GDPR and Data Protection

On the 25th May 2018, the UK’s Data Protection Act 1998 was replaced by a new law called the GDPR (the EU General Data Protection Regulation 2016). This law governs how we collect, use and share people’s information and provides greater rights to individuals and control over how their information is handled by organisations, including school.

Data protection is very important at St John’s and we view it as an extension to safeguarding – not only for pupils, but their families, our staff, our governors and our volunteers.

We are taking steps to review and update our processes around how we are handling your information. This page will be updated on a regular basis.

In the meantime, if you would like to know more about GDPR and your rights, please visit the UK’s data protection regulator, the Information Commissioner’s Office, using the link below.

Information Commissioner’s Office (ICO)

Should you have any queries regarding the GDPR and our school, please contact our Data Protection Officer, Mrs Hall, via the school office email (, telephone (01923 255 017) or by visiting the school office during term time.


Please find below our Privacy Notices – we are in the process of transferring our privacy notices onto the website.

Our privacy notices detail why we collect data, how we collect it and how we use it.

SJ Privacy Notice – Parents about their child’s data


The Systems we use

We use various systems in school in order to carry out our public duties and school functions.

We use Arbor as our school information system (MIS) and where we store most of our data relating to pupils. Read their privacy policy here

The Early Years Foundation Stage (EYFS – Reception classes) use Tapestry – an online learning journey – to record children’s achievement. Read their privacy policy here

Key Stage Two (Years 3,4, 5 & 6) use Class Dojo to share information about classroom activities and school events  with St John’s C of E Primary School families. Read their privacy policy here

We use Cool Milk to supply milk to the children in our school. Read their privacy policy here

As a Google School, we teach IT through Chromebooks running the GSuite for Education package, for children this means that they will have their own login to our secure IT system where they are able to access the core Google Tool Suite including GMail (restricted to internal emails only), Google Classroom, Docs, Sheets and Slides.

Here you will find Google’s Privacy Policy as well as Terms of Service.


The website we share data with 

We also share data with the following websites and companies

We use Xero as our accounting system. Read their privacy policy by clicking here

We use Magic Booking to manage our Eagle Club booking. Read their privacy policy here

We have a St John’s C of E Primary School Facebook page, read their privacy policy here and an Instagram page, please read their privacy policy here 


The third party services we use 

We also use the following third party services where we use the information provided by participants

We also use Eventbrite to manage our events, for example, tours for prospective parents. We only use this information to provide any relevant updates in relation to the event which has been booked and to review attendance at events. In relation to admissions, we may use the data to look at what percentage of attendees then went on to apply to the school. At the end of every annual admissions process, we delete the attendee information from Eventbrite. Read their privacy policy by clicking here