Educater holds information from customer schools, nurseries and other organisations about both pupils and employees for the purpose of providing a service in accordance with the terms and conditions for contracted services. This information is held and processed in compliance with the General Data Protection Regulation (GDPR).
The customer remains the 'Data Controller' in respect of pupil data at all times. As such the school is obliged to ensure that the information provided is accurate and up to date. As part of the school's obligation as 'Data Controller', it must have necessary consent in place to collect pupil personal data.
The categories of pupil information that we collect, and hold, include:
- Personal Information (such as name, unique pupil number, address and contact details);
- Characteristics (such as ethnicity, language, gender and free school meal eligibility);
- Attendance Information (such as total attendance percentages and session details);
- Assessment details (such as end of key stage assessments);
- Special educational needs information.
Why we collect and use this information
We use the pupil data to allow schools/organisations:
- To monitor, track and report on pupil progress and attainment;
- To provide relevant services (sending electronic school to parent communications, creating SEND documentation, etc);
- To perform analysis on pupil data (average progress for vulnerable groups, etc).
The categories of employee information we collect, and hold, include:
- Personal Information (such as name, gender and contact details);
- Job Role Information (such as teaching status and teacher number).
Why we collect and use this information
We use the employee data to:
- Allow suitable staff members to log in and use the Educater system;
- Allow the school/organisation to perform relevant services (school/organisation wide employee emails, professional employee names on reports, etc).
The lawful basis on which we use this information
We collect and use this information under Article 6 (b) of the GDPR: the processing is necessary for a contract you have with an individual, or because they have asked you to take specific steps before entering into a contract.
As we collect the data of children (a special category of data) we also do so under Article 9(2)(j) of the GDPR: processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Data we collect is done so at the request of the organisation, this could be entered manually by the school/organisation or collected automatically from the organisation’s MIS system. We can only collect data from the MIS once the organisation has given us permission to do so (the exact process varies depending upon the MIS system used), and this permission can be revoked from the organisation at any time.
All data is stored securely within the EU, in compliance with GDPR and industry standard levels of security.
Educater retains data for differing periods of time depending upon the type of data, these retention policies are listed below:
- General correspondence regarding named individuals: This data will be deleted three years after the end of the contract. This is to allow for complaints to be managed effectively and to allow for services to be reinstated if the customer decides to renew their contract.
- Named pupil contacts and corresponding personal details: This data will be deleted after six months of a relevant pupil being removed from the system/organisation contract ending.
- Pupil data for pupils who have left the school: Pupil data is retained by Educater for two academic years after leaving. After this point personal data is anonymised and may be used for anonymised usage data and analysis.
- Pupil data after contract end: Pupil data will be anonymised after two years of the contract expiring, or if the customer requests this be done sooner.
- Pupil data provided to us for processing (e.g. data sent during the initial setup): This data will be deleted one year after processing, to aid customer services and in case of a dispute.
- Employee data: Employee names will be retained to show on historical data reports (if applicable), otherwise this will be anonymised one month after leaving. Other details will be deleted after this one-month period.
Anonymised data may be kept indefinitely for usage statistics and analysis.
Database backups are used and retained for 90 days – this means that data will persist in backups but not on live data for an additional 90 days after the timescales mentioned above.
Who we share data with?
We do not share any pupil or employee data with any third parties without express consent from the school first, an example of this could be sharing a school's data with the academy chain that the school belongs to.
We may also share data with the data subject at the request of this individual in compliance with a Subject Access Request.
Educater may share data with a third party if legally required to do so.