ASHURST CE AIDED PRIMARY SCHOOL
Privacy Notice 
Recruitment and Volunteers

Privacy Notice

The School Workforce: those employed to teach, or otherwise engaged to work at, 
a school or a local authority

The EU General Data Protection Regulation (GDPR)

The Data Protection Act 2018 (DPA) is the UK’s implementation of the General Data 
Protection Regulation (GDPR) and both came into force on 25th May 2018.
The DPA 2018 sets out the framework for data protection law in the UK. It updates and 
replaces the Data Protection Act 1998.
The DPA sits alongside the GDPR, and tailors how the GDPR applies in the UK. 
Everyone responsible for using personal data has to follow the ‘data protection 
principles’. 
They must make sure the information is:

• used fairly, lawfully and transparently
• used for specified, explicit purposes
• used in a way that is adequate, relevant and limited to only what is necessary
• accurate and, where necessary, kept up to date
• kept for no longer than is necessary
• handled in a way that ensures appropriate security, including protection against 
unlawful or unauthorised processing, access, loss, destruction or damage

Data Controller

Ashurst CE Aided Primary School complies with the GDPR and is registered as a ‘Data 
Controller’ with the Information Commissioner’s Office. 
The Data Protection Officer (DPO) for the School is Mrs Lindsey Welstead
We ensure that your personal data is processed fairly and lawfully, is accurate, is kept 
secure and is retained for no longer than is necessary.

The Legal Basis for Processing Personal Data

• Your personal information will be processed in the administration of your application.
• It is processed where it is required by law or regulation.
• During the course of your application it may also be necessary to process your 
sensitive personal information. This processing will be carried out on the basis of 
consent - by completing an application form as part of a recruitment process or to 
become a volunteer you consent to the processing of your personal data. 

The categories of personal data we are processing

• The information you provide to in your curriculum vitae and covering letter or the 
information you provide on the application form (both in paper and electronic form), 
including:
• name, title, address, telephone number, personal email address, national 
insurance number, date of birth, gender, ethnicity, disabilities, 
employment history and details of qualifications and experience;
• Any notes made during interview and any additional information you provide to us 
during an interview process;
• Any other information related to the recruitment process e.g. test results, right to 
work in the UK
• Information received from the Disclosure and Barring Service in respect of criminal 
convictions where this is a requirement of the role
• Information from the Health and Care Professional Council (or other relevant 
professional body) in respect of registration details where this is a requirement of 
the role
• Details of criminal convictions
• Information about your health
• Documents confirming identity
• Your named referees, from whom we collect the following categories of data: 
• Current employment history
• Referee details

How we collect and use information

We use this personal data to:

• Assess your skills, qualifications, and suitability for the role
• Carry out background and reference checks, where applicable and where required 
for the role
• To comply with equal opportunities
• To comply with immigration and money laundering legislation
• Communicate with you about the recruitment process
• Keep records related to our recruitment processes
• Comply with legal or regulatory requirements.

Who we share data with

We may pass data to:*

• HR advisers / Organisational Change team;
• The recruiting manager and other recruiting panel members;
• IT staff if access to the data is necessary for performance of their roles;
• The Disclosure and Barring Service where this is a requirement of the role
• The Health and Care Professional Council (or other relevant professional body) 
where this is a requirement of the role

• Our local authority
• The Department for Education

We will not share data with third-parties for marketing purposes

Personal data will not be retained for longer than necessary in relation to the purposes 
for which they were collected. We will retain your personal information for a period of 
six months after we have communicated to you our decision about whether to appoint you 
to the role or within 6 months of the end of your volunteering role. After this period, we 
will securely destroy your personal information. 

Rights

You have the right to:

1. be informed of data processing (which is covered by this Privacy Notice)
2. access information (also known as a Subject Access Request)
3. have inaccuracies corrected
4. have information erased
5. restrict processing
6. data portability 
7. intervention in respect of automated decision making (automated decision making 
is rarely operated within WSCC) 
8. Withdraw consent (see below)
9. Complain to the Information Commissioner’s Office (See below)

To exercise any of these rights please contact The Data Protection Officer. 

Withdrawal of Consent

Where personal data is processed on the basis of consent, you have the right to withdraw 
that consent.

Complaints to ICO

If you are unhappy with the way your request has been handled, you may wish to ask for 
a review of our decision by contacting the DPO. 

If you are not content with the outcome of the internal review, you may apply directly 
to the Information Commissioner for a decision. Generally, the ICO cannot make a 
decision unless you have exhausted our internal review procedure. The Information 
Commissioner can be contacted at: 

The Information Commissioner's Office, 
Wycliffe House, 
Water Lane, 
Wilmslow, 
Cheshire 
SK9 5AF. 

This notice was agreed 
By Members of the Governing Body
October 2025
Date for next review October 2026