Digital Usage Policy (inc E-Safety)

1. Introduction

Within the school, digital technology is integral and ubiquitous to the educational process as well as in the administration of Orchard House School. Through this culture of exploring digital technologies, the curriculum is enhanced, and the school’s business workflows are improved. This policy addresses the requirement to ensure that children and staff are able to use digital technologies safely and responsibly.

1.1 Scope

1. This policy covers the acceptable usage of digital technologies for all pupils (including those in the EYFS) and staff of the school. It applies to all members of the school community (including governors, teaching staff, support staff, pupils, volunteers, parents/carers and visitors) who have access to and use the school ICT systems both in and out of school.
2. The school will deal with any e-safety incidents in accordance with the procedures outlined in both this policy and associated school policies, such as the Safeguarding, Behaviour and Anti-bullying policies. Where necessary or appropriate, the school will also inform parents of any incidents of unacceptable or inappropriate use of technology that takes place out of school.
3. The school will deal with any data protection breaches in accordance with the procedures outlined in the Data Protection policy, as informed (where the breach involves digital technology) by this policy.
4. The term ‘digital’ applies to all forms of technology and communications apparatus such as: Computers, Laptops, Mobile devices, Reprographics, Video conferencing units, Cameras, Programmable toys, Software, Internet/Intranet/Extranet/Cloud resources, Email, Apps, All forms of social media/networking sites, and Internet of Things enabled devices.

1.2 Risks

The use of digital technology can put children and staff at risk both in and out of school. Annex C to ‘Keeping Children Safe in Education’ (September 2024) — gov.uk guidance — categorises the main risks as:

• Content: being exposed to illegal, inappropriate or harmful material, e.g. pornography, fake news, racist or radical and extremist views.
• Contact: being subjected to harmful online interaction with other users, e.g. adults posing as children or young people.
• Conduct: personal online behaviour that increases the likelihood of, or causes, harm, e.g. making, sending and receiving explicit images, or online bullying.

Adults are at similar risks to those for children. Staff must also understand how to keep data safe by following the Data Protection Policy and must also be aware of and sensitive to the prevalence of phishing and malware websites and emails as well as their obligations and rights under the Data Protection Act 2018.

These risks are incorporated in the following areas: Self-image and identity, Online relationship, Online reputation, Online bullying, Managing online information, Health, well-being and lifestyle, Privacy and security, Copyright and ownership — which are the strands in education for a connected world. These strands are incorporated into the teaching in computing and RSHE lessons.

1.3 Aims

This policy aims to ensure that:

1. The school follows the statutory guidance on online safety in Keeping Children Safe in Education (September 2024) and other relevant guidance (see Paragraph 9).
2. To create a culture that incorporates the principles of online safety across all elements of school life.
3. The school provides clearly defined roles and responsibilities for online safety as part of the school’s wider safeguarding strategy.
4. All staff and pupils, both in and out of school, are responsible users of technology for educational, personal and recreational use and benefit from its use.
5. Pupils and staff are as clear about what is expected of them online as offline.
6. Pupils are protected from potential risks in their use of technology and are educated to understand the risks posed by the Internet and social media to bully, groom, abuse or radicalise other people, especially children and young people.
7. The school provides clear guidance on the use of technology in the classroom and beyond for all users, particularly staff and pupils, specifying where appropriate permissions/restrictions and sanctions for misuse.
8. Staff and pupils are aware of their responsibilities with regard to this policy.
9. The school’s ICT systems are protected from accidental or deliberate misuse that could put the security of the systems at risk.
10. The technical provision/infrastructure and the safeguards in place to filter and monitor inappropriate content and alert the school to safeguarding issues are fit for purpose and robust.
11. The school adheres to data protection requirements (please refer to the Data Protection Policy).
12. Reporting mechanisms are available for all users to report issues and concerns to the school, including details on how they are to be managed and/or escalated, and how these link with other safeguarding procedures.
13. The school informs, communicates with and provides guidance to parents/carers about use of digital technology in the children’s education and online safety.

2. Roles and Responsibilities

2.1 Heads

The head, who is one of the Designated Safeguarding Leads, has overall responsibility for e-safety within the school. The day-to-day management of this will be delegated to the e-safety officer and the head of IT. The e-safety officer in the school is the member of staff with responsibility for computing. The Data Protection Policy sets out responsibilities regarding data protection.

The head of the school is responsible for ensuring that the school has effective policies and procedures in place and as such will ensure that:

1. this policy is reviewed at least annually;
2. the policy is up to date, covers all aspects of current technology use, and that the policy is effective in managing any e-safety incidents;
3. e-safety and data protection training throughout the school is planned, up to date and appropriate for the recipients, e.g. pupils, all staff, senior leadership team and parents;
4. all e-safety and data protection incidents are reported promptly and dealt with appropriately;
5. the e-safety officer and other relevant staff receive suitable training to enable them to carry out their e-safety roles and train other colleagues, as relevant;
6. there is full awareness of the safeguarding procedures to be followed in the event of an e-safety incident;
7. there is a full awareness of the data protection procedures to be followed in the event of a data breach (see the Data Protection Policy);
8. she or he keeps up-to-date with the latest advice and guidance on the subject of e-safety and data protection.

2.2 Governors

The governors will ensure that the school:

1. keeps up to date with emerging risks and threats through technology use;
2. ensures that online safety training for staff is integrated, aligned and considered as part of the overarching safeguarding approach;
3. receives regular updates from the heads in regard to training, identified risks and any incidents;
4. ensures children are taught about safeguarding, including online safety, through the curriculum and RSHE;
5. ensures that data protection compliance training for staff is integrated, aligned and considered as part of staff core training and that additional data protection awareness and training is otherwise sufficient to ensure staff are alive to the need to protect personal data processed by the school.

