Before continuing to your ECT Manager profile, please confirm you have read our Data Sharing Agreement which has been combined with our Privacy Policy. A Data Sharing Agreement is a formal document that sets out the terms and conditions under which data is shared between Star Appropriate Body and the individual user. It ensures that the sharing of data is lawful, secure, and transparent.
Star Teaching School Hub Network Appropriate Body Service – Data Sharing Agreement
Star Academies are registered as a data controller with the Information Commissioner’s Office (ICO). The registration number is Z3350256.
Introduction
1. This agreement sets out the framework for sharing data between the parties and defines the principles and procedures that both parties shall adhere to throughout the duration of this agreement.
2. All schools that offer a statutory induction are required to have an Appropriate Body for their Early Career Teachers. Appropriate Bodies play a key role in statutory teacher induction.
3. The sharing of data between both parties is necessary to support the following agreed purpose: The provision of an Appropriate Body service as defined in paragraph 3.
Data items to be shared
4. The full list of personal data covered by this agreement is shown in Appendix A.
5. The list shown in Appendix A covers all known data needed by this agreement.
6. The data shared will not be irrelevant or excessive with regards to the purposes outlined in paragraph 3 and 4.
7. The party sharing the data will ensure that shared personal data is accurate. Where either party becomes aware of inaccuracies in the shared data, they will notify the other party.
Fair processing of data
8. In line with the first principle of the UK General Data Protection Regulation (UK GDPR) (Lawfulness, Fairness and Transparency), personal data will only be processed providing it can be demonstrated that one of the conditions in Article 6 applies. The lawful condition(s) that apply to data processed under this agreement are as follows:
Article 6, 1(c) which allows processing that is necessary for compliance with a legal obligation to which the controller is subject.
Article 6, 1(e) which allows processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Special category data will only be processed providing it can be demonstrated that one of the lawful conditions in Article 9 of the UK GDPR and, if applicable, Section 10 of the UK Data Protection Act 2018, applies.
The separate condition(s) that apply to special category data processed under this agreement are as follows:
Article 9, Paragraph 2(g) of the UK GDPR which allows processing that is necessary for reasons of substantial public interest with a basis in law, and proportionate to the aim it has been pursued, respecting the essence of the right to data protection and providing suitable measures to protect the rights of the data subject.
Schedule 1, Part 2: Substantial public interest conditions, paragraph 6 of the Data Protection Act 2018: Statutory and government purposes.
- Star Academies and the user will notify data subjects (pupils, families, and staff) regarding which organisations their data may be shared with and the reasons for the data being shared in their privacy notices.
- Under the UK GDPR, parties to this agreement are acting as data controllers and, therefore, must comply fully with the UK GDPR and Data Protection Act 2018 and must be registered with the Information Commissioner’s Office (ICO) if required.
Legal basis for sharing
- Further to the provisions of the UK GDPR and the Data Protection Act 2018, sharing can be justified for the following purposes in accordance with the following legal gateways:
Part 8: Induction periods: teachers in England, Paragraphs 135A and 135B of the Education Act 2002
This requires Early Career Teachers employed by Local Education Authority (LEA) schools, individual academies, and Multi Academy Trust schools to complete a statutory induction period. The legislation also requires schools to have an Appropriate Body to decide whether a teacher has:
achieved the required standard and satisfactorily completed their induction period; or
should have their induction period extended by such a period as may be determined by the Appropriate Body; or
has failed to complete their induction period.
Part 8: Teacher misconduct etc: Paragraph 141C(1)(b), England of the Education Act 2002
This section is related to the list of persons prohibited from teaching held by the Secretary of State.
The overarching provisions of the Education (Induction Arrangements for School Teachers) (England) 2012
- Star Academies and the user may from time-to-time share information with third party organisations where there is an appropriate legal gateway or a statutory requirement to do so.
Access and rights
14. Data subjects have the right to obtain certain information about the processing of their personal data through a data subject access request (DSAR). Data subjects may also request rectification, erasure or blocking of their personal data.
15. Each party is the controller of the data it holds irrespective of its source, and each will respond to requests to exercise rights available under the UK General Data Protection Regulation (UK GDPR) in accordance with its own procedure. In relation to access requests, Information will not be withheld on the grounds of its having been received by the other party.
