Privacy Notice (Children, Young People, Parents & Carers)

This Privacy Notice explains how The RISE Trust collects, uses, stores and shares personal information about children, young people and parents/carers (“parents”). We aim to be clear and open about what we do with personal data and why.

The RISE Trust is the Data Controller for the personal information we process.

What personal data we hold

We process personal information so we can run the trust, provide education and support, and keep children and young people safe. We may collect information directly from children/young people/parents, or from other sources such as settings, schools, the local authority and the Department for Education (DfE).

Examples of the personal data we may process include:

  • Personal identifiers and contact details (e.g. name, address, emergency contact details)
  • Characteristics (e.g. ethnicity, language, Early Years Pupil Premium eligibility)
  • Safeguarding information (e.g. court orders, professional involvement)
  • Special educational needs information
  • Medical and health information (e.g. allergies, medication, dietary needs)
  • Attendance information
  • Assessment and attainment information (e.g. EYFS assessments)
  • Behaviour information (e.g. exclusions, alternative provision)
  • Photographs (used only where appropriate and permission/consent is requested for promotional use)

Our lawful bases for using personal data

Data protection law requires us to have a lawful reason for processing personal data (UK GDPR Article 6). Depending on the activity, we may rely on one or more of the following:

  • Legal obligation – where we must comply with the law (for example, education and safeguarding duties)
  • Public task – where processing is necessary to perform our role in providing education
  • Consent – for example, for certain promotional photos or other optional uses
  • Vital interests – in life-or-death situations
  • Legitimate interests – where it is in the trust’s or a third party’s legitimate interests and this is not overridden by your rights

Where we rely on consent, you can withdraw it at any time. Where a child/young person is considered capable of making their own consent decisions (often once in secondary education), their choices will override those of a parent/guardian.

Special category (sensitive) personal data

Some information has extra legal protection (UK GDPR Article 9), such as data about racial/ethnic origin, religious beliefs, health information, biometric data, or sexual orientation. Where we process this type of information, we will identify an appropriate Article 9 condition, for example:

  • Legal obligation
  • Substantial public interest (including safeguarding, preventing/detecting unlawful acts, equality of opportunity, public health)
  • Support for individuals with a disability or medical condition
  • Explicit consent (e.g. biometric data, where used)
  • Vital interests

Criminal convictions data

We may process information about criminal convictions/offences where permitted by law, typically for safeguarding, preventing fraud, health and safety, supporting the police or other relevant agencies, or where consent applies.

How we collect information

We collect information in a range of ways, including via admissions/introductions, registration forms, correspondence, and through assessing educational, social and emotional progress. We may also receive information from third parties such as other settings/schools, social care, health professionals, the police, solicitors, and other partner agencies, where relevant.

Who we share information with

We do not share personal information with third parties without consent unless the law allows or requires us to do so (for example, for safeguarding, or where we must share data with the DfE).

Examples of organisations we may share information with (where lawful) include:

  • Wiltshire Council (Local Authority)
  • Schools a child attends after leaving our provision
  • Department for Education (DfE)
  • NHS (e.g. to support safety and vaccination programmes)
  • Family members and representatives (where appropriate)
  • Ofsted
  • Auditors, survey/research organisations, professional advisers
  • Security organisations
  • IT support providers
  • Health and social welfare organisations
  • Educational Psychologists (where appropriate)
  • Charities and voluntary organisations
  • Police, courts and tribunals
  • Our Data Protection Officer (e.g. to support a subject access request)
  • Occasionally, trustees (where appropriate and lawful)

Third-party processors (systems we use)

Sometimes we use external organisations/systems to process personal data on our behalf. These “processors” act under our instructions and are contractually required to meet GDPR standards.

Examples include:

  • Microsoft Teams – may process parent/carer name, email address, voice, and comments/opinions to support remote learning and communication.
  • Microsoft Office 365 – may process contact details, case records, safeguarding notes, action plans, progress data, EHCPs, meeting notes and related records to ensure work with families is recorded appropriately.

How we store and secure data

Personal data is stored securely in line with our data protection policy, including within child files, IT systems and our email system. We keep information for as long as necessary, including sometimes after a child/young person leaves, in line with our retention policies.

You can request a copy of our retention schedule from the RISE Trust office on 01249 463040.

International transfers

Where we transfer personal data outside the UK and European Economic Area, we do so in accordance with data protection law and ensure appropriate safeguards are in place.

Your rights (including Subject Access Requests)

You have rights under data protection law. This includes the right to request access to the personal information we hold about you (a “Subject Access Request”).

If we hold personal information about you and you make a request, we will provide:

  • a description of the information
  • why we hold it, how we use it, and how long we keep it
  • where we obtained it (if not from you)
  • who it has been or will be shared with
  • information about any automated decision-making (if applicable)
  • a copy of the information (normally within one month, unless an extension is needed due to complexity)

Children and young people have the same rights as adults. Requests will be considered case-by-case, including whether the child/young person can understand their rights. Parents with parental responsibility may make a request regarding a child’s information where appropriate.

Other rights include:

  • to request correction of inaccurate/incomplete data
  • to request deletion where there is no compelling reason to keep processing
  • to restrict processing in certain circumstances
  • to object where processing is based on public task or legitimate interests
  • to object to direct marketing (including profiling)
  • to withdraw consent (where consent is the basis)
  • to data portability in certain circumstances
  • not to be subject to purely automated decisions with legal/similarly significant effects (except in limited cases)
  • to seek redress via the ICO or the courts

Contact us

If you have questions or concerns, or want to exercise your rights, please contact:

  • The RISE Trust CEO – Tel: 01249 463040
  • Data Protection Officer (One West) – Email: i-west@bathnes.gov.uk – Tel: 01225 395959

Complaints

If you are unhappy with how we handle personal information, please contact us first using the details above. You can also complain to the Information Commissioner’s Office (ICO):

  • Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  • Helpline: 0303 123 1113
  • Website: https://www.ico.org.uk

Updates to this notice

We may update this Privacy Notice periodically. This version was last updated in February 2026.