The head will have overall responsibility for e-safety and data protection at the school and will ensure this policy is adhered to.

2.3 E-safety officers (computing coordinator at the school)

The school’s head of computing is responsible for the day-to-day duties of managing e-safety. The e-safety officer will be trained in online safety issues and be aware of the potential for serious safeguarding issues to arise from sharing of personal data, access to illegal/inappropriate materials (including potential for actual incidents of grooming), and online bullying.

The e-safety officer will:

1. report all e-safety incidents to the DSL immediately;
2. keep up to date with the latest risks to children whilst using technology;
3. be familiar with the latest research and available resources for school and home use;
4. review this policy regularly and bring to the attention of the head any matters that might make an amendment desirable;
5. advise the head on all e-safety matters;
6. engage with and educate parents and the school community on e-safety matters at school and/or within the home;
7. liaise with Technical Support and other agencies as required;
8. retain responsibility for the e-safety incident log and report all incidents to the head;
9. ensure staff know what to report and that all safeguarding incidents are reported to the DSL as outlined in the Safeguarding Policy;
10. through liaison with Technical Support, ensure any technical e-safety measures in school (e.g. internet filtering software) are fit for purpose;
11. be aware of any reporting function with technical e-safety measures, e.g. internet filtering reporting function, liaising with the head and the managing director to decide on what reports may be appropriate for viewing;
12. approve or disapprove YouTube videos on the Google Apps for Education platform.

2.4 Technical support staff

The Technical Services team are responsible for:

1. keeping up to date with emerging risks and threats through technology use;
2. liaison with the heads in regard to training, identified risks and any incidents;
3. liaison with the school data compliance officers in regard to training, identified risks and any data breach incidents;
4. ensuring the IT technical infrastructure is secure, which will include as a minimum: anti-virus that is fit-for-purpose, up to date and applied to all capable devices; system updates regularly monitored and devices updated as appropriate; e-safety technical solutions such as internet filtering operating correctly; filtering levels applied appropriately and according to the age of the user; categories of use discussed and agreed with the e-safety officer and head; passwords applied correctly to all users regardless of age (see Paragraph 6); USB memory stick use limited to those with explicit permission and sticks sanitised for viruses/malware before connecting to any school network; the school’s approach to the retention of data followed; and endpoint devices managed well and safe for use, both physically and digitally;
5. ensuring that homeworking devices are sufficiently encrypted, and password protected;
6. setting an example and being a model digital citizen to all pupils, staff and parents, engaging where appropriate in conversation and advice on e-safety and digital usage.

2.5 All staff (including support staff)

Members of staff must ensure that:

1. all details within this policy are understood — if anything is not understood it must be brought to the attention of the head;
2. he or she has an up-to-date awareness of e-safety and data protection matters and of the school online safety policy and practices;
3. he or she has read and understood the staff and pupil acceptable usage policies (for pupils, see Appendix I; for staff, see Appendix II);
4. he or she reports any suspected misuse, problem or e-safety incident to the e-safety officer and Designated Safeguarding Lead (DSL) immediately;
5. any digital communications with pupils (email, cloud platforms) are on a professional level and only carried out using official school systems, adhering to this policy;
6. he or she embeds safe and responsible usage of digital technology in all aspects of the curriculum and other school activities;
7. he or she ensures pupils follow the pupils’ acceptable usage policy and understand the tenets of pupils’ appropriate digital usage as set out in section 2.6 below;
8. he or she acts as a good role model for pupils in their use of digital technology;
9. any data breach is immediately reported in accordance with the Data Protection Policy;
10. each understands the reporting flowcharts contained within this policy.

2.6 All pupils

All staff are responsible for making pupils aware of the following aspects of digital usage:

1. to appreciate online safety issues and to act responsibly in their use of digital technology;
2. to use school digital equipment in accordance with the acceptable usage policy for pupils;
3. to understand the importance of reporting abuse, misuse or access to inappropriate materials and to know how to report such to any member of the teaching staff;
4. to have a good understanding of research skills and the need to avoid plagiarism and uphold the copyright of others;
5. to understand the school’s policies on the use of mobile devices;
6. to understand the school’s policies on the taking and use of images;
7. to understand the school’s policies on online bullying;
8. to carry the same level of understanding and follow these policies outside school.

The boundaries of use of ICT equipment and services in this school are set out in the Pupils’ Acceptable Use Policy (see Appendix I). Any deviation or misuse of ICT equipment or services will be dealt with in accordance with the school’s Behaviour Policy.

2.7 Parents and carers

Parents play the most important role in the development of their children. The school will therefore do all that it reasonably can to ensure that parents have the skills and knowledge they need to ensure the e-safety of children outside the school environment. Through parents’ evenings, school circulars and newsletters, the school will keep parents up to date with new and emerging e-safety risks and will involve parents in strategies to ensure that pupils are protected.

Parents will be encouraged to support the school by:

1. promoting good online safety practice;
2. following the guidelines on safe and appropriate use of technology;
3. accessing the secure parents’ section of the school website as instructed by the school;
4. supporting and endorsing the guidance set out in the pupils’ acceptable usage policy.

3. Education Strategies

Whilst the school uses technical procedures for the control of and monitoring of internet activity, it is the marriage of these protocols with the protocols on behaviour that create the most secure environment. Children, including those in the EYFS, will be taught to recognise and avoid online safety risks and to behave online in an appropriate manner. This will largely take place through the computing and PSCHE curriculum but will also be manifest in the general ethos of the school towards online behaviour.

In EYFS this involves using the following strategies

• Check apps, websites and search results before using them with children.
• Children in Early Years should always be supervised when accessing the internet.
• Ensure safety modes and filters are applied – default settings tend not to ensure a high level of privacy or security. But remember you still need to supervise children closely.
• Role model safe behaviour and privacy awareness. Talk to children about safe use, for example ask permission before taking a child’s picture even if parental consent has been given.
• Make use of home visits to inform your understanding of how technology is used within the home and the context of the child with regard to technology.
• Check privacy settings to make sure personal data is not being shared inadvertently or inappropriately.

Source: Safeguarding children and protecting professionals in early years settings: online safety guidance for practitioners, 4 February 2019, Section 4.

Staff will be kept up to date with the latest legislation and advice from the DfE and from other organisations such as CEOP (Child Exploitation & Online Protection) and the NSPCC. Parents will receive help and advice from the school to create safe online environments at home and outside of school. Education is therefore an essential part of the school’s digital safety provision.

3.1 Staff

It is essential that staff receive e-safety and data protection training and understand the above responsibilities. Training will be offered as follows:

1. all new staff will receive e-safety and data protection training as part of their induction programme, ensuring that they understand the acceptable usage policy and their responsibility to follow the reporting procedure;
2. any new e-safety issues will be brought to the attention of staff at staff meetings;
3. all staff will receive refresher training sessions once a year.

3.2 Pupils

1. E-safety is embedded into the school’s curriculum; pupils will be given the appropriate advice and guidance by staff.
2. All pupils will be fully aware of how they can report areas of concern whilst at school or outside school.
3. A separate computing policy for the school details methodology and topics for the teaching of computing and digital literacy.
4. Pupils will be taught the importance of safe and responsible technology usage as part of their computing lessons and through the PSHCE curriculum; this will include using a selection of e-safety books and resources, including those developed by CEOP. A detailed outline of the topics covered within each year group can be found in the Computing and RSHE Schemes of Work for the school. At all times, due consideration is given to the age and level of understanding of the pupils.
5. From September 2020, Relationships Education has been compulsory for all primary-aged pupils. This will include being taught what positive, healthy and respectful online relationships look like, the effects of their online actions on others and knowing how to recognise and display respectful behaviour online. This will complement the existing computing and PSHCE curriculum.

3.3 Parents

1. At the beginning of each academic year, parents are invited to a curriculum evening, which will usually include items on e-safety and at parents’ evenings, and the computing teacher will be available to talk to parents about the e-safety teaching which takes place in class.
2. The school’s parent portal has a link to parentinfo.org, which is a free service for schools and parents that provides expert information to help children stay safe online. Through this service, parents can look up information and obtain the best security practice information on websites and apps that are popular with children.

4. Procedures

4.1 The technology

1. The school is committed to an ongoing programme of replacement and enhancement of ICT equipment and software. New computers are bought as necessary each academic year either as replacements or as additional resources and the school is therefore continuously improving its resources. All classrooms have an interactive whiteboard and all staff have access to a laptop.
2. Computing departmental expenditure is monitored centrally by the head of IT at Dukes Education Outer London and the head.
3. The links to the various software companies’ catalogues are available on the school’s intranet page, and staff are made aware of these during staff meetings. Staff can request help/support/advice about this from the head of computing. After consultation with the head of computing, staff may request to buy or subscribe to ICT software that relates specifically to their subjects: the head of IT for Dukes Education Outer London will then check with the school’s head and order the software if approval is obtained. Members of staff should never place such a purchase order themselves. This is because all suppliers of software are vetted: where the processing of personal data is concerned, a data sharing agreement will be formed between the supplier and school, while software security (e.g. propensity to viruses or malware) is also assessed.
4. The school uses a range of digital devices. To safeguard the pupils and prevent loss of personal data, the technology described in paragraphs 4.2 et seq below is employed.

4.2 Filtering

The school uses a hardware firewall with a content filtering service that prevents unauthorised access to illegal websites. It also prevents access to inappropriate websites. What is considered to be appropriate and inappropriate is determined by the age of the user and is reviewed in line with this policy or in response to an incident. The head of computing and the technical services team are responsible for ensuring that the filtering is appropriate and that any issues are brought to the immediate attention of the head.

Email filtering for pupils

The school uses G-Suite for Education as an email server for pupils. This type of email server prevents any unauthorised senders from sending emails to school pupils. Pupils will also not be authorised to send emails to recipients outside the defined ‘safe list’, which includes domains of the other schools and certain educational bodies.

Encryption

All school devices that hold personal data (as defined by the Data Protection Act 2018) are encrypted. No data is ever allowed to leave the school on an unencrypted device; all devices that are kept on school property and which may contain personal data are encrypted. Any breach (i.e. loss/theft of device such as laptop or USB key drives) must be addressed in accordance with the Data Protection Policy.

Google Safe Search and YouTube Restricted Mode

All devices within the school are programmed to route Google searches only through the Google Safe Search site, which displays only safe search results. When accessing the YouTube video sharing site, all devices within the school are programmed into ‘restricted YouTube’ mode, which restricts videos and audio clips to those that are appropriate.

4.3 Passwords

The correct use of passwords is fundamental to proper data usage. See Paragraph 6 below for more detailed information on passwords.

4.4 Anti-virus

All school devices have anti-virus software where this is feasible. This software is updated at least weekly for new virus definitions. IT Support is responsible for ensuring this task is carried out and will report to the head if there are any concerns. All USB peripherals such as key drives must be scanned for viruses before use.

Viruses are also scanned on the firewall level, so viruses are automatically blocked and monitored. This guards against such viruses from infecting computers behind the firewall (this applies to all devices except those that connect via the mobile network via 3G or LTE connections).

4.5 Emails

1. The school’s email service is to be used for professional work-based emails only. Emails of a personal nature are not permitted. Similarly use of personal email addresses for work purposes is not permitted. Staff must understand that the emails they send and receive are official records that can be disclosed to relevant parents, staff, other third parties or to the Information Commissioner’s Office (ICO) if a subject access request (SAR) is made. Staff are required never to use email communication casually.
2. The school has an email component linked to the internet server. Email addresses are created using the model: firstname.lastname@staff.orchardhs.org.uk or firstname.lastname@pupils.orchardhs.org.uk for pupils, with the exception of the head whose e-mail is initials.lastname@orchardhs.org.uk.
3. Access is as follows: pupils have access to the email messaging service via their G-Suite account, allowing them to email a restricted number of addresses specifically permitted by the ICT staff, primarily school addresses and specified other addresses that have been approved; members of staff may send and receive emails externally but not to parents, to whom messages may be sent only through the school office; staff are able to access their school emails from home and will need to follow the procedure on how this may be achieved via the webmail link on the school’s website.
4. Staff should use their school email address for correspondence of a professional nature. It is unacceptable to use personal email addresses for school or professional communication. Similarly, except with the consent of the head, it is unacceptable for any member of staff to forward data related to the school and/or to children to any external email addresses, including their own personal email. For example, staff must not forward a child’s report from his/her school email account to his/her personal account.
5. All e-mails from the school addressed or copied to an external e-address must by law show at the foot of the e-mail the school’s (or, where relevant for central staff) statutory footer, and it is good practice to show the school’s telephone number, thus:

This footer can be generated using the Dukes email footer creator, dukes.email.

6. If the relevant footer is appropriately displayed earlier in an e-trail of emails such that, by scrolling down, it can easily be seen, then it need not be repeated in later emails where these are within the same linked trail.
7. Staff must not engage in any email correspondence which could be viewed as offensive or makes unsubstantiated claims or gossip about other staff, parents or pupils. Staff are permitted to check their personal email accounts but should do so only in staff areas such as staff rooms; access at other points during the working day should be avoided. Staff should be aware that, if the head believes that traffic generated by or sent to a member of staff may have been inappropriate or in contravention of any other school policies, the school reserves the right without notice to inspect and review email traffic that has passed through or is resident upon the school’s system. Staff must also be careful to avoid any email traffic being displayed inadvertently on a whiteboard or a computer screen such that it could be overlooked by a child or other member of staff to whom the data on display is not relevant and may be inappropriate.
8. Staff must be aware that some email client programs, such as Microsoft Outlook, give alerts when emails are received, so staff should avoid typing sensitive material, e.g. ‘Susie leaving at end of term’ in the subject line. These alerts can be turned off within ‘Preferences’ or via a request submitted to the school’s head of computing. Emails must be checked at least once in the morning, at lunchtime and before leaving at the end of the school day. Please refer to the Acceptable Usage Policy – Staff.

4.6 Use of the internet

Staff should use the internet at work primarily for work-related tasks; any personal usage should be sparse and in rest breaks only, such that it does not interfere with the performance of the member of staff’s duties or with the normal operation of the school internet (e.g. downloading large files could slow the internet for other users). Staff must not use work devices to view or distribute inappropriate content. In particular, staff must not:

1. take part in internet activities which could bring the school into disrepute;
2. create or transmit material which might be defamatory for the school or which could create an unwanted liability for the school;
3. view, download, create or distribute any inappropriate content — including pornography, racial or religious slurs, content relating to illegal drug use, gambling or which facilitates or promotes criminality, or any content which could lead to a claim of unlawful discrimination;
4. use any programmes or software to bypass the school security systems.

The above rules on use of the internet also apply to browsing the internet on a device owned by the school even when not at work. The school reserves the right to monitor and review the internet usage of any member of staff at work or on a school-owned device and to take disciplinary action (up to and including summary dismissal) for use which contravenes this policy.

4.7 Contact with Parents

Emails to and from parents: staff must forward all email communication with parents to the school’s office. An intended outbound email can then be sent on from the school’s general office email address, info@orchardhs.org.uk. There can be no exceptions to this rule. Heads are given the facility on their desktops to respond to email traffic from their school’s ‘info’ address and this address is always to be preferred.

Emails from parents must be responded to before the close of the day, although in the case of a complex enquiry initially it is adequate to state something like ‘Thank you for your email. I am looking into this and will respond by…’ stating a date by which the school will respond in substantive terms. Such complex emails must always be brought to the attention of the head, even if the office or another member of staff will resolve the query.

4.8 Contact with external processors when personal data is shared

Emails sent from the school mail services such as Office 365 and Google Mail are naturally encrypted during transit so that they cannot be intercepted. When sending emails with personal data to external processors such as the NCTL or the LA, the school office may consider further encryption whereby those emails can only be read by the intended recipients, who will require a separate key to open the email.

4.9 Phishing and ransomware

The school uses Apple Mail, Google Mail and Microsoft 365 servers. This mostly prevents infected email being sent from or being received by the school. “Infected” is defined as an email that contains a virus or script (i.e. malware) that could be damaging or destructive to data, or spam email such as a phishing message.

Ransomware is a type of computer virus that gives criminals the ability to lock files on a computer that the criminals have infected – the screen then displays a pop-up window informing the user that the computer will not be unlocked until a sum of money is paid. An additional twist is that an accusation of illegal activity or a pornographic image often appears on the locked screen, making it more difficult and embarrassing for users with infected machines to seek help from anybody else: many users simply resort to paying the ransom sum demanded by the criminals to supply an ‘unlock’ code. The technical procedures detailed below put in place counter-measures against ransomware. However, alongside creating technical policies and installing machines to control what to let in or out of the school, we also need to be extremely vigilant in what we open and send in emails as well as taking great care in choosing websites we browse. It is the marriage of machine protocols and of user behaviour that creates the best and most effective anti-virus strategy. Staff are reminded to digest and follow the rules below:

1. Be alert to email traffic, whoever the sender at first glance may appear to be. Infectious viruses can arrive in the guise of what purports to be an email from a colleague. If you receive an email with an attachment or containing a link, even if it would seem to be from a colleague, always question why he or she has sent you that email. If you harbour any suspicions about the email, please call the colleague who appears to have sent it to check that he or she was indeed the sender. Staff with good IT knowledge can also inspect such emails via “view source” or similar within each email client, which will often reveal the true origin of an email.
2. Never log in to external websites (unless it is Google/G-Suite or you are under the guidance of your school’s head of computing or the IT team). It is highly unlikely that a colleague will send you an attachment that directs you to a page to log in. You should already be logged in if you are receiving emails, so do not log in again, no matter how convincing the address bar and web page look.
3. Even when it’s Google/G-Suite, check the Google address. If prompted to log in to a legitimate service, always first check the address bar to make sure you recognise the web address of the service you intend to browse.
4. Never enable macros on documents or files sent from an external address. Many ransomware viruses are embedded in Microsoft Office documents, which trick the user into running a malware macro that then infects the computer.
5. If you are ever unsure, please log a request for technical support through the technical support website (KevKall).

4.10 Archival and the retention of emails

The retention period of pupil, parent and staff data is covered within the Data Protection Policy. Emails that are stored on school systems are backed up and archived according to this policy, which means that emails are (so far as practicable) kept for 50 years.

4.11 Children’s email accounts

Children may be given access to a school email account (subject to approval by the school), following on from a module of work on internet and email safety. The format of this account is firstname.surname@pupils.orchardhs.org.uk with a password at least six alphanumeric characters long. Children can access their email accounts at both home and school, and proper use of this forms the basis of teaching good electronic communication skills.

4.12 Contact with children

The school email system allows children to communicate with staff at any time, including out of school hours. This allows children to submit work and request help but must not be used for any personal communication with the children. Staff are also under no obligation to respond to an email from a pupil arriving outside normal school hours. To maintain a high level of professional communication between staff and children, the school reserves the right to monitor email communications and postings on internal school sites.

4.13 Photographs and video

The development of digital imaging technologies has created significant benefits to learning, allowing staff and pupils instant use of images that they have recorded themselves or downloaded from the internet. However, staff, parents/carers and pupils need to be aware of the risks associated with publishing digital images on the Internet, which may provide avenues for cyberbullying and may remain available online indefinitely, causing harm or embarrassment. It is common for employers to carry out internet searches for information about potential and existing employees.

When using digital images, staff should inform and educate pupils about the risks associated with the taking, use, sharing, publication and distribution of images, in particular the risks of publishing their own images on social networking sites.

Staff and volunteers are allowed to take digital/video images to support educational aims, but must follow school policies concerning the sharing, distribution and publication of those images. Those images should be taken only on school equipment: the personal equipment of staff should not be used for such purposes, unless the head has given specific prior permission.

The school’s privacy notices for parents indicate that photographs of their child(ren) may be used in school publications, on the school website or in other materials created or promoted by the school in the public domain.

For any external use of digital images:

1. if the pupil is named, the school does not publish a photograph;
2. if a photograph is used, the school avoids captioning the photo with the pupil’s name;
3. when showcasing examples of pupils’ work, only first names are used;
4. if showcasing digital video work to an external audience, care is taken to ensure that pupils are not referred to by name on the video and that pupils’ full names are not given in the credits;
5. only images of pupils in suitable dress are used.

4.14 Social networking by staff

There are many social networking services available, and the school is fully supportive of social networking as a tool to engage and collaborate with the parents of current and prospective pupils. The following social media services are permitted for use within the school and have been appropriately risk assessed. Should staff wish to use other social media, permission must first be sought via the e-safety officer, who will consult the head for a decision to be made. Any new service will be risk assessed before use is permitted:

• Facebook
• Instagram

A broadcast service is a one-way communication method in order to share school information with the wider school community. No persons will be “followed” or “friended” on these services and as such no two-way communication will take place.

In addition, the following is to be strictly adhered to: there is to be no identification of pupils by name; where services are “comment enabled”, comments are to be set to “moderated”; and all posted data must conform to copyright law – images, videos and other resources that are not originated by the school are not allowed unless the owner’s permission has been granted or there is a licence which allows for such use (i.e. creative commons).

Notice and take down policy – should it come to the school’s attention that there is a resource which has been inadvertently uploaded, and the school does not have copyright permission to use that resource, it will be removed within one working day.

Further guidance for staff on social networking use is contained in the staff code of conduct within the Safeguarding Policy.

4.15 Digital usage of personal data

The Data Protection Act 2018 provides considerable protection of pupils’ personal data, and the UK data protection watchdog, the Information Commissioner’s Office (ICO), has fined educational establishments and individual teachers found to be failing in the duty to keep such data secure. The following guidelines will assist staff in processing personal data.

Data which comprises photos of children must only be used at school or on a school device. The school encourages staff to take photos and videos of children at work and play, as these are important aspects of school life to record and are welcomed by children and parents alike. However, basic disciplines must be observed – it is acceptable only to take images and video of children in the classroom on a school device.