16. If necessary, both parties will provide reasonable and prompt assistance to each other to enable them to comply with DSARs and respond to any other queries from data subjects.
17. Any DSARs received by one party and requiring action from both parties should be notified to the other party for action within 72 hours of receipt. This should be responded to as soon as possible and within 14 working days to allow adequate time for processing and adherence with statutory deadline of 1 month for response to the requestor.
18. Both parties will maintain a comprehensive record of DSARs, corresponding documentation, the decisions made and any information that was exchanged.
Data retention and deletion
19. Both parties shall retain shared personal data in line with their own policies and procedures and in accordance with any statutory, professional, or industry specific retention periods. Star Academies retains personal data in accordance with our Records Management Policy.
20. Data will be confidentially destroyed and disposed of in a secure manner as part of electronic data base management.
Data security and breach procedure
21. Both parties to this agreement are responsible for ensuring appropriate security and confidentiality procedures are in place to protect personal data shared as part of this agreement when it is being transferred, stored, and used.
22. Each party will implement appropriate technical and organisational measures to protect any shared personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure.
23. Each individual organisation is responsible and shall, in line with their own policies and procedures, investigate any personal data breaches and report all serious breaches to the Information Commissioners Office within 72 hours of becoming aware of the breach.
24. In the event of a personal data breach, each Data Controller must give due consideration to:
informing the other party of the breach as soon as possible after identification; and
informing the data subject(s) of the breach if it is likely to result in a high risk to the rights and freedoms of an individual.
Complaints
25. This agreement is subject to the formal Complaints Procedures of all parties to the agreement.
26. Complaints from data subjects, or their representatives, regarding information exchanged and held under the terms of this agreement will be investigated in the first instance by the organisation receiving the complaint. Action which affects the other party will not be taken without appropriate consultation.
27. Breaches of data protection legislation will be dealt with under the formal disciplinary procedures of the parties to the agreement.
28. Monitoring of security will be undertaken in consideration with each organisation’s established procedures.
29. Discrepancies in data will be resolved by the relevant data providers at Star Teaching School Hub Network and the user.
Review of agreement
30. All parties undertake to conduct an annual review of this document to deem it fully effective and necessary and make any amendments as required.
31. If no amendments are required, this agreement will continue until the stated end date or until either party notifies in writing that they are withdrawing from this agreement.
Appendix A: List of Data Items shared between Star Academies and the user:
Personal information such as name, Teacher Reference Number (TRN), address, and other contact details (e.g., work and personal email address).
Attendance information, such as sessions attended, number of absences, and absence reasons.
Assessment information, such as progress and completion data.
Training and qualification information, such as where trained, type of qualification awarded, subject of study.
Fitness to teach information, this may include health information.
National insurance number.
Details of employing school and job role.
Safeguarding information, such as DBS clearance.
Regularity
Information will be shared as and when required during the Early Career Teacher’s induction period.
Star Teaching School Hub Network Appropriate Body Service – Privacy Policy
WHO PROCESSES YOUR INFORMATION?
Star Academies is the Data Controller of the personal information you provide to us. This means it determines the purposes for which, and the manner in which, any personal data relating to students and course participants is to be processed.
The Head of Governance and Corporate Services is our Data Protection Officer. The Data Protection Officer’s role is to oversee and monitor our data processing practices. If you have any queries regarding anything in this privacy notice, please write to:
Head of Governance and Corporate Services Data Protection Officer
Star Academies
Shadsworth Road
Blackburn
BB1 2HT
or email regulatory@staracademies.org
Where necessary, third parties may process personal information. Where this is required, Star Academies places data protection requirements on third party processors to ensure data is processed in line with privacy rights.
WHY DO WE NEED YOUR INFORMATION?
Star Academies has the legal requirement and a legitimate interest to collect and process personal data relating to those who enrol on our courses.
We process personal data in order to meet the safeguarding requirements set out in UK employment and childcare law, including those in relation to the following:
Funding Agreements and contracts with the Department for Education (DfE)
Legal and statutory framework
Safeguarding Vulnerable Groups Act 2006
The guidance “Keeping Children Safe in Education”
The Childcare (Disqualification) Regulations 2009
Personal data is also processed to assist in the running of Star Academies and Star Institute for the following reasons:
to facilitate safer recruitment, as part of our safeguarding obligations towards pupils;
to enable us to establish relevant and required experience and qualifications;
to support professional development;
to inform the development of Star Academies’ policies;
to enable equalities monitoring;
to ensure that appropriate access arrangements can be provided for students or participants that require them;
to allow better financial modelling and planning;
to assess the quality of our services; and
to comply with the law regarding data sharing.
