Rationale for this Statement

Individuals have a number of rights in relation to their personal information (i.e., personal data) and these rights have been enhanced by the General Data Protection Regulation (GDPR), effective from the 25th May, 2018.

This Data Protection Statement describes how Scoil Thomáis collects and processes personal data, in accordance with GDPR and the school’s legal obligations generally in relation to the provision of education.

Processing is the legal term used to describe various acts including the collection, recording, organisation, structuring, storage, alteration, use of, retrieval, disclosure, or transmission of information.

This Statement applies to pupils, parents, and guardians. By enrolling a child in or by attending Scoil Thomáis, parents/guardians acknowledge and agree to the collection and processing of personal information by the school.

1. Who We Are and How to Contact Us

• Scoil Thomáis is a data controller responsible for personal data (information relating to an identified or identifiable natural person).
• Scoil Thomáis processes personal data; the school collects, records, stores, retains, and uses personal data.
• If you have any questions about this statement, including any request to exercise your legal rights, please contact us by email: secretary@scoilthomais.ie (Subject line: DATA PROTECTION).

2. Personal Information Collected

The school may collect the following personal information:

(i) Pupil Information

• Personal details: Name, address, date of birth, gender, PPS number, nationality, and emergency contact information.
• Special Education Needs (SEN): Learning needs, profiles, and educational support plans.
• Child Protection: Welfare information and psychological referral/assessment documentation.
• Academic records: School reports and permission for access to educational reports.
• Database Information: Information for the Primary Online Database (POD), SENO, TUSLA, and the HSE.
• Attendance: Records and explanatory notes in relation to absences.
• Behavioural records: Incident/accident reports, investigations, and outcomes.
• Permissions: Notes for school tours, trips, extra-curricular activities, and RSE/Stay Safe programmes.
• Media: Photographs and recorded images (including school events) and CCTV footage.

(ii) ‘Sensitive’ Personal Information – Pupils

The school may process special categories of sensitive information, including:

• Information about pupil’s health, medical certificates, medical needs, and allergies.
• Consent for the administration of medicine.
• Religious belief, membership of the Traveller Community, and racial or ethnic origin.

(iii) Parent / Guardian Information

• Contact details: Name, address, email address, and telephone number(s).
• Legal orders: Information regarding guardianship, custody, or access disputes.
• Demographics: Occupation, emergency contact details, number of children, and pupil’s position in family.
• Consents: Medical emergencies, school activities, and publication of schoolwork on the website/print media.
• Correspondence: Records or notes arising from interaction with the school.

3. Purpose & Legal Basis for Processing

Scoil Thomáis collects and processes personal information to perform our duties and responsibilities and to comply with legal obligations. We also process data to pursue the legitimate interests of the school, namely the effective operation and management of the school and managing the education and welfare needs of our pupils.

Lawful Purposes:

• (a) Legal Obligation: To comply with the Education Act 1998, Education (Welfare) Act 2000, EPSEN Act 2004, Health Act 1947, Children First Act 2015, and Safety Health and Welfare at Work legislation.
• (b) Legitimate Interests: To enable pupils to develop to their full potential; to ensure parents can be contacted in emergencies; and to report on educational progress.
• © Consent: For specific activities such as displaying photographs on the school website. Consent can be withdrawn at any time.

4. How Personal Information is Collected

• Pupils: Normally collected through the enrolment process. Additional information is gathered from third parties (e.g., former schools) and general interactions during the pupil’s time at the school.
• Parents and Guardians: Collected through the enrolment process and via subsequent requests during the term of enrolment.

5. Information and Third Parties

The School may receive from, share, and/or transfer information to:

• The Department of Education and Skills (DES).
• TUSLA (Child and Family Agency) and the HSE.
• The National Council for Special Education (NCSE).
• National Educational Psychological Service (NEPS).
• An Garda Síochána and School Insurance Providers.
• Third-Party Service Providers: Including the Pupil Management System (Aladdin), ICT providers, printers, lawyers, and cloud storage providers.

6. Data Retention and Transfers

• Retention: The School will only retain personal information for as long as necessary to fulfil the purposes it was collected for, including legal, accounting, or reporting requirements.
• International Transfers: If data is transferred outside the EU, the school will put in place appropriate measures (such as model contractual clauses approved by the European Commission) to ensure an adequate level of protection.

7. Individual Rights

Under GDPR, individuals have the following rights (subject to certain legal constraints):

1. Access: Request a copy of the personal information held about you.
2. Rectification: Correct inaccurate personal data.
3. Erasure: Request the deletion of personal information.
4. Restriction: Restrict the processing of your data.
5. Objection: Object to the use of data for legitimate interests.
6. Portability: Receive data in a machine-readable format to transmit to another controller.

To exercise these rights, please write to: FOR THE ATTENTION OF THE DATA CONTROLLER, Scoil Thomáis, Laurel Lodge, Castleknock, Dublin 15.

Ratification: This statement was ratified by the Board of Management at a meeting on 22nd June 2020.