The use of personal data held within the school should not be abused. Such use must be proper, and further guidance on lawful use of data in education is available from the Information Commissioner’s website. In brief, under the DPA 2018, the school and its staff must:

1. only collect information that is needed for a specific lawful purpose;
2. keep it secure;
3. ensure it is relevant and up to date;
4. only hold as much as is needed, and only for as long as it is needed;
5. allow the subject of the information to see it on request;
6. only hold onto the data for as long as it is lawfully required;
7. allow the subject of the information to erase some or all data concerning the subject if this does not also hinder safeguarding aspects.

Dukes Education and the school’s head take the security of pupils’ personal data extremely seriously. Data pertaining to children, such as academic records, examination and test data, etc, should never be taken off school premises unless specific written authorisation has been obtained from the head of the school or, in her or his absence, from the managing director. This rule applies not only to laptops but also to disks, USB memory sticks, mobile phones, iPads, MP3 devices or any other electronic device upon which data may be stored. Even with such authorisation, the member of staff seeking to take data off site must nonetheless liaise with the head of computing or the IT technical staff to ensure proper data security, encryption, or file protection is in place.

If pupils’ personal data is required by a teacher working elsewhere, for example for the analysis of work or the writing of reports, remote access is granted via the Google G-Suite ecosystem (Google Drive, Google Docs and Google Sheets). Staff must only use Google G-Suite through an Internet browser and must not download any content from that platform onto their personal device. The only exceptions are certain school staff (bursary and IT technical staff), the heads, deputy heads and the heads of computing, all of whom use computers that are school property and each of whom must be satisfied about the installation and activation of full disk encryption (FDE) on his or her laptop, or that the laptop is protected by a file security program such as FileVault™ or similar, or both. When travelling with such a device, the machine must also be fitted with an effective screensaver password and shut down before transit.

It follows from the two paragraphs above that, save for the exceptions noted therein, no personal data should ever be in transit on any IT device outside the school. Failure to comply with this aspect of this policy will be regarded as a very serious disciplinary breach and could result in a fine by the ICO on the individual member of staff.

If a member of staff authorised to do so is working on such data remotely in a semi-public place, e.g. on a train or in a café, he or she must ensure that inappropriate eyes may not snoop and shut down the device whenever it is not fully supervised. Use of laptops etc. in such surroundings is always risky and should, where possible, be avoided.

When a teacher leaves the school’s employ, should there be any personal pupil data inadvertently remaining off-site on a personal system, this must immediately be reported, and all instances must be deleted. Any devices that belong to the school, such as laptops, USB memory sticks, or disks, must be returned to the school’s office.

The school uses cloud services for teaching and learning (setting and marking homework), communication and curriculum management. In accordance with the DfE’s guidance on cloud computing and the GDPR, the following services have been chosen by the school, and these organisations have participated in the DfE’s self-certification scheme:

• G-Suite for Education – Google Classroom, Google Drive, Google Calendar
• Microsoft 365 – Microsoft OneDrive, Microsoft Office Suite

All external educational suppliers which process pupil data on the school’s behalf have been audited for their DPA 2018 compliance. This process is conducted using the GDPRiS platform, whereby suppliers are registered with GDPRiS and have shared their data sharing agreement with it. Any of these suppliers which store data outside of the EEA have been vetted so that they appear on the Privacy Shield, a mechanism for U.S.- and EEA-based companies to comply with cross-border data protection requirements. For more information on the DPA 2018 and data protection, please refer to the Data Protection Policy.

4.16 Remote Learning inc Video Conferencing

The school has the opportunity to use video conferencing software to conduct teaching and learning when teachers or children are not in school (distance learning). The same standards of behaviour are expected of pupils in remote sessions as would be expected in a real classroom – for example, never talk over the teacher, wait to be invited to speak or to write on the whiteboard, and treat all other pupils with respect. During remote sessions with teachers, pupils should be dressed appropriately, in the same manner as they would be for an ‘Own Clothes’ day.

All contact between staff and a pupil must only be made through Google Classroom. Pupils will have an opportunity every day to touch base with their class teacher, and can communicate with their teachers during normal school hours via the stream on Google Classroom. They should not expect an immediate response to emails outside of lesson time; teachers will aim to respond as soon as they can.

Using Google Classroom and Zoom

1. Pupils need an appropriate space in which to attend sessions – a desk and a chair within an enclosed space that is public, but quiet. Using headphones will be useful in reducing surrounding noise.
2. In Zoom sessions, ensure you are in a quiet space. You should not use a bedroom in this situation.
3. Do not eat, listen to music or have the TV on during a session, just as you would not in a real lesson.
4. You must not leave sessions without permission from a teacher.
5. During a session, keep the microphone on mute unless directed by the teacher to turn this function on.
6. Respect the privacy of teachers and of other pupils. Do not record sessions, take screenshots or post any element of the session online — this will be treated as a serious breach of the behaviour policy.
7. Do not conduct any pupil-to-pupil chat during a session unless the teacher directs you to do so. Forms of less formal communication such as memes, emojis, GIFs, stickers, text talk, etc. should not be used.
8. Do not use Zoom outside of session times.

Online safety at home

As children work from home using digital technology, parents need to ensure that children are staying safe when using the technology. All parents should ensure that they follow the online safety advice that the school continually offers.

