We do not share information that you give us with any third-parties.
Cookies are small files saved to the user’s computer hard drive that track, save and store information about the user’s interactions and usage of the website. This allows the website, through its server to provide the users with a tailored experience within this website.
Users are advised that if they wish to deny the use and saving of cookies from this website onto their computer’s hard drive they should take necessary steps within their web browser security settings to block all cookies from this website and its external serving vendors.
This website uses tracking software to monitor its visitors to better understand how they use it. The software will save a cookie to your computer hard drive in order to track and monitor your engagement and usage of the website but will not store, save or collect personal information.
Centrally Hosted SIMS and FMS – Privacy Notice
The ICT Service is a part of Cambridgeshire County Council and is fully committed to keeping your information safe.
This privacy notice is to help you understand what information The ICT Service collects, the purpose for which it is collected and who we share the information with. It also explains the decisions that you can make about your information.
This notice will provide you with the following information:
- Who is collecting information about my organisation?
- What information are you collecting about my organisation?
- Why are you collecting this information?
- What is the legal basis for processing my organisations information?
- Who might you share my organisations information with?
- Where might you transfer my organisations information outside the UK?
- How long do you keep hold of my organisations information?
- What if I chose not to give you my organisations information?
- Will you process my information or my organisations for purposes my organisation may not be aware of?
- Where is my organisations information processed?
- What rights do I have?
For the purposes of this Privacy Notice:
“Information” means the data held within SIMS/FMS application
“Customer” means the establishment that purchases the service. i.e. individual school, Multi Academy Trust
“Data Controller” refers to the Customer
“Data Processor” refers to The ICT Service
“Data Subject” refers to a living persons details that are recorded in the SIMS/FMS application by the Data Controller
“Individual” refers to a person or employee who is associated with a named Customer
“EEA” is the European Economic Area
“Organisation” refers to the individual school or academy
The ICT Service provides you, the customer, with hosted SIMS/FMS that enables you to store the information for your school, and its associated pupils, staff and contacts, that is required for statutory and /or legal reasons as well as providing a service that assists with school processes and performance.
As you are responsible for the information that is entered and maintained in hosted SIMS/FMS, this makes you, the customer, the Data Controller. The ICT Service delivers the service that provides you with the ability to store this information and as such does not enter your information into this system for you, this makes The ICT Service the Data Processor. As a Data Processor, The ICT Service provide a hosted service that includes the application and customer data as well as support services to the customer.
As the Data Controller you are responsible for the information in the SIMS/FMS system and must be able to demonstrate compliance with the Data Protection Act and General Data Protection Regulations for the processing of personal information.
The ICT Service must demonstrate the same compliancy for any processing of your SIMS/FMS Data.
Details of the Data Protection Act Principles are detailed on the Information Commissioner’s Office website: https://ico.org.uk/for-organisations/guide-to-data-protection/data-protection-principles/
3. Who is collecting information about my organisation?
The ICT Service
Compass Point Business Park
Stocks Bridge Way
Should you have any queries relating to the collection of your information or about this policy please contact the Data Privacy Officer at firstname.lastname@example.org
4. What information are you collecting about my organisation?
For the purposes of delivering hosted SIMS/FMS to your organisation, the contents of your organisations existing SIMS/FMS data is stored on our hosted SIMS/FMS servers, together with administrative files in the shared file storage and the hosted email systems.
We also collect session information from those users accessing our system, this includes the use of third party technologies, these include, Google Analytics and logs from Microsoft Applications.
This information will be used for the following:
- To enhance the security of the system by tracking suspicious and anomalous behaviour.
- To assist The ICT Service support and operations functions to tune their services to provide scalable and performant software using utilisation information over a period of time
- To monitor the usage of our services and systems to support the development and enhancement of future features
See Cambridgeshire County Council’s data privacy notice at https://www.cambridgeshire.gov.uk/data-protection-and-foi/information-and-data-sharing/privacy-statement/ for information on customer information collected as part of the SIMS/FMS Service.
5. Why are you collecting this information?
In order to meet the contractual requirements of the SIMS/FMS Service to the customer, SIMS, FMS, file storage and email storage is hosted on our systems.
Service usage and performance information is used to understand the service and to make further enhancements that will benefit our customers.
6. What is your legal basis for processing my organisations information?
The ICT Service has a contractual obligation for the processing of customer SIMS/FMS data, file and email storage for the purposes of providing a hosted service to the customer.
The ICT Service, as data processor, supports the customer to meet their legal requirements and as data controller, it is the customer’s responsibility to ensure that they have a legitimate reason for processing the data subject’s information entered into hosted SIMS/FMS.