INFORMATION THAT WE COLLECT, PROCESS, HOLD AND SHARE INCLUDES:
personal information (i.e. name, address, employee or teacher reference number, national insurance number);
characteristics (i.e. age, gender);
special categories of data (i.e. ethnicity, biometrics, health);
cctv images;
photographs and video recordings;
copies of right to work documentation;
employment records, including work history, job titles, training history and professional memberships;
education history (i.e. schools and universities/colleges attended);
qualifications;
funding information;
references;
assessment information; and
relevant medical information.
THE LAWFUL BASIS ON WHICH WE PROCESS THIS INFORMATION
Article 6 1(b) of the GDPR which allows processing that is necessary for the performance of a contract;
Article 6 1(c) of the GDPR which allows processing that is necessary to comply with a legal obligation;
Article 6 1(e) of the GDPR which allows processing that is carried out in the public interest;
Article 9 2(b) of the GDPR which allows the processing of special category data that is necessary for carrying out obligations in the fields of employment and social security and social protection law;
Article 9 2(g) of the GDPR which allows the processing of special category data that is necessary for reasons of substantial public interest;
Article 9 2(j) of the GDPR which allows the processing of special category data when it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Star Academies maintains Records of Processing that identify the lawful basis on which personal information is processed.
COLLECTING INFORMATION
Whilst the majority of information that you provide to us is mandatory, some of it is provided on a voluntary basis. In order to comply with data protection legislation, we will inform you when your consent is required. Personal data may be obtained and processed from third parties where the law requires us to do so.
STORING INFORMATION
Personal data is stored in line with our Records Management Policy. In accordance with data protection legislation, it is only retained for as long as necessary to fulfil the purposes for which it was obtained, and not kept indefinitely.
DATA TRANSFERRED OUTSIDE THE EU
Processors that we use may transfer, and hold, personal data outside of the EU. We will ensure that organisations who process personal data on our behalf only transfer data to countries that the EU deems as having adequate levels of protection in place. Processors that transfer data to the United States must be covered by the EU-US Privacy Shield. If a processor is found to be transferring data to a country that does not have adequate protections, or to an organisation that is not covered by the EU-US Privacy Shield, we will terminate our contract/subscription.
WHO WE SHARE DATA WITH
We do not share information about students or participants with anyone without consent unless the law and our policies allow us to do so. We share information with the following:
Local Authorities
Department for Education (DfE)
Student Loans Company
Funding Providers (Bursary Services and Scholarship Providers)
Delivery partners (e.g. University of Cumbria and Manchester Metropolitan University)
Teaching Regulation Agency (formerly the National College for Teaching and Leadership)
Office of the Independent Adjudicator (OIA)
Police
Social Services
Payroll providers
External Examiners
Course Tutors
Occupational health and wellbeing providers
Schools
Management Information Systems (e.g. Capita SIMS, NQT Manager, Safeguarding and accident reporting systems)
Print Management Software providers
Providers of visitor management and access control systems
Providers of online learning resources
Providers of financial management software
Photography and design agencies
WHAT ARE YOUR RIGHTS?
As the data subject, you have specific rights in relation to the processing of your data. You have a legal right to:
Request access to the personal data that Star Academies holds.
Request that your personal data is amended if it is inaccurate or incomplete.
Request that your personal data is erased where there is no legal basis for its continued processing.
Request that the processing of your personal data is restricted.
Object to your personal data being processed if it is likely to cause, or is causing, damage or distress.
Requests must be submitted in writing to the Data Protection Officer (contact details above). Star Academies also has a Subject Access Request Form that may be obtained from Star Institute. Star Academies will consider all requests in line with your legal rights and our legal obligations.
Where the processing of your data is based on your explicit consent, you have the right to withdraw your consent at any time. This will not affect any personal data that has been processed prior to withdrawing consent.
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with the Data Protection Officer in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns