PRIVACY NOTICE
DATE POLICY WAS APPROVED 30/04/2025
DATE POLICY WILL BE REVIEWED SPRING 2026
MEMBER OF STAFF WITH RESPONSIBILTY FOR REVIEW HOIT
What is a Privacy Notice?
The Data Protection Act 2018 (UKGDPR) gives everyone the right to be informed about how their information
is used by organisations. This Privacy Notice explains how we use information about individuals who engage
as participants with the Haybridge Teaching School Hub, part of The Four Stones Multi Academy Trust.
This Privacy Notice explains:
▪ why we use your personal data
▪ the reasons we need to do this
▪ what kinds of personal data we use
▪ where we collect your personal data from
▪ who we will share your personal data with
▪ how you can find out more.
Who processes your information?
The Four Stones Multi Academy Trust is the “Data Controller” of personal data. This means that the Trust
and its academies are responsible for deciding how to use the personal information we hold about individuals
who use our Teaching School Hub.
We refer to information that identifies you as “personal data”. When we use your personal data in different
ways, this is called “processing”. The Data Protection Act (2018) outlines how personal data should be
protected and processed appropriately by organisations including schools.
All staff employed by the Trust receive regular data protection training so that they understand how to use
personal data appropriately.
Where we choose to share your information with people and/or organisations who provide essential systems
and services to our Teaching School Hub, we ensure that the same data protection standards are in place.
If sharing your information with service providers is not essential, we will always ask for your consent
(permission) before this takes place.
The Trust has a Data Protection Officer (provided by Services 4 Schools Ltd). Their role is to oversee and
monitor our Trust’s data protection procedures, and to ensure they are compliant with data protection
legislation. The data protection officer can be contacted by emailing: DPO@the4stones.co.uk
The categories of personal information that we process include:
▪ Personal identifiers and contacts (such as name, contact details, address, and Teacher Registration
Number)
▪ Characteristics (such as gender, ethnicity, language, or disabilities)
▪ Images (such as photographs and CCTV images)
▪ Medical and administration (allergies, medication, and dietary requirements)
▪ Attendance Information (such as courses/sessions attended, number of absences)
▪ Performance and Development (results from assessments or accreditation)
Why we collect and use your information.
Most of the information we collect about participants is used to help perform our duties as a public authority.
These include:
▪ To administrate the activities and services we undertake
▪ Advertising of future activities
▪ To signpost/invite current and alumni participants to future events
▪ To assess the quality of our services
▪ To comply with the requirements of our funding authorities
▪ To assess the impact of the services we offer
▪ To manage the induction of new teachers (Appropriate Body Service)
▪ To comply with the law regarding data sharing
▪ To meet the statutory duties placed upon us for the Department for Education (DfE) data collections.
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing
participant information for general purposes are:
▪ Article 6, 1, (a) the data subject has given consent to the processing of his or her personal data for
one or more specific purposes.
▪ Article 6, 1, (c) processing is necessary for compliance with a legal obligation to which the controller
is subject.
The basis/bases we rely on for processing participant special category information for general purposes
are:
▪ Article 9, 1, (a) the data subject has given explicit consent to the processing of those personal data
for one or more specified purposes, except where Union or Member State law provide that the
prohibition referred to in paragraph 1 may not be lifted by the data subject.
▪ Article 9, 1, (b) processing is necessary for the purposes of carrying out the obligations and
exercising specific rights of the controller or of the data subject in the field of employment and social
security and social protection law in so far as it is authorised by Union or Member State law or a
collective agreement pursuant to Member State law providing for appropriate safeguards for the
fundamental rights and the interests of the data subject
We also collect and use personal data where it is necessary to meet the legal responsibilities set out in data
protection legislation, other UK law and regulation that applies to schools. These include the following:
▪ Education Act 2011(2022)
▪ Health and Safety at Work Act (1974)
▪ Keeping Children Safe in Education regulations
We may also need to share your personal data with other official bodies, or organisations where we are
required to by other UK law.
If we would like to use your information for another reason, then we will ask for your permission (consent)
before doing so. When we ask for consent, we will explain what your information will be used for, by who and
what choices you have about how it is used.
Collecting Participant Information
We collect participant information via registration forms available on our website, through emails to schools,
via forms used by third-party systems, or via marketing materials.
We may collect personal data directly from your current employer, or from other partners or service providers
you are registered with (where you have agreed for this information be shared).
Whilst most of the personal information we collect from you is necessary for us to deliver the services you
wish to participate in (collection is mandatory), some of the information we ask for is voluntary (requires your
consent). To comply with data protection legislation, we will inform you at the point of collection whether you
are required to provide certain items of personal information to us, or if you have a choice in this.
Storing your data
Information that we collect from you is stored securely using systems that have been approved by the Trust.
Checks are undertaken to ensure that the systems we use meet the requirements of data protection
legislation. Access to these systems is limited to designated Teaching Hub staff and controlled with role based permissions.
Where we use systems that are provided by companies based outside the UK, we have undertaken
appropriate compliance checks to ensure your information rights can be upheld under UKGDPR/GDPR
legislation. Where we use systems that store your personal data, these currently use data centres located in
territories that form part of the European Union or European Economic Area (where GDPR applies).
