacy Shield arrangement. Access Conditions: Supervised and unsupervised Teacher Access: Yes Server/Data Location: United Kingdom (EEA) Retention Period: DOB + 21 years or 3 years since the last log on	No
Venture Centre more information	Data Shared: Name, age, DOB, gender, address, medical info Server/Data Location: Paper copy Retention Period: Shredded after visit	Yes
Zoom more information	Data Shared: Your name, username and email address, or phone number, Cloud recordings, chat / instant messages, files, whiteboards, and other information shared while using the service, voice mails, IP address, MAC address, other device ID (UDID), device type, operating system type and version, client version, type of camera, microphone or speakers, connection type, etc. location, Duration of the meeting / Zoom Phone call, Email address, name, or other information that a participant enters to identify themselves in the meeting, Join and leave time of participants, Name of the meeting, Date / time that meeting was scheduled, Chat status (unless a setting is actively chosen by user), Call data records for Zoom Phone Sharing Basis: Consent Security Protocols: Password protection, encryption – not end-to-end, only participants to meetings to be sent links, updates to be installed. Please note there are currently serious issues and no sensitive information should be shared on this platform. Privacy Shield applies. Access Conditions: Supervised and unsupervised Teacher Access: Yes Server/Data Location: Data routed through servers in China. USA Retention Period: Individual accounts when deleted	Yes

For more specific details about retention periods see the Department’s retention schedule

Information obtained or disclosed by third parties will not be used for any other purpose other than supporting the delivery of teaching and learning.

Failure to provide information may impact on support in school, the quality of teaching and learning and in achievement in examinations.

Protecting your information

Bunscoill Ghaelgagh will:

keep your information safe and secure in compliance;
only use and disclose your information as detailed above where necessary
Retain the information for no longer than is necessary and your information wll be permanently deleted once the timeframes set out below have been reached (there will need to be an authorisation process, to dispose of this in line with our Records Management Policy and retention periods as outlined below (unless there is an over-riding reason to retain this information).

Transfer of Information outside the EEA

Apps and services that are used in school may require data to be stored on servers outside of the EEA. Information sent to these will be limited and are as detailed above.

More Information

You can find out more information including:

Looking at the Isle of Man Government Privacy Policy here https://www.gov.im/about-this-site/privacy-notice/ [Accessed 16/1/18]
Contacting the Department’s Data Protection Officer: By email DPO-DESC@gov.im by post to Data Protection Officer, DESC, Thie Slieau Whallian, Foxdale Road, St John's, Isle of Man, IM4 3AS, or by telephone on (01624) 685828;
Asking to see your information or making a complaint if you feel that your information is not being handled by contacting the Headteacher as Data Controller for Bunscoill Ghaelgagh
Making a subject access request which is a request for all of the personal data we hold about you.
Obtaining this information in large print, braille, or in an alternative language.

Freedom of information

Requests for Information, submitted in accordance with Freedom of Information Act 2015.

The following information is collected for the purpose of meeting a request you have made for information.

Title
First name
Surname
Address
Email Address
Phone number
Mobile number

Your rights

You may have the following rights in relation to your personal information:

right to be informed about the personal information we collect, how this is being used, and to or from whom we share any details with.
right to access the personal data we hold about you by making a ‘subject access request’. If you agree, we'll try to deal with your request informally, for example by providing you with the specific information you need over the telephone, or we can email this to you where you have given us an email address. In certain circumstances a charge may apply.
right to request the correction of personal data we hold about you that you think is incorrect.
right to request erasure of your personal data in some circumstances.
right to object to processing and the right to restriction of processing of your personal data in some circumstances.
right to request portability, where you have supplied information to us, and you wish to transfer that information to another organisation or service provider.
right to withdraw your consent at any time.

It is worth noting that the benefits afforded by these rights are limited in some circumstances, and may depend on the legal reason why we collected your personal data. If this is the case, we'll explain why.

To exercise any of the rights mentioned, or if you have any questions relating to your rights, please contact the Data Protection Officer. To do this, by email DPO-DESC@gov.im by post to Data Protection Officer, DESC, Thie Slieau Whallian, Foxdale Road, St John's, Isle of Man, IM4 3AS, or by telephone on (01624) 685828.

Complaints

We take any complaints we receive about the way we process your information very seriously and we would like to hear from you if you have any concerns that our collection or use of your personal data is unfair, misleading or inappropriate. Please bring your concern to our attention by contact the Data Protection Officer, who will work with you to resolve any issues.

If you are unhappy with the way we are using your personal data you have the right to make a complaint to the Information Commissioners Office as the Supervisory Authority for the Isle of Man. Further details can be found at www.inforights.im

Will this Privacy Notice Change

From time to time we may amend this privacy notice to reflect changes in legislation, changes in our processing or experience of operating these services, and for other reasons or feedback we receive.

Any significant changes will be advised by a prominent notice on our website so that you can review the change. We will not reduce your rights under this Privacy notice without your consent. This Privacy notice was last updated July 2022.