It is the policy of VJ Learning Centre to ensure, as far as is reasonably practicable, the health, safety and welfare of the children it cares for, its staff members and other persons who may be affected by its operations. A summary of key policies can be seen below. If you would like a full copy of any VJ Learning Centre policy please ask your VJ Learning Centre Management Team.
Introductory Statement
VJ Learning Centre needs to hold and to process large amounts of personal data about its students, employees, applicants, contractors and other individuals in order to carry out its business and administrative functions.
By personal data, VJ Learning Centre refers to any information relating to an identified or identifiable natural person (data subject) who can be identified, directly or indirectly by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Personal data includes sensitive personal data and pseudonymised personal data but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour.
This policy is intended to ensure that personal data is dealt with properly and securely and in accordance with General Data Protection Regulation (GDPR) and The Data Protection Act 2018 (DPA).
GDPR and DPA are the laws that protect personal privacy and uphold individual rights. These laws were set to strengthen and unify all data held within an organisation. It explains what kind of information teachers should keep, how to obtain and store this information and how long it should be kept. GDPR and DPA apply to anyone who handles or has access to people’s personal data.
This policy will apply to personal information regardless of the way it is used, recorded and stored and whether it is held in paper files or electronically.
Policy Objectives
VJ Learning Centre aims to help children and seeks to enable each student to develop his/her full potential. Part of our mission is to provide a safe and secure environment for learning and encourage children to develop a positive attitude and respect for themselves and others. Complying with its obligations under the GDPR and DPA, the Children’s Act 1989, the Childcare Act 2006, and all other relevant legislation is a fundamental aspect of its mission.
VJ Learning Centre is committed to being concise, clear and transparent about how it obtains and uses personal information and will ensure data subjects are aware of their rights under the legislation.
VJ Learning Centre supports that a Data Subject is a living, identified or identifiable individual about whom we hold personal data. Data Subjects may be nationals or residents of any country and may have legal rights regarding their personal data.
All staff must have a general understanding of the law and understand how it may affect their decisions in order to make an informed judgement about how information is gathered, used and ultimately deleted. All staff must read, understand and comply with this policy.
This policy aims to
ensure that VJ Learning Centre complies with its obligations under the GDPR and DPA.
ensure that the data protection rights of students, staff and other members of the VJ Learning Centre are safeguarded.
Scope of the Policy
This policy applies to the keeping and processing of personal data, both in manual form and on the computer, including personal data held by both staff and pupils.
GDPR Article 4 defines Personal data as any information that relates to an identified or identifiable living individual who can be identified directly or indirectly from the information. The information includes factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of a living individual. This includes any expression of opinion about an individual and intentions towards an individual. Under the GDPR personal information also includes an identifier such as a name, an identification number, location data or an online identifier.
VJ Learning Centre collects a large amount of personal data every year including pupil records, staff records, names and addresses of those making enquiries, examination marks, references, fee collection as well as the many different types of research data used by VJ Learning Centre. In addition, it may be required by law to collect and use certain types of information to comply with statutory obligations of law enforcement agencies, government agencies and other bodies.
The policy applies to all staff, the board of management, parents/guardians, pupils and others insofar as the measures under the policy relate to them. The policy also applies to all locations from which personal data is accessed including off-campus.
Contents of the Policy
The policy content is divided into two sections as follows:
Section A:
Details of all personal data which will be held, the format in which it will be held and the purpose(s) for collecting the data in each case.
Section B:
Details of the arrangements in place to ensure compliance with the principles set out in the GDPR.
Section A:
Details of all personal data which will be held, the format in which it will be held and the purpose(s) for collecting the data in each case.
Personal data is subject to the legal safeguards specified in the GDPR.
Staff records:
These may include:
Storage Format
The format in which the above records will be kept will be either manual record (personal file within filing system), computer record (database) or both. They will be kept securely in accordance with the VJ Learning Centre’s data protection obligations.
The purpose of keeping staff records
At VJ Learning Centre, Staff data is essential for operational use and facilitate other administrative tasks.
Student records
These may include:
Storage Format
The format in which the above records will be kept will be either manual record (personal file within filing system), computer record (database) or both. They will be kept securely in accordance with the VJ Learning Centre’s data protection obligations.
The purpose for keeping student records
At VJ Learning Centre, student data is essential to enable each student to develop his/her full potential, to comply with legislative or administrative requirements, to ensure that eligible students can benefit from the relevant additional teaching or financial support, to support the provision of religious instruction, to enable parent/guardians to be contacted in the case of emergency.
Board of Management records
These may include:
Storage Format
The format in which the above records will be kept will be either manual record (personal file within filing system), computer record (database) or both. They will be kept securely in accordance with the VJ Learning Centre’s data protection obligations.
The purpose for keeping Board of Management records
At VJ Learning Centre, the Board of Management details are essential to record board appointments and document decisions made by the board.
Section B
Details of the arrangements in place to ensure compliance with the principles set out in the GDPR.