7. Who might you share my organisation’s information with?
We may share your SIMS/FMS data and/or school information with the following parties:
- Internal ICT Service parties for the purpose of data investigation as and when issues are reported by the customer
- Capita for the purpose of data investigation as and when issues are reported by the customer.
- To comply with any court order or other legal obligation
It should be noted that your information is only shared with other parties where the customer has provided prior consent to do so and is stated in your contract with the exception of a legal obligation.
8. Where might you transfer my organisation’s information outside of the EEA?
The ICT Service will not be transferring any data outside of the EEA
9. Is my organisation’s data processed other than for the purposes of the use of hosted SIMS/FMS?
10. How long do you keep hold of my organisation’s information?
SIMS/FMS information will be hosted by The ICT Service for the duration of the contract with the customer. In the event of a contract termination the information will be returned to the customer and removed from the production ICT Service systems. Copies of the data may be held in Backup cycles for up to 7 years.
SIMS/FMS information shared for the purposes of data investigations and fixes via The ICT Service’s Service Desk is held for the full time of the investigation and all data is destroyed within 90 days of the fix being issued.
11. What if I choose not to give you my organisation’s information?
If you are unable to provide your school establishment details then we will not be able to enter a contract with you. We require this information in order to provide a contract between your school establishment and The ICT Service which includes the Terms and Conditions of the service.
In the event that you report a data issue with your SIMS/FMS information to the Service Desk and you choose not to issue consent to use your school SIMS/FMS information, we may not be able to offer our full range of support that requires a copy of your SIMS/FMS information for further investigation.
12. Will you process my information for purposes I may not be aware of?
13. Where is my organisations data processed?
The SIMS/FMS service is hosted on a secure managed service, with the main system hosting provided in Cambridgeshire County Council’s Data Centre in Cambridge. Some is also processed via Microsoft Azure® UK, which is reliable and resilient. Microsoft Windows Azure has G-Cloud Impact Level 2 (IL2) from the Cabinet Office for use across the UK Public Sector. All data is securely stored and processed within the EU and complies with UK data protection standards and requirements.
14. What security is in place for my organisations data?
See Question 13.
Hosting and management of hosted SIMS/FMS infrastructure is undertaken fully by The ICT Service on behalf of the establishment, including the provision of all software, maintenance operations, upgrades and background supporting processes. Application security is SSL (TLS 1.0): The SSL method requires the use of TLS 1.0 to authenticate the RD Session Host server. A High setting for encryption is also applied so data sent from the client to the server and from the server to the client uses strong 128-bit encryption. Clients that do not support TLS and this encryption level cannot connect to RD Session Host servers.
The Data Centre Services and network are subject to rigorous firewall and intruder detection testing.
Cookies are only used for Hosted SIMS and FMS to capture client device information to aid reconnections to existing sessions. When a user connects to the platform a cookie is checked and then verified against a database, if an existing session with all matching details exists users will be reconnected to their existing session otherwise a new session is created.
16. What rights do I have?
The right to be informed:
The ICT Service have an obligation to provide you, the customer, with fair processing information. This is delivered to you in the SIMS/FMS Privacy Notice and includes information relating to the processing of your school file, email and SIMS/FMS information.
The right of access:
This does not apply to The ICT Service for SIMS/FMS who act as a data processor and are not responsible for subject access requests for information stored in SIMS/FMS or other stored files or email, these are to be conducted by the customer, as data controller.
Where you wish to make a request to access data that The ICT Service hold about you or your organisation, please refer to Cambridgeshire County Council’s data privacy notice at https://www.cambridgeshire.gov.uk/data-protection-and-foi/information-and-data-sharing/privacy-statement/
The right to rectification
Please refer to Cambridgeshire County Council’s data privacy notice at https://www.cambridgeshire.gov.uk/data-protection-and-foi/information-and-data-sharing/privacy-statement/ for contact information to rectify or update any information that The ICT Service has recorded against you or your organisation in their systems.
The right to erasure (also known as the “right to be forgotten”)
As data controller, it is the customers responsibility to respond to and act upon requests where the data subject has requested for the removal of information stored about them in SIMS/FMS or other stored files or email.
Please refer to Cambridgeshire County Council’s data privacy notice at https://www.cambridgeshire.gov.uk/data-protection-and-foi/information-and-data-sharing/privacy-statement/ for contact information to make such request to The ICT Service on information stored about you or your organisation in their systems.
The right to restrict processing
Individuals who are associated with a customer have the right to request that processing of their information is not processed. As data controller, the customer must respond to such requests.
The right to data portability
Upon termination of the SIMS/FMS contract, as a customer, you have the right to request a copy of your SIMS/FMS data in a format that is compatible with other systems. You should make such requests via the Service Desk and note this may be subject to a charge.