In accordance to the principles of article 5 of the GDPR our personal data shall be:
a) processed lawfully, fairly and in a transparent manner in relation to individuals
b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
d) accurate and, where necessary, kept up to date
e) kept in a form which permits identification of data subjects, for no longer than is necessary for the purposes for which the personal data are processed
f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisation measures.
The Data Controller for Willow Tree Learning is Judith Carter and she is responsible, and is able to demonstrate, compliance with these principles. At times Willow Tree Learning is also a processor of personal data on behalf of other Controllers, including individual schools. Within both roles, the obligations to protect data are fully adhered to.
1. What lawful basis our data is collected under.
2. What personally identifiable data is collected through our work, how it is used and who it may be shared with.
3. The Security procedures in place to protect our data.
4. How individuals can correct any inaccuracies or update our data.
1. The Lawful Basis for Data Collection
Under GDPR there are six available lawful bases for processing data. No single basis is ‘better’ or more important than others. Willow Tree Learning has selected the lawful base deemed to be the most appropriate for each type of service offered.
Our bespoke Educational Psychology service requires data collection about children, their learning and barriers to learning. The processing is necessary in order to provide the service and will be collected under the legitimate interests lawful base.
SEN-D training, including the Essential SENCO Network and SENCO Induction training, collects data under the lawful base of Contract.
Inclusive school improvement will also process data under the lawful base of Contract.
2. Data Collection – Type, Use and Sharing
Educational Psychology Services:
Prior to completing individual EP work, schools are asked to complete a background information form. The form includes name, date of birth, class teacher and class size, code of practice category, barriers to learning, name of parent/carer and family context. Parent/Carer Permission for pupil work. Pupil likes, dislikes, concerns of school and others, perceived description of them as a learner, assessment information, what interventions and support are currently offered, other agencies and the rationale for commissioning EP assessment. This information is emailed by the SENCO and a printed copy is kept on the school file. The information is used to plan the assessment activities. The background information form is not shared with others. During the school visit, assessment tools are completed including standardised and dynamic or interactive tasks. Notes and or assessment information are recorded and used to inform the professional evaluation of strengths, barriers to learning and strategies for overcoming the barriers to learning. This evaluation is written in to a visit summary report and a letter is written to the child. This is securely emailed to the commissioning school who provide a copy to the Parents and a copy of the letter to the child. Reports are stored electronically and in a paper format within a school folder. These are not shared unless a specific and relevant request is made by another Professional or the Local Authority and Parent/Carer permission has been given to share the information.
A database is kept annually which captures the name, school and email address of Essential SENCO Network members, and those enrolled on specific training courses. This information is used in accordance to the ‘contract’ specified on the membership form, where members give permission for Willow Tree Learning to email the annual programme, invoice and termly updates deemed essential. The information is not shared with others. This process is also applied to information on delegates who have applied to attend the annual conference.
Inclusive School Improvement:
Specific contracted activities could include an SEN review or audit of systems and practices. Information is provided by the contracting school, as it is essential for the service delivery. Any information provided is used during this specific piece of work and then securely shredded once a report is written and shared with the school. This information is not shared with others.
3. Security Procedures in Place
Willow Tree Learning we take the security of our data very seriously. Paper files are kept in locked and secure areas and electronic data is secured using the latest Anti-Intrusion and Anti-Virus software. Our hardware is password protected and data storage devices are secured in a locked rooms. Electronic communication via emails is encrypted to and from our mail server. Our mail server is hosted within the EU. Paper information is stored in school files and archived for a period of 5 years and then securely shredded via the services of a confidential waste company who issue a certificate of secure disposal.
4. Correction of data inaccuracies
Individual schools and Parents/Carers have the opportunity to correct or request amendments to inaccuracies in our data at any time. Similarly, individual members of the Essential SENCO Network and other delegates of training programmes can request amendments to information held. Delegate information is only kept for the duration of the annual membership or specific course.
Willow Tree Learning is committed to the safe, secure and professional storage of personal data. In accordance to the professional guidelines and code of conduct of Practitioner Psychologists registered with the Health Care Professionals Council, we acknowledge the privilege and trust associated with our work, and will actively seek to ensure that we respect this and protect the information held. All Associates working with Willow Tree Learning will be asked to sign agreement to our policy and to acknowledge their responsibilities as data processors. Willow Tree Learning is registered with ICO and will adhere to the requirement to report any breach in our data policy immediately. Further information can be sought from our data Controller and Director of Willow Tree Learning, Judith Carter, by emailing her at:
Judith Carter @ WillowTreeLearning