Back to homepage

Privacy and Data Protection

Who is responsible for your information

I am Andy Leary-May. I am responsible for the personal information collected through this project.

I have created this project to receive and understand accounts from adults who have experience of Michaela Community School, and to establish whether similar experiences are being reported independently by different people.

For questions about your information, to exercise your data protection rights or to raise a concern, please use [privacy/data-rights contact route].

What information I collect

If you share an experience, I may collect your name and contact details; your connection with Michaela and approximately when that connection took place; the account you provide; subsequent correspondence with you; relevant documents or other information you later choose to provide; and records of any permissions or agreements concerning subsequent use of your account.

The project is for people aged 18 or over. I do not ask for your date of birth or routine proof of identity.

Accounts may sometimes contain information about other people, including children. They may also contain sensitive information, for example about health, SEND, ethnicity, religion or alleged wrongdoing. Please include only information that is relevant and avoid unnecessary names or identifying details, particularly about other pupils.

Why I use your information

I use information provided to me to:

- receive and understand your account;

- contact you where clarification or follow-up is necessary;

- assess the provenance and reliability of information;

- compare independently provided accounts and identify whether common patterns exist;

- keep appropriate records of permissions and subsequent use; and

- consider what, if anything, should happen if substantial and corroborated concerns emerge.

Providing an account does not give permission for it to be published or disclosed.

Legal basis

For ordinary personal information, my proposed lawful basis is legitimate interests: the legitimate interest in receiving, assessing and comparing accounts about experiences of a school in order to understand whether matters of wider concern may exist.

I will only use information where doing so is necessary and proportionate for those purposes, taking account of the rights and interests of the people concerned.

[LEGAL REVIEW REQUIRED BEFORE SUBMISSIONS OPEN: insert the confirmed basis/conditions for special-category information and criminal-offence information.]

That distinction matters because legitimate interests can provide the Article 6 basis, but it does not itself solve sensitive-data processing: special-category information requires an additional Article 9 condition, while criminal-offence data requires the relevant Article 10/DPA 2018 authority or condition. Information Commissioner's Office

Confidentiality and sharing

Your account will be treated as confidential.

Before identifying you, quoting you publicly or sharing your identifiable account with a journalist, lawyer, regulator or anybody else, I will discuss the proposed use with you and seek your agreement.

There are limited exceptions. I may disclose information where I am legally required to do so or where an immediate safeguarding concern makes it necessary to act. In those circumstances, I will disclose only information that I consider necessary. Where appropriate and lawful, I will tell you what I have done, although I cannot always promise advance notice.

Removing somebody's name does not necessarily make information anonymous. Distinctive circumstances may still identify a person, and I will take this into account before using or sharing material.

Security

Access to identifiable accounts will be restricted. I will use protected accounts, two-factor authentication where available, secure devices and appropriate storage and transfer arrangements.

I will minimise unnecessary copies and downloads.

The online form, website and storage services necessarily involve service providers processing information to operate those services. [Insert final provider/processor and international-transfer information once the technical setup is fixed.]

No online system can guarantee complete security, but I will take reasonable measures appropriate to the sensitivity of the information being collected.

How long I keep information

I will keep identifiable information only for as long as it is reasonably needed for the purposes described above or to meet a specific legal requirement.

I will review retained information at least every six months and when the project materially changes or ends. I will consider whether further contact or verification remains reasonably likely; the information remains necessary for assessing patterns; it relates to an ongoing safeguarding, regulatory or legal matter; less identifiable information would now be sufficient; or it should be securely deleted or anonymised.

Where information needs to be retained for longer, the reason will be recorded and reviewed.

Your rights

Depending on the circumstances and applicable law, you may have rights including access to your personal information, correction of inaccurate information, erasure, restriction of processing and objection to processing.

Where processing is based on legitimate interests, you have a right to object. I will consider your circumstances and explain the outcome.

Some rights are not absolute. For example, responding to a request may require consideration of the privacy and rights of other people whose information appears in the same material.

Where I rely on consent for a particular subsequent use of information, you may withdraw that consent for future processing without affecting processing that was lawful before withdrawal.

To exercise a right or ask a question about your information, use [privacy/data-rights contact route]. I may need to take proportionate steps to establish your identity before releasing personal information.

You may also complain to the Information Commissioner's Office.

Other information

Providing an account is voluntary. Genuine name and contact details are, however, required if you choose to use this submission route.

I do not use solely automated decision-making to make decisions about individuals that have legal or similarly significant effects.