March 2026
To be renewed March 2027

What is Christ Church Cathedral School?
Christ Church Cathedral School was founded by Cardinal Wolsey in 1525 as part of Cardinal College, to train and educate the choristers. The School expanded to take pupils other than choristers in the late C19. The School is registered as an independent school by the Department for Education and, as such, falls under the inspection regime of the Independent Schools Inspectorate. The School is fully part of Christ Church and is governed by the Dean and Chapter through a governing committee comprising members of Chapter and elected external advisory governors. The School has been a member of the Independent Association of Preparatory Schools since 2005.

Explaining the legal bases we rely on
The law on data protection sets out a number of different reasons for which an organisation may collect and process your personal data. When collecting your personal data, we will always make clear to you which data is necessary for each purpose or type of data. Most commonly, we will process your data on the following lawful grounds:

Consent
In specific situations, we can collect and process your data with your consent. This is usually in relation to direct marketing but is also used extensively in the collection of personal data by schools.

Contractual obligations
In certain circumstances, we need your personal data to comply with our contractual obligations.

Legal compliance
If the law requires us to, we may need to collect and process your data.

Legitimate interest
In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of the running of the college, cathedral, and cathedral school, and which does not materially impact your rights, freedom or interest.

Vital interests
We may also use your data, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests. In a small number of cases where other lawful bases do not apply, we will process your data on the basis of your consent. If you are aged under 18, we may ask your parent or guardian for their consent also.

Special category data
"Special categories" of particularly sensitive personal data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal data. We aim to collect and process special category data as little as possible and, when we do, it is usually to do with your health and well-being. Christ Church Cathedral School documents all incidents of our processing of special category data in our Records of Processing Activities.

The special categories of personal data consist of data revealing:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic data;
• biometric data (e.g. fingerprints) for the purpose of uniquely identifying someone;
• data concerning health;
• data concerning someone's sex life or sexual orientation.

We may process special categories of personal data in the following circumstances:

• With your explicit written consent;
• Where it is necessary in the substantial public interest, and further conditions are met;
• Where the processing is necessary for archiving purposes in the public interest, or for scientific or historical research purposes, or statistical purposes, subject to further safeguards for your fundamental rights and interests specified in law.

Further legal controls apply to data relating to criminal convictions and allegations of criminal activity. We may process such data on the same grounds as those identified for “special categories” referred to above.

When do we collect your personal data?
When you are a pupil at Christ Church Cathedral School;

When you are an alumnus/alumna of Christ Church Cathedral School;

When you are a staff member at Christ Church Cathedral School;

When you are a member of the Governing Body of Christ Church Cathedral School;

When you are employed by Christ Church Cathedral School as a contractor;

When you are a volunteer at Christ Church Cathedral School;

When you visit Christ Church Cathedral School as a parent or guardian;

When you are a supplier to or purchaser from Christ Church Cathedral School;

When you access or engage with our website;

When you communicate or engage with Christ Church Cathedral School by letter, or email, or other means, including social media;

When your image is collected on our CCTV system;

When you contribute to any Christ Church Cathedral School publications.

What sort of personal data do we collect?
The categories of information that we collect, hold and share include:

• Personal information of pupils, parents, guardians, and staff (such as name, unique pupil number and address); • Characteristics (such as ethnicity, language, nationality, country of birth);
• Attendance information (such as sessions attended, number of absences and absence reasons);
•  Assessment information (including reports, grades, exam marks and SEN);
• Medical records;
• Behaviour management including merits and pluses, and sanctions;
• Safeguarding information (such as court orders and professional involvement);
• Images of pupils and staff engaging in School activities;
• School trip information (including transport arrangements, medical and allergies);
• Financial information (relating the school fees and bursaries);
• Car and entry details using the parking areas; and
• CCTV recordings of activities in the school grounds.

How and why do we use your personal data?
We use the data:

• to support pupil learning;
• to monitor and report on pupil progress;
• to provide appropriate pastoral care;
• to assess the quality of our services;
• to comply with the law regarding data sharing;
• to advise future senior schools regarding attainments;
• to ensure a safe and secure environment;
• to manage the site and its buildings;
• to keep in touch with alumni and friends of the School;
•  to manage our website; and
•  to comply with our contractual and legal obligations.

The lawful bases by which we process pupil data
We collect and use pupil information under the Education Act 1996, the Education (Pupil Information) (England) Regulations 2005, and the School Attendance (Pupil Registration) (England) Regulations 2024. Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.

How we protect your personal data
Christ Church Cathedral School makes every effort to keep your personal data safe. Our Records of Processing Activities include information on the measures in place to protect both physical and digital data during its collection, processing, and destruction (if relevant). These Records of Processing Activities are under constant review to ensure they are correct and current. Enquiries should be directed to the Data Protection Officer at the address below.

Access to your personal data is limited to those who need to process it. As far as possible, paper records are kept in locked cabinets or cupboards which are themselves behind access-controlled doors. CCTV is used in public areas. Digital files are always password protected and encryption is encouraged when personal data is moved. Servers are protected by firewalls and security software. When data is deleted, every effort is made to ensure the deletion of all copies.

Storing data
We hold data according to the Department for Education’s guidance for record keeping and management (https://www.gov.uk/guidance/data-protection-in-schools/record keeping and-management)

We hold pupil data for 20 years after the pupil has left.

We hold most personnel data for six years from the termination of employment, unless there is an allegation (founded or unfounded) concerning child protection. These records are retained until retirement or for ten years after the date of the allegation, whichever is the later.

With whom do we share information?
We routinely share pupil information with:

• schools that the pupils attend after leaving us
• our local authority
• the Department for Education (DfE)

We do not share information about our pupils, their parents or guardians, staff, or governors with anyone without consent unless the law and our policies require us to do so.
We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins educational attainment policy and monitoring

Data collection requirements:
To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.

We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the National Pupil Database (NPD). The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and supporting-information.

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

• conducting research or analysis;
• producing statistics;
• providing information, advice or guidance.

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

• who is requesting the data;
• the purpose for which it is required;
• the level and sensitivity of data requested; and
• the arrangements in place to store and handle the data.

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data.

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received
To contact DfES: https://www.gov.uk/contact-dfe

Requesting access to your personal data
Under data protection law, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact The Headmaster or the Data Protection officer for the School.

You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress;
• prevent processing for the purpose of direct marketing;
• object to decisions being taken by automated means;
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and to claim compensation for damages caused by a breach of the Data Protection regulations.

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/.

Contact
If you would like to discuss anything in this privacy notice, please contact: The Headmaster or the Data Protection Officer for the School, Judith Curthoys on dpo@chch.ox.ac.uk

This notice will be reviewed annually by the School and Christ Church’s data protection team.

 

v.1 May 2019
v.1.2 Revised February/March 2026

 

 

 

 

 

 

 

 

 

 

 

Form Submissions

We may collect information about your approximate location when you submit a form on our website.

This may include:

• Your IP address
• Geographic location (such as city or region), inferred from your IP address or device data

We collect this information to:

• Identify and prevent fraudulent or malicious activity
• Diagnose technical issues

We process this data under our legitimate interests in operating and improving our website and ensuring its security.

We do not use this information to identify your precise location, and we do not share it with third parties for marketing purposes.

Cookies Used

Necessary

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms.

You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Targeting

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.

They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.