Back to homepage

Privacy and Data Protection

Who is responsible for your information

I am Andy Leary-May. I am responsible for the personal information collected through this project.

I have created this project to receive and understand accounts from adults who have experience of Michaela Community School, and to establish whether similar experiences are being reported independently by different people.

For questions about your information, to exercise your data protection rights or to raise a concern, please email [email protected].

What information I collect

If you share an experience, I may collect your name and contact details; your connection with Michaela and approximately when that connection took place; the account you provide; subsequent correspondence with you; relevant documents or other information you later choose to provide; and records of any permissions or agreements concerning subsequent use of your account.

The project is for people aged 18 or over. I do not ask for your date of birth or routine proof of identity.

Accounts may sometimes contain information about other people, including children, and sensitive information such as information about health or SEND, ethnicity, religion or alleged wrongdoing. Please include this only where it is relevant and avoid unnecessary names or identifying details, particularly about other pupils.

I may retain relevant information about other people where this is necessary to understand or assess an account.

Why I use your information

I use information provided to me to:

- receive and understand your account;

- contact you where clarification or follow-up is necessary;

- assess the provenance and reliability of information;

- compare independently provided accounts and identify whether common patterns exist;

- keep appropriate records of permissions and subsequent use; and

- consider what, if anything, should happen if substantial and corroborated concerns emerge.

Providing an account does not give permission for it to be published or disclosed.

Legal basis

I rely principally on legitimate interests as my lawful basis for using personal information: the legitimate interest in receiving, assessing and comparing accounts about experiences of a school in order to understand whether matters of wider concern may exist.

I will only use information where doing so is necessary and proportionate for those purposes, taking account of the rights and interests of the people concerned.

Some accounts may contain more sensitive types of personal information, including health information or information about alleged wrongdoing. I will only retain and use this where it is relevant and necessary for the purposes of the project.

Confidentiality and sharing

Your account will be treated as confidential.

I will not identify you, quote you publicly, or pass on your identifiable account to a journalist, lawyer, regulator or anybody else unless we have discussed it and you have agreed to it.

The exceptions are where I am legally required to disclose information, or where an immediate safeguarding concern requires action.

Removing a name does not necessarily make information anonymous if other details could identify the person concerned. I will take this into account before using or sharing material.

Security

Access to identifiable accounts will be restricted. I will use appropriate security measures for the sensitivity of the information, including protected accounts and two-factor authentication.

I will minimise unnecessary copies and downloads.

Service providers

I use Google to provide the submission form and to store responses, and Cloudflare to host and deliver the website. These providers may process personal information outside the UK as part of providing their services. Where personal information is transferred internationally, the providers use recognised legal safeguards for international transfers where required.

How long I keep information

I will keep identifiable information only for as long as it is reasonably needed for the purposes described above or to meet a specific legal requirement.

I will review retained information at least every six months and when the project materially changes or ends. I will consider whether the information remains necessary for assessing accounts or patterns, follow-up, or any ongoing safeguarding, regulatory or legal matter, and whether it can instead be deleted or made less identifiable.

Where information needs to be retained for longer, the reason will be recorded and reviewed.

Your rights

Depending on the circumstances and applicable law, you may have rights including access to your personal information, correction of inaccurate information, erasure and restriction of processing.

Your right to object

Because I rely principally on legitimate interests, you have the right to object to the use of your personal information. I will consider your particular circumstances and explain the outcome.

Some rights are not absolute. For example, responding to a request may require consideration of the privacy and rights of other people whose information appears in the same material.

To exercise a right or ask a question about your information, please email [email protected]. I may need to take proportionate steps to establish your identity before releasing personal information.

You also have the right to complain to the Information Commissioner's Office if you are unhappy with how I have used your personal information.

Other information

Providing an account is voluntary. Genuine name and contact details are, however, required if you choose to use this submission route.