September 2026 • Publication date: 20/09/2026

About this notice

Barrow CEVC Primary School is committed to protecting personal information. This notice explains how we use information when you visit our website, contact us through the details it provides, or appear in content we publish online. It explains your choices and how to contact us about your information.

It should be read alongside our September 2026 privacy notices for pupils, parents and carers, the school workforce, and governors and volunteers. Those notices explain the wider use of information for education, safeguarding, employment and school administration.

School privacy notices

Who is responsible and how to contact us

The data controller is Barrow CEVC Primary School. We decide why and how personal information is used for the school website.

Address: Colethorpe Lane, Barrow, Bury St Edmunds, Suffolk IP29 5AU
Telephone: 01284 810223
Email: admin@barrow.suffolk.sch.uk
Website: https://barrowcevcprimaryschool.co.uk/

Our Data Protection Officer is Mark Denny.
Email: mark.denny@majorseventh.co.uk

Information covered by this notice

Enquiries: your name, contact details, message and any information you choose to provide when contacting the school. Please contact the office to arrange a suitable way to send confidential information about a child. Published information: photographs, videos, school news, staff contact information and governance information where these are published on the website. Technical information: website requests can disclose your IP address, browser and device details, pages requested and access times to the website host and services your browser loads. Search terms can also form part of a page request.

 Why we use information and our lawful bases

We use personal information in accordance with the UK GDPR and the Data Protection Act 2018, as amended. The basis depends on the purpose, rather than simply on someone visiting the website.

If an enquiry becomes part of a pupil, parent, workforce or volunteer record, the relevant school privacy notice explains the further use of that information. Sensitive information is handled only where an additional legal condition permits it.

Photographs and information published online

We follow the school’s Photographic Images Policy and recorded permissions when publishing identifiable pupil images. We consider safeguarding risks and avoid unnecessary identifying details. You may change or withdraw permission by contacting the school office or Headteacher; please identify the image or page concerned.

Withdrawing consent does not affect earlier lawful use. We will stop future use based on that consent and remove affected material under our control as appropriate. Public material may already have been copied by others or indexed by search engines.
  
Cookies and similar technologies

Cookies are small files stored on your device. Websites may also use browser storage and similar technologies to remember settings, support security or deliver embedded content. These technologies can involve personal information.

Strictly necessary technologies may operate without consent where the legal exemption applies. Other technologies require consent unless a specific exemption applies and its conditions are met. Simply browsing the website does not amount to consent.

You can also delete or block cookies through your browser settings. Blocking necessary cookies may prevent some functions from working. Browser controls do not necessarily stop information being sent to an embedded service.

Embedded content and external services

The homepage includes YouTube videos and a Google Calendar, and loads a Trustindex feed script. When third-party content loads, your browser can send technical information such as your IP address and browser details to the provider. Depending on the service, it may also use cookies, record interactions or associate activity with an account you have with it.

The providers explain their own processing in their privacy notices. Our responsibilities for choosing and configuring these services remain with the school.

Google privacy information for Google Calendar and YouTube


Trustindex privacy information

If you follow a link to another website, its operator is responsible for its own processing. Please read its privacy information before providing personal details.

Who receives information and overseas processing

Relevant school staff and authorised service providers may access information where needed to respond to you or operate and support the website. Providers may include website hosting, maintenance, email, security and backup services. Suppliers processing information for us must follow appropriate contractual and security arrangements. Information may also be shared with authorities or professional advisers where legally required or justified.

How long we keep information

We retain information only for as long as needed for its purpose, in line with the school’s records management and retention procedures. Enquiries that become part of a formal school record follow the retention arrangements for that record. Information no longer required is securely deleted or otherwise disposed of appropriately.

Keeping information secure

We use appropriate technical and organisational safeguards to protect personal information. Access is limited to people who need it for their role. If you believe information has been disclosed incorrectly, or have a concern about something published on the website, contact the school or Data Protection Officer promptly.

Your rights

Depending on the purpose and lawful basis, you can ask to access your information, correct inaccurate information, have information erased, or restrict its use. Data portability applies in certain circumstances. Some requests are subject to legal exceptions; we will explain these where relevant.

Your right to object: you may object, for reasons relating to your particular situation, to processing based on public task. We must consider your objection and explain any lawful reason for continuing.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Contact the school or DPO for school records and photographs. For website technologies, use the choice controls described in the cookie section.

You can make a rights request verbally or in writing to the school or DPO. We may need information to confirm your identity or clarify your request. We normally respond within one month, subject to the extensions and time-limit rules permitted by law. We will explain if these apply.

Children have their own data protection rights. We consider a child’s understanding and the authority of anyone acting for them when handling requests about their information.

Concerns and complaints

Please contact the school or Mark Denny, our Data Protection Officer, if you have a concern about how we use your information. You also have the right to complain to the Information Commissioner’s Office (ICO).

Make a complaint to the ICO

Changes and related school information

We review this notice at least annually and whenever there is a significant change to the way we use personal information. The publication date above will show when it was last updated. Please contact the office if you need a paper copy or help understanding this notice.

School policies, including photography and records management