HomeProtect Privacy Notice
OVERVIEW
Our Intent. We are committed to safeguarding the privacy of users of our services and we will only use the information we collect about your school lawfully.
Changes to Data Protection Legislation. The European Union’s General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 (DPA 2018), has introduced significant and enhanced rights for Data Subjects, including users of this service. This Privacy Notice seeks to outline these rights and also the way personal data is processed by HomeProtect, so that Data Subjects (you) have transparency.
Data Subject’s Privacy Notice. This Privacy Notice should be read by Data Subjects, i.e. “you,” or any identifiable person using the London Grid for Learning (LGfL) HomeProtect service.
The Data Controller. LGfL provides HomeProtect for LGfL client schools as their Data Processor. This Privacy Notice is intended to provide an overview of how LGfL, manages personal data used in HomeProtect. Our contact details are:
Email: dataprotectionenquiries@lgfl.net
Mail: 9th Floor, 10 Exchange Square, Primrose Street, London, EC2A 2BR.
Data Protection Officer (DPO). Your school to which you are associated with, will have a DPO who should be your first point of contact for data related queries as they are the Data Controller. The preferred mechanism for Data Subjects to raise concerns regarding the processing of their personal data by LGfL is to contact your school to which you are associated with as they are the Data Controller. The DPO as your associated school fulfils a number of roles, one of which is to be the primary and independent point of contact for Data Subjects, namely you. If you wish to contact LGfL, please email or send a letter to our contact details above, at which point the enquiry will be forwarded to the DPO of the respective Data Controller.
Purpose of Processing Personal Data. The policies for HomeProtect is the responsibility of individual Data Controllers (schools) and their users. The HomeProtect system is intended to address the ‘Keeping Children Safe in Education’ statutory guidance published by the Department for Education, and issued under Section 175 of the Education Act 2002, the Education (Independent School Standards) Regulations 2014, and the Non-Maintained Special Schools (England) Regulations 2015.
It also addresses ‘Revised Prevent duty guidance: for England and Wales’ statutory guidance published by the Home Office, and issued under Section 29 of the Counter Terrorism Act 2015.
Since 2023, Department for Education standards for schools, web filtering and monitoring, are also applied which require the functionality applied within HomeProtect.
The intent of HomeProtect’s capabilities is to allow technical and/or safeguarding administrators in schools to enforce filtering policies across all web browsing made on school owned devices configured for the services. This significantly increases the safeguarding of children by reducing the risk of exposure to inappropriate or illegal content.
Lawful Basis of Processing Personal Data When Visiting This Website. The lawful basis of processing your personal data when using HomeProtect is “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”
Categories of Personal Data Processed by LGfL. The information within HomeProtect should be within the policy of individual Data Controllers and is the responsibility of their users. However, HomeProtect will as a matter of routine process the following data:
User First Name;
User Surname;
Username;
History of websites visited; and
Workstation IP address.
Transfer of Personal Data Outside the EEA (European Economic Area). HomeProtect is only processed using UK based servers.
Sensitive Personal Data. We will never collect sensitive personal data about you without your explicit consent or under the relevant lawful purpose. There is no Sensitive Personal Data collected and processed in HomeProtect. However, it is recognised the disclosure of individual Internet usage may have a potential negative reputational impact.
Sale or Passing of Personal Data to Third Parties. We will not sell or pass your personal data to any company without your explicit consent. However, to support Safeguarding or Law Enforcement investigation, LGfL may be required to pass personal data outside of normal processes, for very specific and limited purposes.
Retention of Personal Data. LGfL will retain the log files for websites visited for the current academic year, plus the previous academic year (September to August) and then securely dispose of it. This is required to provide support to customers and for customers to run reports in HomeProtect. This will also support the typical types of enquiries received by law enforcement agencies, for example, a request from the police pursuant to IPA 2018. The LGfL Safeguarding board have recommended the retention period for HomeProtect log files.
Data Subject’s Rights. Under data protection legislation you have a number of Rights which we have outlined below:
Right of Access. You are entitled to access your personal data so that you are aware of and can verify the lawfulness of the processing. This is best achieved through submitting a Subject Access Request (SAR). In summary, Data Subject’s (you) have the right to obtain:
Confirmation that your data is being processed;
Access to your personal data (a copy); and
Other supplementary information, which corresponds to the information in this Privacy Notice.
Fees and Timings. This information will be provided to you without charge; without delay and within one month. If an extension is required you will be informed of this. If requests are considered manifestly unfounded or excessive, in particular because they are repetitive, LGfL may choose to:
Charge a reasonable fee taking into account the administrative costs of providing the information; or
Refuse to respond.
The reasons for this will be formally notified to you and your rights to appeal to the appropriate Supervisory Authority, i.e. UK Information Commissioner’s Office (ICO) https://ico.org.uk will be highlighted.
Identify Verification. To protect your personal data, LGfL will seek to verify your identity before releasing any information, which will normally be in electronic format.
Right of Rectification. You are entitled to have personal data rectified if it is inaccurate or incomplete. If any data held about you is inaccurate or incomplete, LGfL will respond within one month of your request. In the unlikely event LGfL does not act on the request for rectification, LGfL will inform you of your rights to complain or seek judicial remedy.
Right of Erasure. You may request the deletion or removal of personal data where there is no compelling reason for its continued processing. The Right to Erasure does not provide an absolute ‘right to be forgotten.’ However, you do have a right to have personal data erased and to prevent processing in specific circumstances:
o Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed;
When you withdraw consent (and this is the basis of processing);
When you object to the processing and there is no overriding legitimate interest for continuing the processing;
The personal data was unlawfully processed;
The personal data has to be erased in order to comply with a legal obligation; and
The personal data is processed in relation to the offer of information society services to a child.
Right to Restrict Processing. When processing is restricted, LGfL are permitted to store the personal data, but not further process it. In this event exactly what is held and why will be explained to you by LGfL.
Right to Data Portability. You may request to obtain and reuse your personal data for your own purposes across different services. This allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability. The Right to Data Portability only applies:
To personal data you have provided to LGfL;
Where the processing is based on your consent or for the performance of a contract; and
When processing is carried out by automated means.
In these circumstances LGfL will provide a copy of your data to you in CSV format free of charge, without undue delay and within one month. If there is a delay to this, you will be informed by LGfL.
Right to Object. You have the Right to Object to:
Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
Direct marketing (including profiling); and o Processing for purposes of scientific/historical research and statistics.
Automated Decision Making and Profiling. LGfL do not employ any automated decision-making or conduct profiling of Data Subjects.
Cookies. This section outlines the type of cookies we apply HomeProtect. By using HomeProtect, you agree your personal information will be handled as described in this Privacy Notice. The cookies we may use for HomeProtect are described as below:
Session Cookies. These are stored while you browse our site and then deleted once you leave.
Performance Cookies. These help us to track how people are using our site. They help us to know what pages people are using most and how users navigate around the site, we use this information to make informed decision about how we can improve the user experience of our site. The information we get using these cookies is completely anonymous and we will make no attempt to identify you or influence your experience of our site while you are on it.
How Do We Use Your Data? We use the data that we collect about you for the following purposes:
To provide services related to your Account;
To communicate with you about your use of HomeProtect, your Account and/or Services we offer or make available through HomeProtect;
To respond to any enquiries that you submit to us;
To operate and improve HomeProtect; and
To better understand how users access, use HomeProtect and their Accounts, both on an aggregated and individualised basis, for the purposes of improving HomeProtect.
