Our Privacy Policy

  1. Home
  2. /
  3. Privacy Policy

The St Marylebone CE School Privacy Notice: how we use Maths Hubs Contractor and Participant Information

Under the General Data Protection Regulation (GDPR) we are obliged to inform you of the information we hold on you, what we use it for, who we share it with, and for how long we keep it. This privacy notice (also known as a fair processing notice) aims to provide you with this information. If you have any questions about this, please contact the school office, or the school’s Data Protection Officer. Contact details for both are available at the end of this privacy notice.

We, The St Marylebone CE School at 64 Marylebone High Street are the Data Controller for the purposes of data protection law.

As a public body as we have appointed a Data Protection Officer (DPO), provided by the London Diocesan Board for Schools.

1. A. The categories of contractor information that we collect, hold and share include (but are not limited to):

  1. Personal information (such as name, address, national insurance number).
  2. Contact details and preference (contact telephone numbers, email addresses, addresses)
  3. Characteristics (such as ethnicity, religion, language, nationality, country of birth)
  4. the terms and conditions of your deployment with us including contractual terms;
  5. details of your qualifications, skills, experience and employment history where required;
  6. Payment details where applicable;
  7. information about your emergency contacts or associated procedure;
  8. Photographs (for internal safeguarding & security purposes, school newsletters, media and promotional purposes).
  9. CCTV images

We may also hold personal data about you from third parties, such as references supplied by former employers or service users, information provided during the completion of our pre-deployment checks, and from the Disclosure & Barring Service, in order to comply with our legal obligations and statutory guidance.

2. Why we collect and use this information

  1. Fulfil our legal obligations in relation to Keeping Children Safe in Education
  2. Develop all aspects of the school operationally
  3. Inform our operational procedures
  4. Allow better financial modelling, administration and planning
  5. Provide references where requested
  6. Allow us to fulfil or legal and contractual obligations
  7. to assess the quality of our services
  8. to comply with the law regarding data sharing

3. The lawful basis on which we use this information

Our lawful basis for collecting and processing your information is defined under Article 6, and the following sub-paragraphs in the GDPR apply:

(a) Data subject gives consent for one or more specific purposes.

(c) Processing is necessary to comply with the legal obligations of the controller.

Our lawful basis for collecting and processing your information is also further defined under Article 9, in that some of the information we process is deemed to be sensitive, or special, information and the following sub-paragraphs in the GDPR apply:

(a) The data subject has given explicit consent.

(b) It is necessary to fulfill the obligations of controller or of data subject.

(d) Processing is carried out by a foundation or not-for-profit organisation (includes religious, political or philosophical organisations and trade unions)

Where we have obtained consent to use your personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.  Some of the reasons listed above for collecting and using your personal data overlap, and there may be several grounds which justify our use of this data.

4. Collecting participant information

Whilst the majority of information you provide to us is mandatory or related to our mutual contractual obligation, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain your information to us or if you have a choice in this. Where we have obtained consent to use your personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

5. Storing your data

We create and maintain filing system related to these individuals. The information contained in these files is kept secure and is only used for purposes directly relevant to your participation in the Maths Hub programme. Once your participation has ended, we will retain this file and delete the information in it in accordance with our retention policy.

Please refer to our Data Retention Policy for further information.

We have data protection policies and procedures in place, including strong organisational and technical measures, which are regularly reviewed. Further information can be found on our website.

6. Who we share information with

We share supply, contractor and participant information with appropriate third parties, including:

  1. Our auditors, to ensure our compliance with our legal obligations
  2. NCETM

Where we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.

7. Why we share your information

We do not share information about you with anyone without consent unless the law and our policies allow us to do so.

We only share your information with our Local Authority if we there is a genuine safeguarding concern. The majority of the information shared will be to manage the mutual contractual obligations in place around the services provided.

8. Data collection requirements

Our data collection requirements all relate to the our legal and contractual obligations, for example contract clauses or the statutory ‘Keeping Children Safe in Education Guidance’

9. The categories of participants’ information that we collect, hold and share include

  1. Name
  2. Email Address
  3. School (your employer)
  4. Your Teacher Reference Number (where applicable)

This information will be shared with NCETM

10. Requesting access to your personal data and your Data Protection Rights

Under data protection legislation, you have the right to request access to information about them that we hold, through a Subject Access Request. 

If you make a subject access request, and if we do hold information about you, we will:

  1. Give you a description of it
  2. Tell you why we are holding and processing it, and how long we will keep it for
  3. Explain where we got it from, if not from you
  4. Tell you who it has been, or will be, shared with
  5. Let you know whether any automated decision-making is being applied to the data, and any consequences of this
  6. Give you a copy of the information in an intelligible form

Individuals also have the right for their personal information to be transmitted electronically to another organisation in certain circumstances.

If you would like to make a request, please contact our data protection officer.


You also have the right to:

  1. object to processing of personal data that is likely to cause, or is causing, damage or distress
  2. prevent processing for the purpose of direct marketing
  3. object to decisions being taken by automated means
  4. in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
  5. claim compensation for damages caused by a breach of the Data Protection regulations

11. Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact our data protection officer:


or appropriately appointed DPO will be contactable through this email address

Alternatively, you can make a complaint to the Information Commissioner’s Office:

  • Report a concern online at https://ico.org.uk/concerns/
  • Call 0303 123 1113
  • Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact dataprotection@stmaryleboneschool.com