1. Children should only use devices (laptops, iPads and phones) in an area where parents are able to monitor what is happening.
2. It is vital that parents are aware of what their child(ren) are doing when using a device, including putting parental controls in place where needed – though vigilance is a far better tool than any technical control offered.
3. The risks of being online are the same as any other time: inappropriate content, stranger danger, cyberbullying, disclosing private information, phishing, and personal reputation harm, to name a few. As a school, we aim to minimise these risks, but it must be the parents’ responsibility to ensure children are safe at home.
4. If a teacher offers any video conference links for a specific session, a parent or carer should be in the room with the child at all times during this interaction, without fail, if a child is using the video camera or microphone. The school has the right to record every live video feed; children should not record any live feeds.

5. Incidents

5.1 E-Safety incident

It is expected that all members of the school community will be responsible users of ICT who understand and follow this policy. However, there may be times when infringements of the policy could take place, through careless or irresponsible or, very rarely, deliberate misuse. An online safety incident is defined as a violation of the Staff Acceptable Usage Policy (Appendix II), the Pupils’ Acceptable Usage Policy (Appendix I), or a safeguarding incident involving technology. If a member of staff suspects that misuse might have taken place, the following procedures should be followed in reporting the incident.

1. Children should be regularly reminded to report anything they feel unhappy with, and staff must act upon this according to the online safety procedures.
2. In the event of an accidental online safety incident, e.g. a child or staff member inadvertently accessing inappropriate material, the school’s e-Safety officer must be informed for an investigation to be carried out.
3. Where cyberbullying is identified, the matter will be reported immediately to the head.
4. Where the matter is not bullying but is a child protection issue, reporting processes as laid out in the Safeguarding Policy will be followed. The initial step is to immediately report the matter to the designated safeguarding lead (DSL).

If a member of staff suspects that misuse might have taken place, but that it is seemingly a minor infringement and is not illegal (e.g. a staff member using ICT for personal use, or a child using another child’s login details), these steps should be followed:

1. staff must use KevKall (kevkall.houseschools.com) and select the help topic title “Report an e-safety incident” to report incidents;
2. the e-safety officer must be informed;
3. the e-safety officer will judge whether this concern requires an investigation and will report the incident to the head;
4. if the investigation has substance, appropriate action will be required and could include internal response or disciplinary procedures;
5. if the incident gives rise to any safeguarding concern, this must be reported immediately to the DSL.

In the event of suspicion of deliberate misuse where the incident is serious – e.g. a member of staff looking at websites that incite racial hatred, or a child uploading inappropriate images of him/herself – the following procedure should be followed:

1. the device should be locked;
2. no images or content should be forwarded, nor should devices be searched for further content;
3. the incident must be reported to the head immediately;
4. the incident must be reported to the Technical Services Team immediately so that URLs are closely monitored and recorded;
5. isolate the computer in question as best you can – any change to its state may hinder an investigation;
6. record the URL of any site containing the alleged misuse and describe the nature of the content causing concern; it may also be necessary to record and store screenshots of the content;
7. if the content being reviewed includes images of child abuse, monitoring should be halted and the DSL will consider the situation in accordance with the Safeguarding Policy. Other instances would include incidents of ‘grooming’ behaviour, the sending of obscene materials which potentially breach obscene publications legislation, criminally racist material, other criminal conduct, activity or materials, and material related to radicalisation.

6. Passwords

The school treats data security very seriously, especially as its digital services are available outside the physical confines of the school. Passwords are an important aspect of computer security. A poorly chosen password may result in unauthorised access and/or exploitation of the school’s data resources. All users, including contractors and vendors with access to the school’s systems, are responsible for taking the appropriate steps outlined below to select and secure their individual passwords.

6.1 Purpose

The purpose of this password policy is to establish a standard for the creation of strong passwords, the protection of those passwords, and the frequency of change.

6.2 Scope

The scope of this password policy includes all personnel who have or are responsible for an account (or any form of access that supports or requires a password) on any system that resides at the school facility or any cloud-based service that the school subscribes to, that has access to the school’s network or that stores any non-public school information.

6.3 Where this policy applies

This policy applies to the following but is not limited to these services: MacOS Network account (school login), Wifi networks, School email accounts, School G-Suite accounts, iSSAMS accounts, School websites, Policies and Knowledge Bank Matrices, School intranet, Blue Sky appraisal, CPOMS, School online galleries, and online learning services such as Mathletics, Education City, Purple Mash, Atom Learning and IXL.

6.4 Password change frequency

All system-level passwords (e.g. root, system administrator, local administrator etc) will be changed on at least a yearly basis by the IT team. The passwords to all staff accounts should be changed at least on a yearly basis and at any point promptly if the user should come to believe his or her password has been compromised.

6.5 Secure passwords

All system-level and staff account passwords must be strong rather than weak. All users should be aware of how to select strong passwords.

Strong passwords

Weak passwords

Contain at least three of the following five character classes – lower case characters, UPPER CASE CHARACTERS, numbers, punctuation, and “special” characters (e.g. @#$%^&*()_+|~-=\`{}[]:”;'<>/ etc) – and contain at least 8 characters.

Contain fewer than 8 characters; are a word found in the dictionary (foreign or English) even if alpha-numeric; are a common usage word such as names of family, pets, friends, co-workers or fantasy characters; use birthdays or other personal information such as addresses and phone numbers; use word/number patterns or palindromes such as aabb, qwerty, 123321; or use any of the above preceded or followed by a digit (e.g. kevinchung1, orchardschool2014).

6.6 Password protection: how to help yourself

1. Always use different passwords for school accounts from other non-school access (e.g. personal email accounts, ISP etc).
2. Do not share school passwords with anyone.
3. Passwords should never be written down or stored electronically without encryption (e.g. do not write a password on a sticky note and stick this to your computer!).
4. Do not reveal passwords in email, iChat, or other electronic communications.
5. Do not hint about the format of passwords.
6. If someone should ask for help with a password, please refer them to this document.
7. If compromise of an account or password is suspected, report the incident on KevKall immediately.

