Privacy Notice
MTO Persian School is a language supplementary school operating online, teaching the Persian Language to children aged 6-16 as well as adults wishing to learn or improve their knowledge of the language.
MTO Persian School uses the “Google G Suite for Education” platform and its other various products such as Google Meeting and Google Classroom for its online teaching. (You can read their Privacy Notice in Appendix I of the school’s Online Safety Policy).
MTO Persian School collects data and information about our pupils and their parents/carers so that we can operate effectively as a school. This privacy notice explains how and why we collect this information, what we do with it and what rights the pupils and parents have. The Data Protection Officer is Ghoncheh Dolatshahi, one of our schoolteachers as well as our Safeguard officer.
Why Do We Collect And Use Parent /Carer Information?
We collect and use parent/carer information under the following lawful bases:
1. where we have the consent of the data subject;
2. where it is necessary for compliance with a legal obligation;
3. where processing is necessary to protect the vital interests of the data subject or another person;
4. where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where the personal data we collect about parents/carers is sensitive personal data, we will only process it where:
1. we have explicit consent;
2. processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; and / or
3. processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, where we respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Please see our Data Protection Policy for a definition of sensitive personal data. We use the parent/carer data to support our functions of running a school, in particular:
1. to decide who to admit to the school;
2. to support pupil learning;
3. to monitor and report on pupil progress;
4. to provide appropriate pastoral care;
5. to assess the quality of our services;
6. to comply with the law regarding data sharing;
7. for the protection and welfare of pupils and others in the school, including our safeguarding / child protection obligations;
8. for the safe and orderly running of the school;
9. to promote the school;
10. to send you communications that may be of interest to you which may include information about school events or activities, news, campaigns, appeals, other fundraising activities;
11. in order to respond to investigations from our regulators or to respond to complaints raised by our stakeholders;
12. in connection with any legal proceedings threatened or commenced against the school.
The Categories of Parent/Carer Information That We Collect, Hold And Share Include:
1. Personal information (such as name, address, telephone number and email address);
2. Information relating to marital status, employment status, religion, ethnicity, language, medical conditions, nationality, country of birth and entitlement to certain benefits.
3. From time to time and in certain circumstances, we might also process personal data about parents / carers, some of which might be sensitive personal data such as bank account information.
Collecting Parent/Carer Information
Whilst the majority of information about parents/carers provided to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain parent/carer information to us or if you have a choice in this. Where appropriate, we will ask parents/carers for consent to process personal data where there is no other lawful basis for processing it, for example where we wish to request voluntary contributions. Parents/carers may withdraw consent given in these circumstances at any time.
Storing Parent/Carer Data
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, insurance or reporting requirements. [Details of retention periods for different aspects of your personal information are available in our Data Retention Policy which is available from our website. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Once you are no longer a parent/carer we will retain and securely destroy your personal information in accordance with applicable laws and regulations.
Who Do We Share Pupil, Parent/Carer Information With?
From time to time, we may share parent/carer information with other third parties including the
following:
• a local authority;
• a pupil’s home local authority;
• the Department for Education (DfE);
• school governors/trustees;
• the Police and law enforcement agencies;
• NHS health professionals including the school nurse, educational psychologists;
• Education Welfare Officers;Courts, if ordered to do so;
• the Teaching Regulation Authority;
• other schools, for example, if we are negotiating a managed move and we have your consent to
share information in these circumstances;
• examination boards and their centres such as Edexcel/OCR etc;
• our legal advisors;
• our insurance providers / the Risk Protection Arrangement;
Some of the organisations referred to above are joint data controllers. This means we are all responsible to you for how we process your data. In the event that we share personal data about pupils, parents/carers with third parties, we will provide the minimum amount of personal data necessary to fulfil the purpose for which we are required to share the data.
Requesting Access To Your Personal Data
Under data protection legislation, parents/carers have the right to request access to information about them that we hold (“Subject Access Request”). To make a request for your child’s personal data, or be given access to your child’s educational record, contact the school’s Administration
Manager. The legal timescales for the school to respond to a Subject Access Request is one calendar month. As the School has limited staff resources outside term time, we encourage parents/carers to submit Subject Access Requests during term time and to avoid sending a request during periods when the School is closed or is about to close for the holidays where possible. This will assist us in responding to your request as promptly as possible.
No Fee Usually Required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What We May Need From You
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person
who has no right to receive it. You also have the right to:
• object to processing of personal data that is likely to cause, or is causing, damage or distress;
• prevent processing for the purpose of direct marketing;
• object to decisions being taken by automated means;
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
• claim compensation for damages caused by a breach of our data protection responsibilities.
Right To Withdraw Consent
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Administration Manager at the school. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law
Data Protection Officer
We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO, Mandana Paymai, via the school. You have the right to make a complaint at
any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. You can contact the Information Commissioner’s Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.
Changes To This Privacy Notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information