This policy sets down the arrangements in place to ensure that all personal data records held by VJ Learning Centre are obtained, processed, used and retained in accordance with the following principles set out in the GDPR:
Lawfulness, Fairness and Transparency
Purpose Limitation
Data Minimisation
Accuracy
Personal data shall be accurate and where necessary kept up to date and every reasonable step must be taken to ensure that personal data that are inaccurate are erased or rectified without delay.
Storage Limitation
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the personal data is processed
Integrity and Confidentiality
Appropriate technical and organisational measures shall be taken to safeguard the rights and freedoms of the data subject and to ensure that personal information is processed in a manner that ensures appropriate security of the personal data and protects against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
A student aged between 12 and 16 would be required to give consent themselves and, in addition, consent should also be obtained from the student’s parent or guardian. In the case of students under the age of twelve consent from a parent or guardian will suffice. Individuals aged 18 or older may give consent themselves.
Transfer Limitation
In addition, personal data shall not be transferred to a country outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data as determined by the European Commission or where the organisation receiving the data has provided adequate safeguards.
Processing means anything done with personal data, such as collection, recording, structuring, storage, adaptation or alteration, retrieval, use, disclosure, dissemination or otherwise making available, restriction, erasure or destruction. These may be provided by a legally binding agreement between public authorities or bodies, standard data protection clauses provided by the ICO or certification under an approved mechanism.
This means that individuals’ rights must be enforceable and effective legal remedies for individuals must be available following the transfer. It may also be possible to transfer data where the data subject has provided explicit consent or for other limited reasons. Staff should contact the DPO if they require further assistance with a proposed transfer of personal data outside of the EEA.
Lawful Basis for processing personal information
Before any processing activity starts for the first time, and then regularly afterwards, the purpose(s) for the processing activity and the most appropriate lawful basis (or bases) for that processing must be selected:
Withdrawal of consent
Data subjects must be easily able to withdraw consent to processing at any time and withdrawal must be promptly honoured. Consent may need to be reviewed if personal data is intended to be processed for a different and incompatible purpose which was not disclosed when the data subject first gave consent.
The decision as to which lawful basis applies must be documented, to demonstrate compliance with the data protection principles and include information about both the purposes of the processing and the lawful basis for it in VJ Learning Centre’s relevant privacy notice(s).
Sensitive Personal Information
Processing of sensitive personal information (known as ‘special categories of personal data) is prohibited in line with Article 9 of GDPR unless a lawful special condition for processing is identified.
Sensitive personal information is data which reveals the racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or orientation or is genetic or biometric data and personal data relating to criminal offences and convictions, which uniquely identifies a natural person.
Sensitive personal information will only be processed if:
VJ Learning Centre privacy notice(s) set out the types of sensitive personal information that it processes, what it is used for, the lawful basis for the processing and the special condition that applies.
Sensitive personal information will not be processed until an assessment has been made of the proposed processing as to whether it complies with the criteria above and the individual has been informed (by way of a privacy notice or consent) of the nature of the processing, the purposes for which it is being carried out and the legal basis for it.
Unless VJ Learning Centre can rely on another legal basis of processing, explicit consent is usually required for processing sensitive personal data. Evidence of consent will need to be captured and recorded so that VJ Learning Centre can demonstrate compliance with the GDPR.
Automated Decision Making
Where VJ Learning Centre carries out automated decision making (including profiling) it must meet all the principles and have a lawful basis for the processing. Explicit consent will usually be required for automated decision making (unless it is authorised by law or it is necessary for the performance of or entering into a contract).
Additional safeguards and restrictions apply in the case of solely automated decision-making, including profiling. VJ Learning Centre must as soon as reasonably possible notify the data subject in writing that a decision has been taken based on solely automated processing and that the data subject may request VJ Learning Centre to reconsider or take a new decision. If such a request is received staff must contact the Data Protection Officer as VJ Learning Centre must reply within 21 days. Contact details are below:
Data Protection Officer
VJ Learning Centre Ltd
8 – 10, Fieldhead Shopping Centre
Legrams Lane
Bradford – BD7 1ND
Email: info@vjlearningcentre.co.uk
Data Protection Impact Assessments
VJ Learning Centre’s processes must embed privacy considerations and incorporate appropriate technical and organisational measures in an effective manner to ensure compliance with data privacy principles.
Documentation and records
Written records of processing activities must be kept and recorded including:
personal data
Privacy Notice
VJ Learning Centre will issue privacy notices as required, informing data subjects (or their parents, depending on the age of the pupil, if about pupil information) about the personal information that it collects and holds relating to individual data subjects, how individuals can expect their personal information to be used and for what purposes.
When information is collected directly from data subjects, including for HR or employment purposes, the data subject shall be given all the information required by the GDPR including the identity of the DPO, how and why VJ Learning Centre will use, process, disclose, protect and retain that personal data through a privacy notice (which must be presented when the data subject first provides the data).
When information is collected indirectly (for example from a third party or publicly available source) the data subject must be provided with all the information required by the GDPR as soon as possible after collecting or receiving the data. VJ Learning Centre must also check that the data was collected by the third party in accordance with the GDPR and on a basis which is consistent with the proposed processing of the personal data.