Personal data relating to participants is stored in line with the Trust’s records management policy and
procedure. This policy is based on retention guidance published by the Information Records Management
Society (IRMS) in their toolkits for schools and academies.
In accordance with the Data Protection Act, the Trust does not store personal data indefinitely; data is only
stored for as long as is necessary to complete the task for which it was originally collected.
We do retain limited personal contact information of alumni for the purposes of marketing and signposting
individuals to future events. In this case, the personal data we retain will be proportionate and limited to what
is necessary.
Who we share information with
We do not share information about participants with anyone without consent unless the law and our policies
allow us to do so. We routinely share participant information with:
▪ Your current employer
▪ The Department for Education
▪ The system we use for managing participant information (HubSpot)
▪ Our visitor entry system
▪ The internal systems and resources we use to help deliver our services (including Microsoft
OneDrive, Outlook)
▪ The system we used to promote and manage event bookings (Eventbrite)
▪ Facilitators of our programs and activities
▪ Current programme partners including:
o Albright Education Centre
o Ambition Institute
o Billesley Primary School
o Central Region Schools Trust
o Cleobury Mortimer Primary School
o Hales Valley Trust
o Invictus Education Trust
o The Four Stones MAT
o The Orchard School
o Inclusive Attendance
o Woodrush High School
▪ Local Authorities involved in programme partnership.
The information that we share with these parties includes the following:
▪ Personal information – name, address, gender, contact details.
▪ Attendance Information
▪ Relevant medical information
▪ Performance and achievement information (assessment outcomes)
▪ Disability and access requirements
Making Choices About Your Personal Data (consent)
Where you have given us consent to do so, we may send you messages by email or text promoting Teaching
School events, campaigns, charitable causes or services that you might be interested in.
Where these messages are optional, you can withdraw or ‘opt out’ by clicking on the ‘Unsubscribe’ link at the
bottom, or by contacting us (see ‘Contact us’ below).
Use Of Your Personal Data in Automated Decision Making and Profiling
We don’t currently use automated decision making or profiling in the processing of participant data. This
means we don’t make decisions about you using only computers without any human involvement, for
example using AI.
If this changes in the future, we will update this notice to take account of how automated decision making
may affect you, including explaining your right to object to it.
Transferring Data Internationally
Where we share data with an organisation that is based outside the UK, we will protect your data by following
the transfer requirements of data protection law.
Your Information Rights
Data Protection law provides you with certain rights.
Requesting access to your personal data
You have the right to request access to information about you that we hold. If we do hold information about
you, we will:
▪ Give you a description of it.
▪ Tell you why we are holding and using it, and how long we will keep it for
▪ Explain where we got it from, if not from you or your parents
▪ Tell you who it has been, or will be, shared with
▪ Let you know if we are using your data to make any automated decisions (decisions taken by a
computer or machine, rather than by a person)
▪ Give you a copy of the information.
To make a request to access your personal information, please contact our Data Protection Officer by
emailing DPO@the4stones.co.uk ,
or in writing to: The Four Stones MAT, Brake Lane, Hagley, Worcestershire, DY8 2XS
Please address letters: For the attention of the Data Protection Officer.
We may require you to provide proof of your identity before we can help with your request. Right of access
requests are usually processed within one calendar month of receipt unless they are deemed to be excessive
or complex. Where this is the case, we may ask you to clarify your request or apply an extension to the time
we have to respond.
Your Other Information Rights:
▪ The right to know how your information is being used – We uphold this by publishing Privacy
Notices and letting you know how your information will be used when we collect it.
▪ The right to have inaccurate information amended - We uphold this right by asking you to review
the information we hold on record and updating information if you provide evidence to show it has
changed
▪ The right to have information removed or deleted from your records – We uphold this right by
removing or deleting your information that we are no longer required to keep
▪ The right to temporarily restrict how your information is used - We uphold this right by not using
information until we have confirmed what is accurate, unless it is necessary to do so
▪ The right to object to us using your data for certain purposes – We uphold this by asking for your
consent or permission to use your information for these purposes (including direct marketing and for
scientific/historical research and statistics)
▪ The right for important decisions about you not to be made solely by automated systems that
use your information (like computer algorithms and AI) – We uphold this right by letting you know
if these systems are used and giving you a choice for these types of decisions to be reviewed.
Who to Contact
The Trust has a Data Protection Officer (provided by Services 4 Schools Ltd). Their role is to oversee and
monitor our data protection procedures, and to make sure we are compliant with data protection legislation.
The Data Protection Officer is responsible for helping participants uphold their information rights.
You can contact our Data Protection Officer by emailing: DPO@the4stones.co.uk
or in writing to: The Four Stones MAT, Brake Lane, Hagley, Worcestershire, DY8 2XS
Please address letters: For the attention of the Data Protection Officer.
Complaints or Concerns
We take any complaints about how we collect and use your personal data very seriously, so please let us
know if you think we have done something wrong.
If you have a concern or complaint about the way we are collecting or using your personal data, you should
raise your concern with our Data Protection Officer in the first instance. You can also raise a concern with the
Information Commissioner’s Office at https://ico.org.uk/concerns/
For further information on how to request access to personal information held centrally by the Department
for Education (DfE), please see the ‘How Government uses your data’ section of this notice.