7. Enforcement

It is very important that this policy should be followed by staff carefully and diligently; departures from it will be investigated and may result in disciplinary action.

8. Policy Monitoring

The implementation of this digital usage policy will be monitored by the e-safety officer at the school. It will be developed in light of its success, significant new developments in the use of the technologies, new threats to digital safety or incidents that have taken place. Should online incidents take place, the school’s DSL (the head) must always be informed.

9. Legislation and Guidance

The following statutory and non-statutory guidance has been reflected in this policy:

• DfE statutory guidance – Keeping Children Safe in Education (September 2024)
• Teaching Online Safety in Schools (June 2019)
• Safeguarding Children and Protecting Professionals in Early Years Settings (February 2019) advice for managers and practitioners
• The UK Safer Internet Centre (www.saferinternet.org.uk)
• CEOP’s Thinkuknow website (thinkuknow.co.uk)
• UK Council for Child Internet Safety (UKCCIS)
• The Data Protection Act 2018

10. Information and Support

There is a wealth of information available to support schools and parents to keep children safe online. The following is not exhaustive but provides a useful starting point:

• www.thinkuknow.co.uk
• www.disrespectnobody.co.uk
• www.saferinternet.org.uk
• www.internetmatters.org
• www.pshe-association.org.uk
• www.educateagainsthate.com
• gov.uk – The use of social media for online radicalisation
• nspcc.org.uk/onlinesafety
• parentzone.org.uk

Appendix I – Acceptable Usage Policy: Pupils

(This Acceptable Usage Policy is printed, laminated and displayed in all classrooms in KS2.)

Appendix II – Acceptable Usage Policy: Staff

(This Acceptable Usage Policy is laminated, printed and displayed in all staff common areas.)

Internet access

Staff must not visit Internet sites, make, post, download, upload, data transfer, communicate or pass on, material, remarks, proposals or comments that contain or relate to: child abuse; pornography; discrimination of any kind; the promotion of racial or religious hatred; the promotion of illegal acts; statements or images that are intended to radicalise people or in any other way endorse, condone or incite extremist or terrorist activities; contain threatening behaviour, including promotion of physical violence or mental harm; any information which breaches the integrity of the ethos of the school or brings the school into disrepute; or any other information which may be illegal or offensive.

Inadvertent Internet access must be treated as an e-safety incident, reported to the e-safety officer, and a KevKall incident completed.

Social networking

This is allowed in school in accordance with the e-safety policy only and as outlined in the Staff Code of Conduct within the Safeguarding Policy. Staff using social networking for personal use should never undermine the school, its staff, parents or children. Staff must not become “friends” with parents or pupils or former pupils on personal social networks such as Facebook, Twitter, Instagram or LinkedIn.

Use of Email

Staff are not permitted to use school email addresses for personal correspondence unrelated to school business. All email should be kept professional: whilst there can be no objection to a degree of informality in internal emails, the body text of any intended to go outside the school, for example to parents, should be composed no less rigorously than an old-fashioned letter. Staff are reminded that school data, including emails, is open to subject access requests under the DPA 2018.

Passwords

Staff should keep passwords private. There is no occasion when a password needs to be shared with another member of staff, pupil or IT support.

Data Protection

If it is necessary for staff to take work home, or offsite, they should ensure that any devices (laptop, USB pendrive etc.) are encrypted. On no occasion should data concerning personal information be taken offsite on an unencrypted device.

Personal Use of School ICT

Staff are not permitted to use ICT equipment for personal use unless specific permission has been given from the head, who will set the boundaries of personal use.

Images and Videos

Staff must not, without consent, upload to any internet site or service images or videos of themselves, other staff or pupils. This is applicable not only professionally (in school) but also personally (e.g. staff social events).

Use of Personal ICT

Use of personal ICT equipment is at the discretion of the head. (See Appendix V for guidance on use of personal devices.)

Viruses and other malware

Any virus outbreaks must be reported to Technical Support as soon as it is practical to do so, along with the name of the virus (if known) and actions taken by the school.

Social Media – e-safety

Like health and safety, e-safety is the responsibility of everyone. As such staff will promote positive e-safety messages in all use of ICT whether they are with other members of staff or with pupils. Any member of staff who suspects that a member of the school community is accessing inappropriate material or not abiding by the school’s e-safety policy and protocols must report any allegation, complaint, concern or suspicion directly to the head. If the head is absent or is the subject of the concern, the concern must be reported to the managing director.

Mobile Networks

The school’s Firewall infrastructure is designed to keep all users of the Internet within the school safe. Staff must not circumnavigate the school’s network by using the Internet via mobile network connections such as 3G or LTE.

Appendix III – Incident Procedures and Flowchart

Appendix VI – Information and Support

There is a wealth of information available to support the school to keep children safe online. The following is not exhaustive but provides a useful starting point:

• www.thinkuknow.co.uk
• www.disrespectnobody.co.uk
• www.saferinternet.org.uk
• www.internetmatters.org
• www.pshe-association.org.uk
• www.educateagainsthate.com
• gov.uk – The use of social media for online radicalisation
• UKCIS – Education for a Connected World (PDF)

Appendix VII – Legislation and Guidance

The following guidance has been reflected in this policy:

• DfE statutory guidance in Keeping Children Safe in Education, September 2024
• The UK Safer Internet Centre (www.saferinternet.org.uk)
• CEOP’s Thinkuknow website (www.thinkuknow.co.uk)
• UK Council for Child Internet Safety (UKCCIS)
• The Data Protection Act 2018