We develop quality thinking and inspire children to learn without limits.
Read our Child Friendly Privacy Notice for Pupils (PDF 313KB)
The Headteacher in the name of Andreas School as Data controller
The Headteacher, in the name of Andreas School, is a data controller for the purposes of the Data Protection Act 2002/General Data Protection Regulation (Isle of Man) Order 2018. The contact details for the Data Controller are Andreas School of Andreas Village, Ramsey, Isle of Man IM7 4EZ.
In addition to the information set out in the Isle of Man Privacy Notice, we may also collect the following information about your child as required by the Education Act 2001 and the Registration of Pupils Regulations 2016:
The Data Protection Officer for the Department of Education, Sport and Culture is: Andrew Shipley, Department of Education, Sport and Culture, Hamilton House, Douglas. IM1 5EZ. Tel 01624 685828. Email: DPO-DESC@gov.im.
Andreas School may use your information to:
Andreas School has a statutory obligation to check and verify the data you provide to us on registration documents and on consent forms. This may include checks of publicly available information but in some cases, where it is necessary and relevant, the information you provide may be disclosed or shared with other organisations.
App or Service | Details | Consent Required |
---|---|---|
Arbor |
Data Shared: Pupil record Sharing Basis: Public interest + official authority of the DC Security Protocols: Server/Data Location: EEA Retention Period: DOB + 25 years |
No |
Book creator |
Data Shared: name, email address, a password and the school name Security Protocols: Access Conditions: Supervised Teacher Access: Yes Server/Data Location: US |
Yes |
DESC Attendance |
Data Shared: Name, School, Attendance data if less than 80% Sharing Basis: Public interest + official authority of the DC Security Protocols: Secure access or information sent by email password protected Server/Data Location: EEA Retention Period: As needed while resolving issues |
No |
DHSC Dental Survey |
Data Shared: Child’s name, date of birth Security Protocols: Information sent password protected with the password sent via an alternative means of communication Server/Data Location: EEA Retention Period: Current year |
Yes |
DHSC School / Community Nurses |
Data Shared: Child's name, date of birth, current address, previous address, current school and previous school Security Protocols: Information sent password protected with the password sent via an alternative means of communication Server/Data Location: EEA Retention Period: Current year |
Yes |
Dolphin Gala |
Data Shared: Names, DOB, school Security Protocols: Password protected email / paper copy handed to organisers Server/Data Location: EEA Retention Period: Deleted after competition |
Yes |
Evolve |
Data Shared: Name, contact details, trip information and risk assessments Sharing Basis: Public interest + official authority of the DC Security Protocols: Server/Data Location: UK Retention Period: Current year + 6 years |
No |
|
Data Shared: Photos, names Security Protocols: Password protected, Two-factor authentication. Server/Data Location: Worldwide including the US Retention Period: Current year |
Yes |
|
Data Shared: No personal information should be stored on Google servers by staff apart from a name, class grouping, email address and information regarding work completed or to be completed Sharing Basis: Public interest + official authority of the DC Security Protocols: Google adheres to several self regulatory frameworks, including the EU-US Privacy Shield arrangement. Access Conditions: No Teacher Access: Limited to areas set up by staff such as Google Classrooms and shared areas Server/Data Location: Worldwide including the US Retention Period: DOB + 21 years or 3 years since the last log on |
Yes |
|
Data Shared: Photos only Sharing Basis: To promote school in the community and celebrate its' achievements. Security Protocols: Data Shared: Photos Access Conditions: Supervised - not accessed in school for home use by adults unless consent given Teacher Access: Yes it's public Server/Data Location: USA Retention Period: Until deleted |
Yes |
ItsLearning |
Data Shared: Name, class, school work Sharing Basis: Public interest + official authority of the DC Security Protocols: Username and password Access Conditions: No Teacher Access: Yes Server/Data Location: EEA Retention Period: End of Use + 12 months |
No |
Junior Achievement |
Data Shared: Name. class, year group Security Protocols: Retention Period: Until after event |
Yes |
Juniorlibrarian |
Data Shared: Name and class Access Conditions: Supervised Teacher Access: Yes Server/Data Location: EEA Retention Period: Upon leaving school |
Yes |
Language link / Speech |
Data Shared: Name, DOB. email & telephone number of school Security Protocols: Encryption, access restriction and physical security Teacher Access: Yes Server/Data Location: EEA Retention Period: 3 years |
No |
Microsoft Teams |
Data Shared: Sharing Basis: Public interest to assist with remote education during period of school closures. Security Protocols: Teams enforces team-wide and organization-wide two-factor authentication, single sign-on through Active Directory, and encryption of data in transit and at rest. Files are stored in SharePoint and are backed by SharePoint encryption. Access Conditions: Supervised and unsupervised. Teacher Access: Yes Server/Data Location: EEA Retention Period: August after pupil leaves school |
No |
ParentPay |
Data Shared: Sharing Basis: Schools have signed up for the service and their legal basis is: 'processing is necessary for the performance of a task carried out in the public interest' Security Protocols: Server/Data Location: UK Retention Period: |
Yes |
Quesmedia Sites |
Data Shared: Website activity, website form submissions and user content. Sharing Basis: To provide public website services for our school Security Protocols: Access Conditions: None Teacher Access: Limited to data provided within the CMS Server/Data Location: United Kingdom (EEA) Retention Period: Please view the more information link for data retention policies. |
No |
Scratch |
Data Shared: Access Conditions: Supervised and unsupervised Server/Data Location: US Retention Period: When requested |
Yes |
Sumdog |
Data Shared: child's name, date of birth, school, class and year group. Educational progress data. Analytics data. Teacher contact info Security Protocols: Teacher Access: Yes Server/Data Location: US Retention Period: Upon leaving school |
Yes |
Transition between primary and secondary school |
Data Shared: Transition activities / work done in transition lessons / pupil record Sharing Basis: In the public interest and official authority of the data controller. Security Protocols: Emails on secure servers; for ‘online.sch.im’ a google service self regulatory frameworks, including the EU-US Privacy Shield arrangement. Access Conditions: Supervised and unsupervised Teacher Access: Yes Server/Data Location: United Kingdom (EEA) Retention Period: DOB + 21 years or 3 years since the last log on |
No |
Venture Centre |
Data Shared: Name, age, DOB, gender, address, medical info Server/Data Location: Paper copy Retention Period: Shredded after visit |
Yes |
Zoom |
Data Shared: Sharing Basis: Consent Security Protocols: Access Conditions: Supervised and unsupervised Teacher Access: Yes Server/Data Location: Data routed through servers in China. USA Retention Period: Individual accounts when deleted |
Yes |
For more specific details about retention periods see the Department’s retention schedule
Information obtained or disclosed by third parties will not be used for any other purpose other than supporting the delivery of teaching and learning.
Failure to provide information may impact on support in school, the quality of teaching and learning and in achievement in examinations.
Andreas School will:
Apps and services that are used in school may require data to be stored on servers outside of the EEA. Information sent to these will be limited and are as detailed above.
You can find out more information including:
You have a right to access your personal data to ensure that it is accurate, and to request that it is rectified, blocked, erased or destroyed if it is inaccurate.
To make any request relating to your data held by us, please contact the Data Protection Officer for the Department of Education, Sport and Culture who is: Andrew Shipley, DPO. Hamilton House, Peel Road. Douglas. IM1 5EZ. Tel 685828. Email DPO-DESC@gov.im
If you are not satisfied with the response you receive, you may also complain to the Information Commissioner, whose details can be found on www.inforights.im, or the relevant supervisory authority. You may have a right to other remedies.