VJ Learning Centre will issue a minimum of two privacy notices, one for pupil information, and one for workforce information, and these will be reviewed in line with any statutory or contractual changes.
Individual Rights
Staff, as well as any other ‘data subjects’, have the following rights in relation to their personal information:
Individual Responsibilities
During their employment, staff may have access to the personal information of other members of staff, suppliers, clients or the public. VJ Learning Centre expects staff to help meet its data protection obligations to those individuals.
If you have access to personal information, you must:
Information Security
VJ Learning Centre will use appropriate technical and organisational measures to keep personal information secure, to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage.
All staff are responsible for keeping information secure in accordance with the legislation and must follow VJ Learning Centre’s acceptable usage policy.
VJ Learning Centre will develop, implement and maintain safeguards appropriate to its size, scope and business, its available resources, the amount of personal data that it owns or maintains on behalf of others and identified risks (including use of encryption and pseudonymisation where applicable). It will regularly evaluate and test the effectiveness of those safeguards to ensure the security of processing.
Staff must guard against unlawful or unauthorised processing of personal data and against the accidental loss of, or damage to, personal data. Staff must exercise particular care in protecting sensitive personal data from loss and unauthorised access, use or disclosure.
Staff must follow all procedures and technologies put in place to maintain the security of all personal data from the point of collection to the point of destruction. Staff may only transfer personal data to third-party service providers who agree in writing to comply with the required policies and procedures and who agree to put adequate measures in place, as requested.
Staff must maintain data security by protecting the confidentiality of personal data. This means that only people who have a need to know and are authorised to use the personal data can access it.
Staff must maintain data security by protecting the integrity of personal data. This means that personal data is accurate and suitable for the purpose for which it is processed.
Staff must maintain data security by protecting the availability of personal data. This means that authorised users can access personal data when they need it for authorised purposes.
Staff must comply with and not attempt to circumvent the administrative, physical and technical safeguards VJ Learning Centre has implemented and maintains in accordance with the GDPR and DPA.
Where VJ Learning Centre uses external organisations to process personal information on its behalf, additional security arrangements need to be implemented in contracts with those organisations to safeguard the security of personal information. Contracts with external organisations must provide that:
the organisation will submit to audits and inspections, provide VJ Learning Centre with whatever information it needs to ensure that they are both meeting their data protection obligations, and tell VJ Learning Centre immediately if it does something infringing on data protection law.
Before any new agreement involving the processing of personal information by an external organisation is entered into, or an existing agreement is altered, the relevant staff must seek approval from the Data Protection Officer.
Storage and retention of personal information
Personal data will be kept securely in accordance with the VJ Learning Centre’s data protection obligations. Personal data should not be retained for any longer than necessary. The length of time data should be retained will depend upon the circumstances, including the reasons why personal data was obtained. Personal information that is no longer required will be deleted in accordance with VJ Learning Centre’s Record Retention Schedule.
Data breaches
A data breach may take many different forms:
VJ Learning Centre must report a data breach to the Information Commissioner’s Office (ICO) without undue delay and where possible within 72 hours if the breach is likely to result in a risk to the rights and freedoms of individuals. VJ Learning Centre must also notify the affected individuals if the breach is likely to result in a high risk to their rights and freedoms.
Staff should ensure they inform their line manager or Data Protection Officer immediately that a data breach is discovered and make all reasonable efforts to recover the information, following VJ Learning Centre’s agreed breach reporting process.
Training
VJ Learning Centre will ensure that staff are adequately trained regarding their data protection responsibilities.
Consequences of a failure to comply
VJ Learning Centre takes compliance with this policy very seriously. Failure to comply puts data subjects whose personal information is being processed at risk and carries the risk of significant civil and criminal sanctions for the individual and VJ Learning Centre and may in some circumstances amount to a criminal offence by the individual.
Any failure to comply with any part of this policy may lead to disciplinary action under VJ Learning Centre’s procedures and this action may result in dismissal for gross misconduct. If a non-employee breaches this policy, they may have their contract terminated with immediate effect.
If you have any questions or concerns about this policy, you should contact your line manager or the VJ Learning Centre’s Data Protection Officer.
Review of Policy
This policy will be updated as necessary to reflect best practices or amendments made to the GDPR or DPA. This version was last updated on 28 February 2022.
Statement
Considering the current pandemic, VJ Learning Centre intends to implement this policy to minimise the risk of disease transmissions by providing precautionary measures across all of its relevant environments. The policy has been developed in light of the guidance shared by the government for Educational & Childcare settings.
Policy Guidelines
The policy guidelines described below apply to children, parents, visitors and staff members. All guidelines must be strictly followed and the tuition reserves the right to enforce them to ensure total compliance with the UK government’s guidance.
Children
Parents & Visitors
Staff
Staff should only attend if they are symptom-free, have completed the required isolation period or achieved a negative test result. All staff and their household are eligible for testing if they display symptoms.
Precautionary Measures
Handwashing
Cleaning
Food
Premises
Breaks
PPE
Responding to a suspected case